{ "Event": { "published": true, "date": "2026-04-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-06", "timestamp": 1775520181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "07e06ba1-f41b-4bd0-8e34-61092d888470", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2a13af-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1775471020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471020, "uuid": "9b6c7799-9e4a-4a8b-9cfe-a92756c5d2b6", "comment": "Malware payload (DattoRMM)", "value": "39df9d1428ec6bd6eac5bc00eeb16118", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471020, "uuid": "623882da-f724-4acb-aac4-5e87cd424bce", "comment": "Malware payload (DattoRMM)", "value": "0004605ebfe027d41ea29b8fe1fde0995dbaceac94c52839d5202904a6798798", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471020, "uuid": "3df65e42-ea70-4528-9d93-91be5c487c34", "comment": "Malware payload (DattoRMM)", "value": "b1a8585694bc49f23290dd45caf57eb38e8e4d8c", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471020, "uuid": "9d3bc03e-ef40-4667-9522-9c543ddcb331", "comment": "Malware payload (DattoRMM)", "value": "022d3e3c7b8770007fbbbfda852a4a5d2211898bddfab77611dfc3057afb9ce3037dc8a921a790c686d1d7845aaed54a", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471020, "uuid": "ff4399cb-adbf-418d-8873-75db6ca02ff8", "value": "T11DB63347D9778DF0CA330B3890D2196B3305980E485BF4C9F609277ADAF35AA9D2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471020, "uuid": "d921d5f0-3702-4c6d-8609-cbc92e60a933", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471020, "uuid": "b14e7e1a-069d-4a1d-8723-5a468d9fb46f", "value": "196608:0aZk+woP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:mn/mzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471020, "uuid": "2c51da5a-5eab-49ce-be8e-0a4f8b356cb8", "value": 11056104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471020, "uuid": "7e122f05-10c0-4848-8d5d-d383e6c82cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471020, "uuid": "836c01b3-8b58-499c-aea6-c29ca390d8bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a20888-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463736, "uuid": "8970c5ff-08e2-4bba-8077-e72223cbea02", "comment": "Malware payload (Mirai)", "value": "7da913719c00b2d9b8d09252fb226f14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463736, "uuid": "48ea9960-be02-4177-8372-af9682060417", "comment": "Malware payload (Mirai)", "value": "00526bf2bce8acc85e37fc3a8f512f5f8a79abd5770765784c6f013eba65dd0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463736, "uuid": "1647f5d5-72a5-4928-ab78-f1a35096ee8e", "comment": "Malware payload (Mirai)", "value": "0de05709faf6e7b681d3926696e4a6a76a5c9f5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463736, "uuid": "cf59febf-666c-43e8-8990-92b0513bac3a", "comment": "Malware payload (Mirai)", "value": "a2d881eb82c05b8fc6bc7b5d26f2f060a6673e51f3b40104d74c07674f14cbcba84faeda2102af72bfb45a98d9078246", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463736, "uuid": "19b7e47e-c357-4cc0-a6cf-cf4fe9ce780b", "value": "T1C723F197330B75F5E7950076265674C8BA3EA886372A0BAF18D21DD3DC79B807E3C522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463736, "uuid": "ac4604fa-8f49-4227-a5c7-bcaafc138f79", "value": "768:xnVsFkDSjrnvvMLSPWoZ6Tqs2efQ1Z2o8YgagHnTA4u:JhsrnHJPd6eGfK2ZYgagHT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463736, "uuid": "1fe51126-e3df-4130-8cad-b10727c03901", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463736, "uuid": "cb2bbe55-3a85-49ec-bec0-6c5de087d6d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463736, "uuid": "3d829b5f-06a1-4ff0-8734-a7881fbb4b86", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630d017a-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442976, "uuid": "2686d03b-9736-432d-8077-a456a81f9cea", "comment": "Malware payload (Mirai)", "value": "036a922c4906b8ad5711f0e39c7761d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442976, "uuid": "8937f832-6f5a-4155-90a4-c5c72b960b80", "comment": "Malware payload (Mirai)", "value": "0078d477b3ea5157348902c5a7885b9afdd31b41ecb10f652b9a9f8f37a0907b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442976, "uuid": "648f9469-5454-48b7-b5dc-4bdb5159d5d3", "comment": "Malware payload (Mirai)", "value": "9a41b4fb9c15ac0ec48a3bc858a08d76d1873020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442976, "uuid": "52225208-8b03-42c8-8b86-e2c940beea27", "comment": "Malware payload (Mirai)", "value": "206d5e178619439003845f7bc611124925112e9fbdd063db4732af51c88aa8dff615267e58a9d5916cf768f3a7e3d6e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442976, "uuid": "ed028f04-ef9c-4bba-a2b0-7bf23c762d49", "value": "T1DF631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D216F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442976, "uuid": "a0fa7be4-8a67-4e26-874b-7383b4c1fc54", "value": "1536:zGYi7YUGCsKr5hSlCkTDYPSnJjCR86s/hX:zGYDUHYCkQKn4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442976, "uuid": "327d41f2-d020-47e4-950b-ae3d4408cf68", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442976, "uuid": "00edc031-6218-466f-a61d-8c7395309f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442976, "uuid": "f8739edb-06c1-4839-b9b7-9ae6e40df3b3", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91db692b-318f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775462812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462812, "uuid": "5dd7c0ba-04e6-42cd-a579-6fd8c82257f4", "comment": "Malware payload (Mirai)", "value": "dca40f08cc93bc2fba8e3f5fec18593f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462812, "uuid": "ec601752-e241-4777-93e1-cbb573f1e616", "comment": "Malware payload (Mirai)", "value": "008061f90f26a3462294a1d5b02424fab50a32fc0aadc0a7b05dfc70cce4e023", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462812, "uuid": "ca9063d3-8f08-43f2-bdfd-aa05d8b358b4", "comment": "Malware payload (Mirai)", "value": "b5987d8bbaa8166d8f2e8aaae619f25d91b8cb1c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462812, "uuid": "22c7e56f-fc52-4db2-9eb8-9a78a3a61b8b", "comment": "Malware payload (Mirai)", "value": "3f03d3144a22097bb0bb00866f62e2806eae47c69b2a4e61b0d915ffce4df7f8f75a49b900cf5fb346f1008f51e8a811", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462812, "uuid": "153bfc1d-2425-4d68-9ef7-079ce696ad90", "value": "T15341F19EA0F412D1CB8BCE0070E549C463CBB69976980772DF9D2D6AC08EE947C1DB35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462812, "uuid": "a4ca0d2f-7989-42c8-a013-aee9b589e3a7", "value": "48:WgkG0rPouY1Jr4Fn/4yM+UvoK6o7Gl3oIQ3MCD:iu1uz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775462812, "uuid": "162d384a-fd5f-451e-99b9-78907509b583", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775462812, "uuid": "0311ebb3-41fa-4e19-a9c0-d5c1d57d1972", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462812, "uuid": "0b13f5e4-4c4e-459c-aec3-67411da8d2fe", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172a197f-319f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775469478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469478, "uuid": "3244ef01-7c85-4391-82ed-fa63c4c782fb", "comment": "Malware payload (Mirai)", "value": "1dad357b98b1d1eefc6ec53b4ef7e442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469478, "uuid": "4a859534-0254-49dc-b120-6d549f65a691", "comment": "Malware payload (Mirai)", "value": "013a9df9d9c613502088ecd92a4998992bb14027989b044752f45243b73366d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469478, "uuid": "2cf13cf1-177f-48aa-bdd0-9d7884487466", "comment": "Malware payload (Mirai)", "value": "0dc43ff0fd2f9b1b82f547275a1c0f33f267b534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469478, "uuid": "391acf66-f7a8-443b-97cb-8207034f8fe8", "comment": "Malware payload (Mirai)", "value": "2c563516bfab225e6afa5bfbd7abf2c8a8ba936469c0d7b32e1a686f6b617673beb3604e2f91dd21edbaf94297e7f62d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469478, "uuid": "105360e3-f5dc-4347-bc0d-d753a66fb872", "value": "T193533B99F4029E3DF88FE9BA84160E05B93023D112931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469478, "uuid": "c9db5f20-7c34-4a99-b40a-fe2615309a70", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozfyC:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJ3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775469478, "uuid": "0adf0d08-7862-4243-908c-bf26cb1bad81", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775469478, "uuid": "db1fc9be-3b50-4514-a578-9106161b1e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469478, "uuid": "82b5a7b3-acb0-4acc-8c21-59132cf96641", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676747be-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442984, "uuid": "93582b7d-c425-4145-9a50-21382b232d49", "comment": "Malware payload (Mirai)", "value": "9e740bd0769278466e482824a1040148", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442984, "uuid": "fedc9f87-6418-42cc-8ec0-85dc288ca4dd", "comment": "Malware payload (Mirai)", "value": "04cb65f2f154595965f75cde6e09de500666c86be46ff0eb690ea724c4103fa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442984, "uuid": "651b6961-ca64-4427-8045-9e3b4930ccb5", "comment": "Malware payload (Mirai)", "value": "6c54848f0f2288a5a1b717765753437bfdc26636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442984, "uuid": "6bd06173-1f48-4c33-916c-493d859e5a9b", "comment": "Malware payload (Mirai)", "value": "5d4b0ff5a9a1fd3417408db975a88f31864f855a515e8302ffac3c2c8f632cdba5c842a1188386ced231db7a4e67c0e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442984, "uuid": "c59297c0-39c1-450b-9509-ba6f26ed19d5", "value": "T1DD639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442984, "uuid": "9ac9b311-3e20-4ea0-83e9-d218f0f77de9", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udc:DYkwfCFlugsz9xznsxrdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442984, "uuid": "537ea267-f049-4041-a8c1-c9d027867965", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442984, "uuid": "9e8e7bb8-3153-4948-89e7-be829f218373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442984, "uuid": "b7f10349-c10e-4eae-a317-ee9149a2eb3b", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a82b3e-31ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502520, "uuid": "6c4bc4bf-c83e-47f7-8f5d-e016038544d6", "comment": "Malware payload", "value": "3d2d51add1a1989c1e7cef9ab0b5c6c6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "xpi", "colour": "#92FF14", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502520, "uuid": "2e37eb48-cebb-4758-bb68-c359951e7d7e", "comment": "Malware payload", "value": "053620962047f50a91c6e8d1a6519eccc41fab51473f033086b4d816abe8bcb0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "xpi", "colour": "#92FF14", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502520, "uuid": "3d7091a0-bf66-439e-99dd-6eac11691fbe", "comment": "Malware payload", "value": "f63e2f56c99efd651712dadc27e29f06889c607e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "xpi", "colour": "#92FF14", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502520, "uuid": "f302196a-e19a-48b7-8005-a1cd472986b8", "comment": "Malware payload", "value": "fe0cc0a26ae5a24455f3c8a79b6aa66f6d7cf1d67d3ce4441bbb29003bca119c88911cb30fa76623ca7eb4443f2200cf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "xpi", "colour": "#92FF14", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502520, "uuid": "45340d3f-6e79-4c14-b4f8-9ab5481444bb", "value": "T14BC2D03B92785215C2379FF802EAA96AED2DDB04B660708B067D326DCDD33D21B45327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502520, "uuid": "16ae383e-ee31-459d-8507-0215d7342643", "value": "768:lU2P/NU6GowBxYeIQHuqZui0AGZtXMY2K2W0+:lFP/3G/BLIQruiLR9Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502520, "uuid": "3b714864-902b-404d-b26d-80f54dd2a925", "value": 28203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502520, "uuid": "50b2f879-2667-4695-a704-92451189250a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502520, "uuid": "d8750e48-2e46-4a46-89df-30c6a532018e", "value": "base.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6539c7c0-31d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775494520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775494520, "uuid": "28904831-8945-454a-a299-9106b73499fc", "comment": "Malware payload", "value": "101707e6e27bd6a9742da111f341529e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775494520, "uuid": "3c3ee344-4209-4513-8dab-b63c6f0c4d43", "comment": "Malware payload", "value": "057ab1839e6b6be055ec100a30f86ffdbd005f7871057f4daac10cb80ad12646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775494520, "uuid": "1cacb397-fd93-449e-83ca-f669ff7db374", "comment": "Malware payload", "value": "d1f3b101ea7ea2f9acc8196e659040023aa04a6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775494520, "uuid": "a42f96b4-e33c-4264-a8b2-09d3202bfbaf", "comment": "Malware payload", "value": "783f3b44e230e41f4f10deafe6020d125943e8beee4bc9504c228db6a2ba37f7354e8bbd66e64a85dee994205a8c2f19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775494520, "uuid": "1c86ee4d-206c-4fec-b150-396c7ed2c8fb", "value": "T1E5157E99E7C798F1F65300F1068FD7E31924A2265043F6F6EB8C1A977432B526E1722E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775494520, "uuid": "783a7e7a-7367-4051-b76b-4abe8dc28f83", "value": "24576:EMXaohE6hjGO11P7gB+Mx8rr/DaBRyqW1rzemBTnZD:ZaohE6h3jitU/DSyqmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775494520, "uuid": "5d86c1e7-e59a-464f-815b-58d119169cc8", "value": 918592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775494520, "uuid": "c04686e9-6259-4398-8031-9b3e7bee80d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775494520, "uuid": "b510f06e-0f28-405a-84bc-0b9a0ecbdbdb", "value": "client32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f342ce-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463654, "uuid": "a1d72cd1-fdb7-4a7f-bde4-515e0312afb6", "comment": "Malware payload (Gafgyt)", "value": "d7794d3235343d851b0f718f47264715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463654, "uuid": "fba5a5ce-6967-4f1d-ae31-7660bf713555", "comment": "Malware payload (Gafgyt)", "value": "05e8bcfc1f5ae44413daa7e5dc772d4316901be7a59fe3862a6c3f8fbf2de19c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463654, "uuid": "586e68db-3ed6-492e-a6a7-373056b5b530", "comment": "Malware payload (Gafgyt)", "value": "9f9b3078895c1d549e53cc8e622e24badee70bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463654, "uuid": "710754e7-be12-41d4-9255-06e72dadefe2", "comment": "Malware payload (Gafgyt)", "value": "3f7e55ea68e8f3144c51281556beca0ed318efdde9e3d03ffd4f4b096cf1910b43e9eaf73c53914de5e2b96fe35cecb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463654, "uuid": "0f74ca45-7f21-481f-8cd5-d54974ffdc3f", "value": "T1FEE2E1F49E496E7185F02830EC5AC1C1B3870BABD69152FE1DD459ACA9E6A0033BD4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463654, "uuid": "736d1a48-3cd6-4d59-a382-5e39703132dc", "value": "768:uMv5IESo9RMCnzm6vIbM/wjtWJsjglFVq3UirRhrP9xI/acR:Xlh9RMCnz5vIbHtWJsySPUCcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463654, "uuid": "74e81b7f-2215-43c1-acc7-784aa73aafff", "value": 31936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463654, "uuid": "5b9d6b26-155d-4080-b88a-5bdd984903a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463654, "uuid": "47707d0a-4b81-40d3-845d-acfeabe8ac8f", "value": "cali.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f864789-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "1adb2986-9fae-4e42-8f5b-4d17bdca9e6c", "comment": "Malware payload (Gafgyt)", "value": "ce7513b256a2bf78cd1bcc2ebf7541e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "0bb1ed32-1ff2-422b-8275-9b6db635ba73", "comment": "Malware payload (Gafgyt)", "value": "061600511e812a0e23246c2aa02a590918d59d9efa9d4e9af06cf8fab2b27411", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "2e9d8956-8fc5-4489-ba30-6cedea01a88c", "comment": "Malware payload (Gafgyt)", "value": "536da6b5560a4b50e42aaa0e4f5f02f224e1e1d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "7278018b-db3d-4b69-9046-d683f1224491", "comment": "Malware payload (Gafgyt)", "value": "bce6d42017d1bb52fe999bf4c9852fa9e356d870957cca5c221be9a4aab9e2ec977633b07a83b0f64c6e648b7f7ec20c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "fca2da72-9091-4ad4-bf9a-dc53251a9d42", "value": "T15D33084AD142EAF7D8830BB1019FD99E0631BE2A8A324F6BB71C7DB85B725C43157352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "127f115a-ff4c-4431-8aa8-7015eafa95d8", "value": "1536:yG2O2frcvCuYUu/JslMvj+11f9A7pd3CP:b2jcP9u/il4+TS9d3CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463640, "uuid": "988c42d7-8ea8-4c96-8da5-b3a386e98d8f", "value": 53876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463640, "uuid": "07bbd7e2-acd1-49f4-a4c1-a49405907c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "5216da6a-7f0c-4667-844b-1959f21c85f4", "value": "cali.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d4ed29-31f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775506114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506114, "uuid": "2522e273-8856-4f5c-9ad1-3bdb7ab158f7", "comment": "Malware payload (Smoke Loader)", "value": "650c00bed1b3ce7db2e8ddfb949a5576", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506114, "uuid": "564fdf9f-76cd-4934-87c7-b6b45a6667ed", "comment": "Malware payload (Smoke Loader)", "value": "072533c1d31d83b056a1a9f4174a23763c53597df1c89ad9c545df2c3bb35f5e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506114, "uuid": "9ca3f1ce-e332-4628-97a7-eb0739533281", "comment": "Malware payload (Smoke Loader)", "value": "350c7b55675d1cd6903ac8f12dcdceace13f1d43", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506114, "uuid": "dfb6f754-c21f-4c99-87db-10ab82c26e81", "comment": "Malware payload (Smoke Loader)", "value": "751c5dd227d5adec215717145ad144e4012dac07c2a859bdac7cc5c06b3602c1711ea32616bacb997ba9ebe419ff6111", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506114, "uuid": "3b18fe66-11a1-4b6c-a7eb-6fe3cd313813", "value": "T1F7655A4A7CD048BAD4AA933288B25296BB72F8190B3333D32E50B7793F76BD05975714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506114, "uuid": "bb5a2286-bf29-4f20-83ca-845eb9bc012f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506114, "uuid": "9d342fb4-ad0f-4fce-a23b-7ae109a533e2", "value": "24576:DEkUgb1pX1b+KZRlxxyqGRWcbgAAAAP0t:DEHgb1P+KrTxyVcAAAAMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775506114, "uuid": "ec216660-56c8-4174-9526-92dfe4ae3cf1", "value": 1448064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775506114, "uuid": "c145cebd-c9f1-49c8-9657-95566366573c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506114, "uuid": "9a0997f3-cc92-4033-8b55-d84b167148c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b25399b-3202-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775512219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512219, "uuid": "be380103-f7ec-4901-b978-6215e4e3bd67", "comment": "Malware payload (QuasarRAT)", "value": "4277be71edf3fc8ce18176fc4dbaee46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512219, "uuid": "800a19e1-46bb-4c99-802b-6f6e9ea3e3ca", "comment": "Malware payload (QuasarRAT)", "value": "07f86311a3fb9a91265e0874a162bba01c58c795a9c5c909484d9448a0dff4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512219, "uuid": "8705f240-66cc-48ac-82fa-f86c6643e448", "comment": "Malware payload (QuasarRAT)", "value": "c633412e8327b0e33bd7da5615bf54c5a6053d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512219, "uuid": "fc216c53-011f-4769-9335-37f0e7365162", "comment": "Malware payload (QuasarRAT)", "value": "9e4be480a9127a4f699ee94523b60a3e369cb92fb3285fdf67ae2cf1f940610052248749cd7a3594b4c83ed06b38c7c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512219, "uuid": "54df7071-eba6-4ccb-bcf0-3e11c3ec82bc", "value": "T17CE54A1437F85E23E1BBE273D5B0041267F1EC2AB363FB5B6181677A1C93B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512219, "uuid": "a0e9d1a7-c4ca-4a2c-a800-97f0b3a24091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512219, "uuid": "9e799b5b-bf53-472c-8adc-f67e79900dcd", "value": "49152:Xv3vE2H5aweBHPbl6T/yGaqA6/tCq1J9LoGd3THHB72eh2NT:XvfE2H5aweBHPbl6T/DaqA6/tCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512219, "uuid": "d34b8585-7e16-4ed8-93cf-0ca1055f5a6e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512219, "uuid": "04c30194-5681-4789-bee7-d68185b55b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512219, "uuid": "147bcb5e-5244-47a5-bd20-eb27712a800c", "value": "noice4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a3e38f-31e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775498255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498255, "uuid": "cc3babd8-9cfd-4760-9e55-341acd1cf0d0", "comment": "Malware payload", "value": "7e5d31a2c1a5eb1ceb54d6317df04306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498255, "uuid": "2abde630-3436-4e07-ae2f-b1a9dee2c39f", "comment": "Malware payload", "value": "08c60d925f8010a0b7904f9a00a251c55cc92f95f9e3127e4dbd392634bb69dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498255, "uuid": "e2b29c9f-c793-483e-b1d6-acebe40a20be", "comment": "Malware payload", "value": "5b3a0521c56e82746c12047bc9c97cf354f35dea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498255, "uuid": "53796350-8f00-432e-bf4d-984914b27f7c", "comment": "Malware payload", "value": "aecd32199ad2241a2cf7d80d1e2caddc3291bb16025e37ccf6abbacd20a726b188102f761a2be040f453730ecf44016a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498255, "uuid": "a75a3cb5-bcac-4f92-a1db-29e58606ee14", "value": "T16B867C83F2E691EDC056D070971AB227FB32B849072466EB53D48B243F76BD02E79725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498255, "uuid": "cad9e368-574f-42c1-ae72-923e0e584ff7", "value": "4bd564206745552972a34af7e186aa52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498255, "uuid": "8f585621-4b1e-4392-9cc8-4c81be0ba702", "value": "98304:gdJnd9uwBTc6BT/yBRNDa5UtTpea1fMTsEs:2jc9RQyFea1ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775498255, "uuid": "6c0c08ba-fc3c-425a-8f3b-9879ac009c85", "value": 8521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775498255, "uuid": "2eeec4a1-f26c-40e1-8082-1ad604859440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498255, "uuid": "945ac828-c421-4350-879c-167f210e0231", "value": "app1_v1.0.2-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cc23af-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775443004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443004, "uuid": "4ef25e9d-a773-4b40-8c6a-406305c94c0a", "comment": "Malware payload (Mirai)", "value": "4a3548f00db7d32409aade060f01be13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443004, "uuid": "5137e118-7b60-4b5c-b585-d94dd6c4c64c", "comment": "Malware payload (Mirai)", "value": "0905ee0d0eaeb506f368e57f4a0cb246f5768823cf66853967beeceba347bd27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443004, "uuid": "62d5675c-3b42-4378-9250-23e33b6c7c75", "comment": "Malware payload (Mirai)", "value": "bbb434f638c392e99a293f61850364bc13cd3631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443004, "uuid": "48936926-7551-4b96-a31c-7d43963a10a7", "comment": "Malware payload (Mirai)", "value": "09ff8e558af90914bf43e53f20e3d6a0b3cfbd2e7abd2271eaae3503e66ff1b0dda9406862db74e10f8aa1364443b836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443004, "uuid": "fa3782f0-ff40-48e3-9955-a944597140ef", "value": "T1C1634BC9F983D4B6E897093010BBBF639DB3D6BE2168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443004, "uuid": "17e94564-0ad2-4e37-9817-f1ec0c62e76b", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSYd:ltFyA0j4HWBJOvwfIyqsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775443004, "uuid": "65f69886-89aa-45f0-af68-5e40d6cd776e", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775443004, "uuid": "1c422de5-d86b-4c18-a408-57e5f6095d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443004, "uuid": "ab233b6c-e6e2-41eb-80d4-de4c1a83d83d", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9bf175-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775515844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515844, "uuid": "175b555b-eab9-4545-9126-acf904f41074", "comment": "Malware payload (ACRStealer)", "value": "0194d33117613fb1a07031ae3c81d440", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515844, "uuid": "e759b663-7e06-491a-9378-9f0d902d7caf", "comment": "Malware payload (ACRStealer)", "value": "093b79e8169cccb94d05d9484615168bbcbc7162eb3050453fa5e041ce7bc740", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515844, "uuid": "22c5e15b-a4d2-4c90-9df0-e5fcdb1b3131", "comment": "Malware payload (ACRStealer)", "value": "eeddf7b59c7d5977c06d89b84823a1d066842248", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515844, "uuid": "cee13c3b-56b3-4d85-afca-c92f28f9ac8b", "comment": "Malware payload (ACRStealer)", "value": "c7de04636a2fd3215a7ac1fa74a9684f04ac4cf8d96495e8a2ddc98f4f54b481bdd76f598f6fa8ffea0177055a81ed19", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515844, "uuid": "0aa0c9cc-1031-46ed-91a4-db0861785473", "value": "T1CFF54B0BECB94CE9C499E2748433A147BE64B8401F7163D72AD0B7682E737F0A975B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515844, "uuid": "9aec5dc0-72db-45b8-ac20-38a99086b121", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515844, "uuid": "28b4eb4d-0791-4f53-bd84-12c294b9cb85", "value": "49152:aFG1r97uNG0a4xC0cRK74bBhmc1LjAQcgEIu:Op5mvFhmg+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515844, "uuid": "00d40c60-da51-45b5-9600-35c3476af6d7", "value": 3518056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515844, "uuid": "19bb3483-21c1-43ae-b59a-65abdb425ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515844, "uuid": "f673b5d5-867e-4bff-84cd-6d471ac1baa5", "value": "SecuriteInfo.com.Win64.MalwareX-gen.57218759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfefb89f-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440985, "uuid": "170555be-5ad6-46e7-a09b-12fb9cc8cdab", "comment": "Malware payload (Phorpiex)", "value": "60e830dca70636a17da3d3d5b740b000", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440985, "uuid": "dc973d3a-53ff-4d31-8115-949e75aa79fb", "comment": "Malware payload (Phorpiex)", "value": "0a5a72cc1d69e1f0c6113c84e634e9b9c82b8e7bc9d05b6732da3a4f5d81761d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440985, "uuid": "1dc8f5a3-5618-4fa5-8e05-140107e42f80", "comment": "Malware payload (Phorpiex)", "value": "a020130b334a55e20739ac19f31b1d712f4f5599", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440985, "uuid": "191e8ded-0ff6-451a-b577-a079b338aae2", "comment": "Malware payload (Phorpiex)", "value": "5b4efbaf9a3f06741a79cec625b81cb81e1dbe822afb3d63f65afe4806673d99cde39f5a128f385d7e35dd3e205f682b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440985, "uuid": "da8dea9f-110b-4def-bf62-913f2fa35cba", "value": "T1D3823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440985, "uuid": "a8fd3603-ff1d-457c-813c-e3bc809640b1", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440985, "uuid": "77a7be0a-578a-4a61-984a-f596318417c9", "value": "384:2I78VGwSRFqw/lsx0xu9NHRgdav8U9cJ:rXhsx0U9Ea0UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440985, "uuid": "f0a6e42d-9605-4f79-8d88-98f08d35f67a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440985, "uuid": "5d7bc3b8-50cb-4190-916d-39acb528bfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440985, "uuid": "2edf3729-abb4-462b-9a5d-d2f9302bdc91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c3edcd-31a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473695, "uuid": "9857e2e1-849d-47c7-ba45-b060750136ac", "comment": "Malware payload (Mirai)", "value": "55f76754cbceffd84e07762898f05084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473695, "uuid": "94742b39-2e0e-4278-908d-bc1d30324598", "comment": "Malware payload (Mirai)", "value": "0b84ee93a149cdeb2e076163df4e5e2b15fab53ae843b976aa47e0b4db3b1d82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473695, "uuid": "833f597f-055a-419b-9884-649f5aa9cfb2", "comment": "Malware payload (Mirai)", "value": "5b24bb889ae92d56c17c08af17c939376ee03b8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473695, "uuid": "910b2edb-534a-4d8a-b12b-04c44e381f73", "comment": "Malware payload (Mirai)", "value": "5d707fa2dd80838045afd475b4697bd4969c1da7b6fcd032ce70f0548d332066b8c411517c059c3778ce8d31f9013ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473695, "uuid": "539c5ccb-d905-487f-93a6-169a3ff4a44d", "value": "T11A735B21B97D1D27C4D4E17A22B78B66B2F6120F14A88B2E7E720FCEFF515C06A16570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473695, "uuid": "106b3cb5-09cb-4675-802d-f520cb3cc228", "value": "1536:cDcMXfZcx8/5msC87jBrnua+9CJEia2NAAZWaW5NkJ:Ob6U5meBrzf1NAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473695, "uuid": "06e166fb-70a9-4918-9da5-348d2c6f69d9", "value": 78480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473695, "uuid": "534cc8c7-1ba5-49c3-b46a-e39ad1649a6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473695, "uuid": "62af029b-c812-4a21-8ba5-5df10e015a20", "value": "mao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cab2a9-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463625, "uuid": "90d4ff22-2406-4ca8-9640-55c62c37170b", "comment": "Malware payload (Mirai)", "value": "7e1fd39c9fb729089bd01b4a3cd2071f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463625, "uuid": "1699ebae-adf5-4656-9e14-4a34e6bf6d98", "comment": "Malware payload (Mirai)", "value": "0c635a845f285a5b4cbe3ec0dc7cd3f2b20f3e580634c459c0e6590411f034d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463625, "uuid": "19fac636-1f83-448c-9106-9dcd23062e63", "comment": "Malware payload (Mirai)", "value": "baaab616a66769984348e302e3aa05f2ecb2a583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463625, "uuid": "32d46432-c6e1-4371-9a1c-741d04d1c3ed", "comment": "Malware payload (Mirai)", "value": "60ecb79c5dc3a1062ed237914fe7c73c2d7a16e76015690ac8d9a1bdeb168ff620927a3937794fdf44fa396cc156d165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463625, "uuid": "6d6cb25b-23f1-4d11-a049-20001b58bd1a", "value": "T14FB2E0EEB5228066EC50B97F4DC24501C112B3DD669F4796374AA7D363F3479CE2064E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463625, "uuid": "c66da124-6715-4797-8920-2a1702a72bac", "value": "384:MDkkze4ZJe23S15KBCfT8pYlXWCU0xbgX9TvlFvmo5iqF44Ok36W3VyonstLubE3:0er265KBCmYlXWCbmXddFv5VF44OO6WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463625, "uuid": "c433e307-e430-44fc-b8c9-e2ba551f6ae1", "value": 24100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463625, "uuid": "0ce8fdbb-e377-44a2-b649-bff8cfe8c5b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463625, "uuid": "d701a6c2-f8e1-48a7-983d-52ead273bc80", "value": "cali.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b476c2-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507274, "uuid": "26bf14ea-7f90-4fc0-8a92-d7d1c80ece68", "comment": "Malware payload (Mirai)", "value": "f2b453979c2b0c9eb87670762a2cfea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507274, "uuid": "b9bd229b-c668-47da-af91-8dbbb452949d", "comment": "Malware payload (Mirai)", "value": "0d2107ca2cd06aed5154c157f07712013cd5fbec0fa059af93fe014c91d9d524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507274, "uuid": "263816ea-93e2-4fac-858f-d753446264de", "comment": "Malware payload (Mirai)", "value": "6ea396459bcb91025f46888e3eaf86133f0cbeb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507274, "uuid": "89ba7331-2bca-4b74-a598-232d01c4405a", "comment": "Malware payload (Mirai)", "value": "1902242f14c5092cbf625801eed16f33b30b331c81dad1db3bb9f6533ee112b123e8af69919559c2060885edda846b24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507274, "uuid": "8aef4165-c6a9-4ce6-89ff-56ba8b9669d9", "value": "T1AF833A27BE724E27C4C2B6B522F30738F6B5ABAA1C78411A7C712DCD6B641D031567E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507274, "uuid": "5b6cd94b-b368-433e-9f6d-40feb5235bf4", "value": "1536:t44DOr1CfjQZkwjZOTljA7hi6yxlM5At56tph:tRDOrc850xjMhxyxl81zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507274, "uuid": "a468b2b6-7d13-4428-915f-1f7a48f45bad", "value": 83508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507274, "uuid": "c67ba4ef-cf51-4b3b-adf1-37eb833e0f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507274, "uuid": "0f25886b-f782-4ca4-bc8c-222b5ab394cf", "value": "SecuriteInfo.com.ELF.Downloader-DN.71385536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a875f982-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463709, "uuid": "1238f97d-f844-4de0-a7e0-4c2920fdfd82", "comment": "Malware payload (Mirai)", "value": "2b1de67d8ca90ffeeac0d07b36691e7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463709, "uuid": "b1fb55ba-3fbd-4d29-a444-9be9288dbd3b", "comment": "Malware payload (Mirai)", "value": "0d767bd5f98b23b81ec07c17fd44ddecc846155949e81331fce62194a0a75698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463709, "uuid": "e89d9c5e-3757-426b-a74f-b69c3e6f86e3", "comment": "Malware payload (Mirai)", "value": "3c87b354df5a4e440c6e136910d6088468be59b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463709, "uuid": "095ed9c7-7ecf-40f4-bd2a-6cb5e216de3e", "comment": "Malware payload (Mirai)", "value": "3c8a240b9bdfb9fd598d7403197e83c375e6f34f082c723d285978084afa3b89fb3abdffed6b738829424f7dcab0759f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463709, "uuid": "eb37040e-4af5-47d9-81c8-365eff4cd0ee", "value": "T169634A81F5A3C2F0E0834570006EEBAF9F36AD664125D667FB683931FCF17524846AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463709, "uuid": "a6fd7779-2218-4130-81f2-812b21985044", "value": "1536:ezvpB3G025EdrB4xKxFpLaWffIkSZapoAUBE4GG1oMYior:ezH40xF9aWnyApkr5oMYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463709, "uuid": "e2edb60a-1423-4833-80ba-e8c0687e1a88", "value": 70804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463709, "uuid": "816eb308-9631-45dc-b545-69783b631d1c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463709, "uuid": "fa62ab26-b0dd-494d-b644-0ec4b56bae94", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873bbd02-31bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775482551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775482551, "uuid": "1efb383d-2121-412c-b127-4470072b56a1", "comment": "Malware payload", "value": "e99dd7e35c82ac87725e0db633513918", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775482551, "uuid": "6517f3b0-98ce-4336-b722-38cfdc3be010", "comment": "Malware payload", "value": "0da71e6f13adb924e250ef67bc53b0b5e957f10586f6305b39ea1bfa73ae764c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775482551, "uuid": "7ebfbffd-8c79-418a-8bc3-a5446bab7ed1", "comment": "Malware payload", "value": "d581b80cde5faf38bfe4a82e9cc01a51a902045f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775482551, "uuid": "5c29e425-8893-4dc6-bec0-93b51a908c5c", "comment": "Malware payload", "value": "8d870fb5b0f961d2639a721f1984c9e9497d7bc910d6110bb6b88bdcf1365b6a4dfe5645546d11bc7725a640f11aebdb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775482551, "uuid": "29e72fe7-6a86-49f1-9b07-a49339d0cfb4", "value": "T13F0833D9C3A40D9670ADA467AAB23914F7FB114E7DC64BB6B708E31F66D77D2908C800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775482551, "uuid": "03138a44-9aa4-4359-bead-6183ee21705f", "value": "1572864:WhAi9BL/twBREfpxao/HJV0AX6Dq7CP2aLSQoc9AkeRMqF4C9vu/YLFGl/7sq9U:WhAODtwBSxao/H/2P2aGQo9keRTyW2AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775482551, "uuid": "823ff192-c638-425e-8f9a-9a95481f7e78", "value": 77524598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775482551, "uuid": "30d32298-37b9-49bb-921e-43858c00bc8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775482551, "uuid": "6a3d97c0-1740-40e1-a2f8-f313e8ea58d2", "value": "swiftpdf_v1.3.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea5c00f-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463612, "uuid": "ea7e5923-d65f-4d10-86a2-5cf69cd52684", "comment": "Malware payload (Mirai)", "value": "bb1d089a992350d4d45aef7a2f5190f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463612, "uuid": "5b356c8e-6dc8-4605-898c-8e33e801e2d3", "comment": "Malware payload (Mirai)", "value": "0dbe04e2373342275ff1e25963440c56b07ab056a23927cfaf94a1d7ece8c596", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463612, "uuid": "8ba37864-4573-47a0-8a1a-7eaf2ffdf6b0", "comment": "Malware payload (Mirai)", "value": "1a5929fbdc61ef1b8aae71b5fb208e4e19c1e7e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463612, "uuid": "6a2d8833-1048-4b09-a586-b41f08b112ef", "comment": "Malware payload (Mirai)", "value": "870990c99b51398966728630cad23a723378496e04afebae9339e200b4d270a7a26d5df7d5139fe2910e2a3005c13db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463612, "uuid": "70f0f879-66b3-4ea8-86de-217c3e97fd2c", "value": "T170B2E1B610B69B57CCC0B074122F15BAF0949E2B85CB0D3B71AF7FDC58B807B591A606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463612, "uuid": "d369e1db-cd0e-4657-9016-416f7c5f2a3b", "value": "384:MEdPMEMOLxI5KNbLSLnIolgdZwob1uRmqsHSFFn9YmmER5so1V3Igq/ZJmJHSg1F:HM7mIENOnxqJuRmpo1VI7bcJN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463612, "uuid": "7bcd711a-3c01-4d7e-91f2-799ce03b8791", "value": 24500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463612, "uuid": "6f5d8f2c-9d27-49e7-bf95-fb2222a8edba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463612, "uuid": "7fe326f7-bede-4030-8b9b-42e8ad44b7ee", "value": "cali.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c3278e-3188-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775459783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459783, "uuid": "0179d40f-249f-4526-a080-265b986fb688", "comment": "Malware payload (Vidar)", "value": "c6b3ee5430bc8e86c8ad38b97e3dcaad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459783, "uuid": "6a2eb5c4-bf3e-4186-a4b2-2bf573dc09aa", "comment": "Malware payload (Vidar)", "value": "0def8fbbe23b25adbc523fcb7245f7fbbdc7fe570dd4a4ce03b46ce6e07b195b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459783, "uuid": "1e999fa2-f3bd-4b05-8708-e2a87fe10136", "comment": "Malware payload (Vidar)", "value": "80122ad801fce61f4f51459bda43fa6768b0d2f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459783, "uuid": "09baffe1-c8d0-4c44-8ceb-bd68d7ff7e8e", "comment": "Malware payload (Vidar)", "value": "db6c3c22c5ac3eab8caddd1bc7572b90758f3470f519f3fc5008718c00ce2cec16adeff3e55f176f477c3d1589e3299c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459783, "uuid": "65401222-95b9-4dc5-8f56-7ccecd88665b", "value": "T155669569BAC71362194106E6588EF3E7FA3B3574D7D745D2309E801D6046CAA03FA3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459783, "uuid": "c91e8be2-dcc5-4ec2-b7ff-a083fc1afb8c", "value": "3b75822d3f559271577125cb713ed2fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459783, "uuid": "3df4cbfa-c34c-4036-8d8a-51dc79d8370a", "value": "24576:cSOVxtPSGwKkxhHmmWQe0jTiVAZai7QNPY+uHYQe:c5TSGw5hHHJbIiuPuYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459783, "uuid": "7b3c2366-3a93-4d26-95f0-3d6c303c45c1", "value": 6495850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459783, "uuid": "713454d7-ed41-4dc3-9dcd-72ed87024142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459783, "uuid": "432feac1-b9fe-463d-8f11-b16723f03aa1", "value": "0def8fbbe23b25adbc523fcb7245f7fbbdc7fe570dd4a4ce03b46ce6e07b195b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25d811e-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440962, "uuid": "ce217543-1633-4106-9013-d8f9ecbbbdbf", "comment": "Malware payload (Phorpiex)", "value": "8dc359215d61af5fb89b2de1aab20b0d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440962, "uuid": "af6c15a3-648f-4f16-9574-6cf819a51ac3", "comment": "Malware payload (Phorpiex)", "value": "0e934989907f2598cd5745ad5a1530dd63161263d2b1f9e142df4d5e635dd349", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440962, "uuid": "cb90aa23-bcca-4d26-9b21-63f128854ab7", "comment": "Malware payload (Phorpiex)", "value": "86746172d8b8ebd685adef3ec8fb5344e6cce4c9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440962, "uuid": "4dc7bf2c-8d22-4e76-bd23-ab7025cdda10", "comment": "Malware payload (Phorpiex)", "value": "aff1fc2cac8cd6f2aa0c665d39eb659e387a5945d754e0bc2d31e68c90e092fff8e742fda7d0848e3647a00b01db500d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440962, "uuid": "24937fc0-4b21-416c-9a2a-235b78f7238b", "value": "T14C823A0FB9424216D0D100B4A672867BC9B9A87637C864EBF7D44AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440962, "uuid": "a48b3d63-738d-482b-9058-7ad6f44a40a4", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440962, "uuid": "d4e50012-f258-4013-9c87-e653cf8a5b1f", "value": "384:TI78VGwSRFqwDlsx0xu9NHRgdav8U9cd:wX9sx0U9Ea0Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440962, "uuid": "3226cec1-c20b-4a2a-8506-f52b0c22a17f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440962, "uuid": "6f23ac79-fc40-4921-840a-19076d356d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440962, "uuid": "da43c866-1d2f-4f63-b668-9dbad2c0ceb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35bedc-31e2-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775498263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498263, "uuid": "e3e83931-13da-4be8-9dea-c462014c2318", "comment": "Malware payload (RustyStealer)", "value": "500c7d1f81d73482e30a8e360fa8b445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498263, "uuid": "8fdea953-832b-40f2-a626-e5322bfcfaa6", "comment": "Malware payload (RustyStealer)", "value": "0e9a7a25487b99cb33dd61257d5162792bcdbf59e32b4a336e44c07bdad1b8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498263, "uuid": "2c6ef523-5b96-4ac6-ad3e-f68721dc586c", "comment": "Malware payload (RustyStealer)", "value": "5d2d41542c7390deb26d864e27d3cd5d7e59b059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775498263, "uuid": "2c0e7b4f-2b45-4f96-b6be-9fa914fcf85a", "comment": "Malware payload (RustyStealer)", "value": "7d2748bb5a1257ab69e8e6d1a5a7ebbafcf4e95df0c977a73f7395bba40c661d29ada29b47b10847c998f663e1ccd571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498263, "uuid": "1aa6820d-dff9-4221-b545-621b274740b3", "value": "T174867C83F2E691EDC056D070971AB227FB32B849072466EB53D48B243F76BD02E79725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498263, "uuid": "5ba08002-2ff4-46e3-b429-caa4c3a5aa22", "value": "4bd564206745552972a34af7e186aa52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498263, "uuid": "48c4ca8c-67a4-4cd9-8c79-80388f3e901c", "value": "98304:gdJnd9uwBTc6BT/yBRNDa5UtTpeaiZp3rEs:2jc9RQyFeaij3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775498263, "uuid": "c170b497-0f42-447d-9c91-b94b246fe32e", "value": 8521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775498263, "uuid": "e1390300-31eb-4e8d-befe-055dc09fc3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775498263, "uuid": "92258a45-2093-4ba2-b98c-dab31d3b9074", "value": "app1_v1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1102628e-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502109, "uuid": "5f9d04b0-2ef6-48ca-a6b0-2bcd1b54b709", "comment": "Malware payload", "value": "ab160e7821b8b3d0a6b6cacc6e3ff2c2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502109, "uuid": "da1a22ff-2273-48c4-ae7e-b1e618b68586", "comment": "Malware payload", "value": "0ea200e3538509aee34a4999e517c7ee2286d12d3e6c30e5a9e459cdee20740f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502109, "uuid": "ac367cf0-cfcf-4e41-9d71-589e9a359a5e", "comment": "Malware payload", "value": "d0b46169f7f6a6081eb998c8fe01a9044205f2a2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502109, "uuid": "4670cae4-928f-4ccb-821b-70f282bbff5b", "comment": "Malware payload", "value": "bbe82473c98312aac36bd6ccb8bc993b5c2da38f98cd688352b586475a5e7f39d2e4bedeff96aab9600df877bc3d1598", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502109, "uuid": "7f659a8a-748f-4931-85c1-a5f294e7bd64", "value": "T1E427AEE192D69C3DC5BDCB3964BA9516EA358DD2478108CBB1D13CF76233AC249B3287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502109, "uuid": "b85c18f5-51a2-4fde-b5df-dcad4ff07312", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502109, "uuid": "7a4df4e2-29db-4980-8bd6-81de7253f59f", "value": "196608:O/RC9A2A3/5EIE4DCwGg0GoiygnaqlsCA+ZfQmF8tTUe:O/Eq/NE4DCwGg0Gugaqm+fQmSwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502109, "uuid": "ba67ce96-b5c6-4159-b866-136fb6b285b5", "value": 20529824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502109, "uuid": "3c46918f-be67-46e7-96e0-d96a00ee1620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502109, "uuid": "5d5aeb61-d08d-49d4-b3ed-b7a8b99edafc", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef4deaf-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470404, "uuid": "64352141-6dec-40fd-881a-d30b32f60c57", "comment": "Malware payload (Mirai)", "value": "de7860fcdfe6099b286b49869cac046a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470404, "uuid": "b1327407-a5d0-4b80-b735-f319a5bfc44f", "comment": "Malware payload (Mirai)", "value": "0ed7a598904f21233222bebf00552b387b91883d181f22bf88f1f9983860b464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470404, "uuid": "d64b668e-96b8-44f8-9086-efddc9822cd9", "comment": "Malware payload (Mirai)", "value": "31b5a055fd711a6a457a281afb593a27911ac284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470404, "uuid": "5eb81b58-5d5c-411e-949b-3c0602343e44", "comment": "Malware payload (Mirai)", "value": "0600be6e7a8d950678436a1e11577ed43fa131dd0e30874808575d5670359aa308fe4d426839571572c6c821a4eeff6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470404, "uuid": "651be2e5-ded8-4c14-83c7-25ad3794ccb5", "value": "T1CF83C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470404, "uuid": "2b41eea6-f17d-4056-9543-6a0db2a6bb33", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAuEG:x/8RHTgMcJ0fmqJZOpkM/NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470404, "uuid": "b1792ec4-a4c5-4a41-acf1-de20e2850371", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470404, "uuid": "4a18ad6c-6c55-4ced-be44-5809ebd84327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470404, "uuid": "3897f1eb-2271-4a68-bbda-08da06fe6016", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b625bae-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463687, "uuid": "ef022b7a-bd89-43d2-bfd2-77f57eb7174b", "comment": "Malware payload (Gafgyt)", "value": "ab70e5e732e22b68d5d13de7aa748541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463687, "uuid": "3aeca2d5-42eb-4007-8335-1dbb5ddeaaea", "comment": "Malware payload (Gafgyt)", "value": "0f2b4b3f5f4dd70ec49c635ec0855dd9df7e596b98ce4946d2935508624cd1ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463687, "uuid": "76096489-b8ec-49cf-b4fb-262893db34aa", "comment": "Malware payload (Gafgyt)", "value": "e9ad8f6ae7cec24b8314d3ee01c3405871e57f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463687, "uuid": "2ac91f0c-f4c9-4e04-a942-501882b6addf", "comment": "Malware payload (Gafgyt)", "value": "8a7916aa045575fad560b84adc62b3132a775bf8f23797d4aa6a229476f0251d9795955459336f2a65ec25a9e3efcb4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463687, "uuid": "34f2848b-4973-41e1-a635-bd371f96b0e1", "value": "T16E532B5B672D035BC59B4AB02CA737F09BA9BE3012A211C4E50EFF844B72B747525F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463687, "uuid": "d01b4458-d7a0-4381-aa1e-14dae66dea7b", "value": "768:HUIJzNczaSLmNp6esnuyKns9ehx0uyfR3rcwmgcPYb9Qa0wStsRI5O7yzbRE2:OmNkes3O0ffNr1mgAPHtsRI5O7yzbi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463687, "uuid": "35aa3fed-333b-4645-98ed-2220301ce63e", "value": 62833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463687, "uuid": "84929125-3916-4c17-974b-0fe4c8f95890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463687, "uuid": "a56d4c3f-e068-43f8-b3c0-087d98519a3d", "value": "cali.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccefd03-3172-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775450536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775450536, "uuid": "b2b0d8c0-6759-49df-b424-e2eedd1b8529", "comment": "Malware payload", "value": "5acc495c403f321c505978239b6a805b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775450536, "uuid": "5677fa73-88fc-4762-8ac8-ee9cf24021c0", "comment": "Malware payload", "value": "0fb34ecb9aafd2b85f60cd85ff9ede8bb2a3cd5d3f4fc5b8d803c2ba21241075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775450536, "uuid": "9058b7af-cc3e-4f78-b6b0-0f87f5bca5a3", "comment": "Malware payload", "value": "e902aa0ad6486fdebc80d2c212185e22ef4c25d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775450536, "uuid": "eeb50a65-b07d-43ee-95ca-76b8258e52bc", "comment": "Malware payload", "value": "696ff8687210bd57a27c5b3fbc989f573eb0386c311f03751a9529b94fc7f5db3f0e237ceddf8f732d192309c1f5e8e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775450536, "uuid": "a1605bfe-2452-4108-a648-7abc308e27b5", "value": "T125C2E1582A028A8BC4372D76754BEC9979E3174E189F4D1812FAC1294BF272C67F131A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775450536, "uuid": "3ae6ecdd-cd5b-45bb-b309-98e5dad1ddca", "value": "384:TeV0foxTKXtuvwdtTX9KSyaBSBjeYTfo9mmQPgta8bN4Y75f3M+2ffVCBOi7+ngK:TDoQtBTX941eYFDgNbl5PatCbYUmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775450536, "uuid": "01f91651-d21c-4a3d-9428-9ead64d70bfd", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775450536, "uuid": "b0ddb861-ed0b-4846-87b1-f2494ec45b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775450536, "uuid": "832462eb-52ea-47ea-92f3-48eb2d8d861f", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2b5c5c-31aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775474321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474321, "uuid": "a440e822-0dbd-45bf-b31f-894bf900ba48", "comment": "Malware payload (Mirai)", "value": "4ec05f4e14c97c9af6bd19959c68190e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474321, "uuid": "1510d4fd-d386-4ae3-b211-74c3e90c0a28", "comment": "Malware payload (Mirai)", "value": "0ff27d4e151d2d6ebd26a50450bbac584d8fd79953e1bebefe947d32de7a761a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474321, "uuid": "39c71cfd-6130-4c4d-b17e-5e4a37abcff9", "comment": "Malware payload (Mirai)", "value": "6f1f24c70bcfee3d79ccf7b400e3365a8e6552e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474321, "uuid": "52d416f2-9c25-4379-a9a7-10f7b2432ef5", "comment": "Malware payload (Mirai)", "value": "b0e8bc84eda34999030ed81e57d1b4fa47ed157c2dc23397585228b41002908ffcf467eb064115898f9045c3b6caa393", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474321, "uuid": "0081c272-0738-4a89-a865-18d74526a4e8", "value": "T155733983FD81AA03E6D41376BA5E51CD33217399E2DE3203AD126F217ACA91F0E7B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474321, "uuid": "cd5b2654-c6a7-4393-bc1c-cadcc9174597", "value": "1536:5fgirL3sZ0njeacF9nWRtV0AsRuc1gNQZA6WWFKQ:5fgGLFa1WqAsRPSNMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775474321, "uuid": "28e48aad-5503-4643-8ec6-4a95ff692350", "value": 75276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775474321, "uuid": "26167c17-721c-4f5b-a72c-9b39b3fb500f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474321, "uuid": "9c4fed3b-f2f1-4afe-9250-93e61d32b409", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddedba1-319a-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1775467691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467691, "uuid": "350972c3-eb00-4873-bc68-46b36a546a80", "comment": "Malware payload (Stealc)", "value": "f66f95cef4621d33831cf86c5cfc5815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467691, "uuid": "76c72fb7-d90b-4e9a-9262-f643fe81628b", "comment": "Malware payload (Stealc)", "value": "1061671e20ed7a7687b490cb39f4cb7befc42b1b5226aad4584f901a083743b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467691, "uuid": "ae0a0c44-5d6f-4f8a-8dd6-81dd4612444c", "comment": "Malware payload (Stealc)", "value": "ef042454580efdf417af93ee8688fe5fbd66f11f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467691, "uuid": "d9abd413-d0b1-44a7-ba2e-639405d937aa", "comment": "Malware payload (Stealc)", "value": "47d1152fc7cba947df3c37f7fd846d9c4c74ebdec8614327a1acea85153c8ae9589e5517bf18d73684fe9ac24ca75cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467691, "uuid": "679b2ddb-7f9e-4f03-95bb-d504dd1b0d68", "value": "T14E546D0196D08BD5D11AF2B88ED5C931C7216CC82BA097FE8E7CFE418A31DA4DE3559E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467691, "uuid": "28993b2a-64c6-492a-9cca-0e817b2bf39c", "value": "1ad35ad75a00d46c9f76cab586995f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467691, "uuid": "33f35f30-1b2f-4eae-8394-3723c84c5e17", "value": "3072:yW8G/Gpalm5TR6Gl3b/tENLQZhdGWTDqjmj3q:yW8G/GQo5NXlr/tMQZhdGQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467691, "uuid": "27245c57-0d16-4a5f-a4f9-61184c1e6401", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467691, "uuid": "ccd8eeff-8ee1-4998-99d3-495593ca1efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467691, "uuid": "d1a5ef14-3fe7-4be9-9ae9-1e1988649ee0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.41669652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009e1521-31b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775479318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479318, "uuid": "3163fb48-7c28-4cb6-bf3d-0097255be3c6", "comment": "Malware payload", "value": "be1f47dd6783886f57acbc003fffb3cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479318, "uuid": "fb4187ca-4c53-4139-ad68-b93cf9118ca3", "comment": "Malware payload", "value": "111cc2d2232705565c4dbbddf7d16104bbf83554248a2ed0520b4e37bdc3acf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479318, "uuid": "2166504a-401b-497d-8202-c12f01ba8264", "comment": "Malware payload", "value": "cc72455fe74411ffe7e9559b9978371e251ec786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479318, "uuid": "fa72f42b-aa60-4468-8b1e-59ffd3ef85a5", "comment": "Malware payload", "value": "04ffddb5fc0a6ff4167a59ae71cc1354132f3720984bae9365fa0da720a2bf11f5bcc7cdaec6458e8737b0b0e3f09911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479318, "uuid": "b237f419-8051-40b8-bbd6-e4cec3a52e52", "value": "T1DB17334D0FE8992DD712DD70BE6F5D2EAF51A5420E3349DB8A0851EFF84119E6C3A2E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479318, "uuid": "d2a7b061-f094-4c12-b01f-5ec4383056e6", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479318, "uuid": "7bf381d0-8f75-4e37-8daf-8bb62e4cc45f", "value": "393216:XzXvxzhbO73I2U6TIl5a3i87geKiaYKOkvZozTMFlqI7ZgO:XjZzhb69fU+S87geKiZK/iTMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775479318, "uuid": "5308894a-90e1-411b-8d05-d5adf1395007", "value": 19116272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775479318, "uuid": "13672a5b-c0fd-4797-9b8c-82553b0bdaf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479318, "uuid": "c69e2ab0-d82d-4864-b504-7db68e8fc163", "value": "hypagent_b9k4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3a0693-3203-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775512788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512788, "uuid": "0a212dd5-4134-42b1-a43e-f71996946c25", "comment": "Malware payload (Mirai)", "value": "346016c868ebb68c1bee8841387a63b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512788, "uuid": "14345eab-6059-477f-a5f2-c22fe213ef05", "comment": "Malware payload (Mirai)", "value": "12ee4abf3638b14971a17e66f12cbcd1bbc190399b6121d39f0d68f793e9b5e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512788, "uuid": "62f0e291-74b6-4ca5-b813-b2bc1f1b3bd5", "comment": "Malware payload (Mirai)", "value": "af6f067a5749dde4ad0ac03c398cb4bb22db7c0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512788, "uuid": "1e99f4b4-cb13-43c7-bee1-4209819ff86a", "comment": "Malware payload (Mirai)", "value": "1f66eb8adc7a84c05315987db344d6513253237a31ce7f17be33aab4e9d70572c79ec12be9b5e7ef44fa02d0887e3a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512788, "uuid": "340f92a6-59a8-4671-ac2e-52633cf846c3", "value": "T18D830B49B393D5F0E84314B001E7FB395530EE720520A96BDBA4BEF39A339DA615632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512788, "uuid": "c0d3fe55-e486-4e19-bb22-5685770e796a", "value": "1536:dY6HyKSzqzxWVLx3mqQ/YAYAhH0gEjBLKWvLtz4jU+31c3/oVhLaZF70sr:iQAmzEHWS0CFLNLt+aA+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512788, "uuid": "6d7a819b-824d-4877-a25f-c3f410ef0117", "value": 85840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512788, "uuid": "47f60ce5-fd64-4032-8518-339b7342fd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512788, "uuid": "d89f59b3-8aa9-4800-927a-0bdeb12d9bdf", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9a39ab-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501597, "uuid": "7dcc6e85-c296-4dd5-818e-e5a4c3823981", "comment": "Malware payload", "value": "e3f5b359374545599605acac3de227eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501597, "uuid": "9da7564b-b49c-4677-bdfd-f6a759d59e7e", "comment": "Malware payload", "value": "138fbf53ed903dc0c23cdf86237acbf8fd2d897e4e7440beb7176ab483eb4974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501597, "uuid": "e36e7657-58a9-4c23-844f-613c17e4c6f6", "comment": "Malware payload", "value": "d9221d6032ec5421b16d20c9ba4a6c92e62d1a35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501597, "uuid": "541e2a3e-9587-4c98-89bd-67baef43415c", "comment": "Malware payload", "value": "9dc9dc10b21f1327da5c8e6eeff37f144529a4a823856d1848534b60c091a53d5a7425c6f62dcdc627a0343fd83ad2cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501597, "uuid": "2a5da64a-06e7-44c8-a043-3089635c3429", "value": "T11273074AF9829F10D4D913BBFE0E018D33536798E3EE71129E116F11A7CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501597, "uuid": "8c6b2a5a-0c87-4e36-9903-ebf4c20e350f", "value": "1536:K9nq3zwiiI5npnFUNh0n2iooZnknrw6iYhf8XllzfisgAXU5wbZn:5jwFI5pWNh02o2nrw6iYhMVgAE5wbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501597, "uuid": "b70d39ea-3147-44e6-9b44-140a9cc15ee9", "value": 75616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501597, "uuid": "6a7c5ae9-b74e-47d6-8097-be122979de6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501597, "uuid": "6f904a3a-3281-435b-8b5e-3b35900b28cc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5424afb-31b0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775477152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477152, "uuid": "f2cf9cd8-5dcb-4eda-ab93-8c8b944b66e5", "comment": "Malware payload (ACRStealer)", "value": "7c5c48514d852439654985d96a7b0e63", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477152, "uuid": "d121fca2-a430-4c57-9e4b-afe1d429b6df", "comment": "Malware payload (ACRStealer)", "value": "14340d8660d776f5b06baa94f1ebf81f97a24588f52384c003b6441f62e8f056", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477152, "uuid": "60ceee74-15bd-4c4f-983e-cd1213c60473", "comment": "Malware payload (ACRStealer)", "value": "626f0e085450a2d69fb886438a13e65b63f20555", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477152, "uuid": "afdb1da5-51a2-4b4b-8386-9d73816c6193", "comment": "Malware payload (ACRStealer)", "value": "79829c5a964905e7cd8d584bafb83aab1750c547638760db2a965c11cb2a5c3896a826955790bb66911eef8e1c001d48", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477152, "uuid": "720968ad-e7db-48ed-810f-24fc1cc18b3b", "value": "T16A65921F15D38275E8D6C4FD2758F7BCD9EFF022AAAB51298318D0F428A25950B9C31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477152, "uuid": "91499a38-aa2f-4b7a-8966-7a73bb56af2b", "value": "2ca968d5fb5546758e1111a22fb27ae2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477152, "uuid": "edefadf8-da14-4933-998a-437af3121e3e", "value": "12288:2ZJttRNrDPLk+6KCq4qc14po1NUaJg/L6VuYQBYV1235:2ZJttjbLoKH4qGVlg/L6o5BYVM35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775477152, "uuid": "4a7b6cac-e38f-4935-b809-d94c69eb0062", "value": 1447976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775477152, "uuid": "c19e0f42-430a-4bb7-84e6-72042c6b67b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477152, "uuid": "d42a453c-6dce-42b7-ac3d-7200c88e140e", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4f913f-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501595, "uuid": "999c4276-7e9f-4d82-ad07-7d68d4d97c70", "comment": "Malware payload", "value": "91b53cf57587d85f6002cc653dcf2256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501595, "uuid": "ba33b618-758d-48d5-8f22-646f92de906c", "comment": "Malware payload", "value": "1447a6834f024427654849663b93a547e507a538bcaffb4c86d92d023d1bcbea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501595, "uuid": "9e396b5d-895a-47e4-b5a0-0fccd4814c01", "comment": "Malware payload", "value": "e83665cd31cdb0b74fc1bc094a01ca2e1b93ea19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501595, "uuid": "90898bc1-8357-4465-8e63-46522fdfebe5", "comment": "Malware payload", "value": "feb37021298a0ccfabd07a5d426e1669f36518249e59dd1a7f97f7da7017e13ca3b8dbc7c386a57b0b562307fb2cf23b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501595, "uuid": "051cacd8-df15-43d6-9302-c40b86b84862", "value": "T1F863511E2E618FADFB6D873447B75E21F24873D212E2C640E15CE9015EA034E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501595, "uuid": "915996d3-10fe-45de-9559-bf2eca7f7ba7", "value": "1536:qZSWtG1Oyu8jDZAPvDMNYdDiwZwnUwbZnL:+G1OMlAANYdDiwZoUwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501595, "uuid": "aa58c3e1-f738-406f-83b3-fd61846460ab", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501595, "uuid": "6669728c-afd7-4e6f-b2d5-5cdcbbf952bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501595, "uuid": "4139db87-4b4a-41f5-961e-6106aa5832d1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523cea48-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499642, "uuid": "8213fe1f-c762-41ba-b593-9a27ab57a6ef", "comment": "Malware payload (Mirai)", "value": "a79dd58a3961b3b9c4e70a6e72a92c50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499642, "uuid": "5b9bf251-ccd2-4015-8f6e-daa38dc52b59", "comment": "Malware payload (Mirai)", "value": "14dac4f0f4cb0795c72476fcf4ff70246b42ee8d4c8ce381cc400b215e291edf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499642, "uuid": "88f0fda2-96c7-4ee8-8bd7-03b047740342", "comment": "Malware payload (Mirai)", "value": "063847eda0300f1beab8cfb715fb3d94265f8233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499642, "uuid": "d231da2c-9a9f-47ae-a835-16ebac1923f7", "comment": "Malware payload (Mirai)", "value": "e89795808c6b7441b1f6fb944db7e988c8eff7cb76e0206d24d3ce468f5e10cb0a2a28490cf1ce988479b23f86d529c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499642, "uuid": "3e941f87-7816-4192-81b2-75f6c509dc11", "value": "T1B6A31846FD819F01D4D335FAFAAF41483313ABB9E3FA710299249F61238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499642, "uuid": "20dbf40e-6ab3-4e43-aaa7-698912391d56", "value": "3072:kZZAuY5nTPJ+ya2wYH6DMmJNNQtHn1o/:EaMya2wYH6DMmytH1o/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499642, "uuid": "33ded99e-19d1-4d75-9f41-1553bc42ba41", "value": 105872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499642, "uuid": "b73a9b50-0fe4-4a76-9eda-9c44cc56155f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499642, "uuid": "cbb213a1-0c3b-4732-a420-d0857dfaf987", "value": "SecuriteInfo.com.ELF.Downloader-DN.57645736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c886d74-31ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775474694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474694, "uuid": "54d7b111-ab4f-44a5-8925-be5d8458a5b3", "comment": "Malware payload (Mirai)", "value": "0f614c0cf2ec8d568c035902927069af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474694, "uuid": "a9f15e01-5a80-4b0d-a9fb-7a3ceccdf75b", "comment": "Malware payload (Mirai)", "value": "156ed8a333c8d51ab3c140a2c03bcb0c809d6948dd46aba73d1c33f0c8fc803f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474694, "uuid": "83c1b8bd-04f6-4802-8987-cf4939975bea", "comment": "Malware payload (Mirai)", "value": "116887724d81b06505a1c372555e862c85d07857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474694, "uuid": "6ca04c58-61f4-456d-85e3-c1f914b2ee2c", "comment": "Malware payload (Mirai)", "value": "f3f03340335f304e48b298e497bfe9d3a54d27ab3aa2062b599d6fb4a191ebbde9c0975ceb6bf4942ebde10bf759420b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474694, "uuid": "e0f066d3-89d1-4a4b-b792-8ee7a0246f34", "value": "T1A2C2D070F9C16DB5DEFE9D38881189D03BE62F5937E2CC9A208DED155112D36D6A8B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474694, "uuid": "f0a205b6-d122-4a63-a5e8-043d2e0a5e4f", "value": "768:7KnqLiChP7gI5gBZw+LajRJ44uVcqgw09o:7KqL1h4Zwa6344u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775474694, "uuid": "e7040edc-aca9-476b-abe8-7909a3567a62", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775474694, "uuid": "bb70fce9-0ad5-4e73-8785-8082f27952d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474694, "uuid": "55826c97-8861-43b2-932b-9d73a1c1b035", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e60805c-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442969, "uuid": "d553a61b-9411-4710-8834-c04d4baf579c", "comment": "Malware payload (Mirai)", "value": "52775f119f927d0822384415391a0d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442969, "uuid": "6964dace-ee04-4b2d-a265-ec69aee96d21", "comment": "Malware payload (Mirai)", "value": "15844e4f618a1d0adbf241b110b2bdd19bfb2f35f08eadc0c5abad3d751b1e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442969, "uuid": "b3c9f955-0ed9-407c-8838-b4c211f3f818", "comment": "Malware payload (Mirai)", "value": "cc7e6da78baf070dbc0ed0944156100aa55c264e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442969, "uuid": "37a94eb3-b981-4beb-9277-51ba5c201ba5", "comment": "Malware payload (Mirai)", "value": "bc03ed44834210718979221a5674203dcd4d761d928f63ea7ca31c009766a08b272aab03c6597a8bea70b155681acf73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442969, "uuid": "72719045-b56e-4639-8b2f-364f12f1adcf", "value": "T153B3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442969, "uuid": "3016970e-5682-4e03-b553-b3f88e65c6cf", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgD5/LWW:8YSZ3e8ZE3MYlphDgD5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442969, "uuid": "be7bf3f8-fe8a-430b-9c9d-356ef44f603f", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442969, "uuid": "1e5f43a5-1347-4e83-85c7-61f12d44b743", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442969, "uuid": "f720539c-2a70-4541-b2ec-b545b95adc73", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c0fabf-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442934, "uuid": "92a89a22-74aa-4099-b24b-e1dff2cdaf5f", "comment": "Malware payload (Mirai)", "value": "d417390793de8a066002814e2908da9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442934, "uuid": "7f03f988-5aef-44c5-ba77-76551ab89ee0", "comment": "Malware payload (Mirai)", "value": "15bb2f7858c0e948f64fd1eaef59c7cd8bd01d7ee7e7781620926df674c648f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442934, "uuid": "e92f57d8-86bc-4ab6-8d51-c625a65eeff9", "comment": "Malware payload (Mirai)", "value": "2a4d5aa05ac333caf3c9b112ff298479f58fd1f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442934, "uuid": "342c10b5-b9b9-45b0-b67c-0275ca312cf2", "comment": "Malware payload (Mirai)", "value": "356d038e4babd03ab7bf53202b7266f85d587d5ed140d96a9f7db3431e93252d9ab47081d7a24bad85358a8500fd91ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442934, "uuid": "0012b574-0d72-44ab-ba16-386584bce57a", "value": "T1A4F2E2661288707382F49D73D9B187F12E2B00B5D1E533D06FE9838CE15671299B7EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442934, "uuid": "0315d9ff-2d99-4ae9-a322-9d8a7a53e39e", "value": "768:7rFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GliBRs3Uoz6:7/eRSnQjMgVuP7qtqxgtAN8z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442934, "uuid": "d1fb8aea-2a0d-4c16-a31c-24a6743fc15e", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442934, "uuid": "8d5c0c5e-8b79-4f84-9124-dd737d715812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442934, "uuid": "c8098bfd-8df8-4425-a561-2af7d450e2b0", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b746ffae-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775502388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502388, "uuid": "17049a8e-8053-43da-8335-1cb068d3c3eb", "comment": "Malware payload (LummaStealer)", "value": "4116843eaf755a8dc20986505a8d81e3", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kokorostore-it", "colour": "#13A424", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502388, "uuid": "383a271e-cc53-41d8-840e-bf9c62527b21", "comment": "Malware payload (LummaStealer)", "value": "15c5bd47958ff77a04a8edbcc9e8def54cdbc890a61f8d68a8609b7fd1db144d", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kokorostore-it", "colour": "#13A424", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502388, "uuid": "1734c3ed-ad59-47e4-a43c-1be2c6da7305", "comment": "Malware payload (LummaStealer)", "value": "4e39fe371d254e144b117c5139259e22a8808846", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kokorostore-it", "colour": "#13A424", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502388, "uuid": "c2fef894-11ee-42d6-bcc0-f863f072e681", "comment": "Malware payload (LummaStealer)", "value": "1bea99a1bf06ab7d15fd5248f3bc8b7c222fd8ef9c501af7949492b4f001fa9e1d714bba77835e3ac86dc8e05d078959", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kokorostore-it", "colour": "#13A424", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502388, "uuid": "a6f3da96-c761-4e14-933e-5e593042805a", "value": "T164656C00EDCB45B6E416133249F762AF7736AC090F32AB83EA447679FA776D11832356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502388, "uuid": "44a85966-bcd6-45c3-81e4-fca1b9ea67c2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502388, "uuid": "09580474-df45-4e30-981b-9a02ab5fbd9d", "value": "24576:ZPks7M7DUtaQvLJzN+auQTnf/PGLykeFalfJA+8pIy0fCiXd6pC2jQmXRxG2oHB5:Z3Yi4nE/OuCXmZkBC0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502388, "uuid": "48d782df-e00b-4347-ab72-32e386dbe124", "value": 1530512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502388, "uuid": "5fc2f903-5eb0-4f23-bc03-6f721727fde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502388, "uuid": "71e1d793-2f4d-4159-9698-1b45a52073ff", "value": "mixnew22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985e5f31-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463682, "uuid": "c32f1ade-1cb7-4dc1-80cf-1ea4c05efd64", "comment": "Malware payload (Mirai)", "value": "80afa13f3753152e22bb9a4043389c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463682, "uuid": "f48fc0c5-4d57-432c-bd26-6c60b6407a0a", "comment": "Malware payload (Mirai)", "value": "178bbc7e4181d89196b2208fa1ee10989d2c1364013e56bca163ca49e4f61206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463682, "uuid": "5d0911e3-495c-4b70-bc79-e695b29dc4c1", "comment": "Malware payload (Mirai)", "value": "9215ed101df5b3c30982d87cb22dcc3d4a97529b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463682, "uuid": "0f061152-2a01-445e-8d95-227ea0731315", "comment": "Malware payload (Mirai)", "value": "100cf41054f3126b6d92a0179d348fba17277023b96ab1e944704602f42a4c98f4bee20ac6afa8cc59f5f0bbcc606480", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463682, "uuid": "64ce5cef-6c4b-4a2c-94b0-5609256514e4", "value": "T1F4F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463682, "uuid": "56b0eb08-a5cb-4d09-a3c2-2d3e1186ad09", "value": "1536:YdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMp5En5p5M/LW:a7vDtrnPTR71gmX7Dy7fMp5xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463682, "uuid": "c415734f-a5bb-4dac-812e-993fb121014f", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463682, "uuid": "ea47e72c-d081-4ebe-90c3-b520d39cbf99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463682, "uuid": "12ce0e7b-08af-44f9-ab48-e8345e82aed4", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746e4690-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463621, "uuid": "2d426edc-dfd5-4614-a9df-967a22bd41d8", "comment": "Malware payload (Mirai)", "value": "cc891173d246730107fe24534697661d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463621, "uuid": "aa6b6727-fdeb-42c5-90d0-6b0c87ec2a75", "comment": "Malware payload (Mirai)", "value": "179c981f19c19c2a0d1cad2ca7e8e26893a0e68e0d50f422e4246173e8f3b7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463621, "uuid": "b6a0a85f-8d53-41e7-a008-31d9672e7f4e", "comment": "Malware payload (Mirai)", "value": "b8c8db394854273908788b47ed88499186f058c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463621, "uuid": "af9ab138-dbf3-44e6-a285-0113fe2c68b6", "comment": "Malware payload (Mirai)", "value": "af88f7d7e4f066e8691f2e6dffdba3fdc17b36498a10fbcaaa52b54ded87759b8c4ebfa86994aeb10c7e389f5f261b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463621, "uuid": "f5cd43d2-db98-46bd-825d-4a52e2e00d1c", "value": "T1F8E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463621, "uuid": "e88f80a9-54d7-4bed-ae49-c2573cbd12fc", "value": "1536:p+FTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4Vx4dbK:pmlybKpzEOfGQ+vEubTt4ouftL40dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463621, "uuid": "15221a9f-adc4-4872-9c7f-f6085969041c", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463621, "uuid": "165fa2af-7a20-42f1-991d-bfe759653c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463621, "uuid": "2ddaa3d0-f16a-4308-82f4-f5e5f7166aa3", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d56a2-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470862, "uuid": "797f1cc4-e595-4cf6-b007-13c6b213b331", "comment": "Malware payload (Mirai)", "value": "215e0c06f1ef40c606dcb616e73142c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470862, "uuid": "5a75ece7-7918-4121-8c8f-ef026320435f", "comment": "Malware payload (Mirai)", "value": "19865318517cf7eef0e157c2738f1f4dbf8e844f9440a91cb8dd8b2072be58c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470862, "uuid": "1d6fd3e5-83cd-4cce-a910-e5216174a885", "comment": "Malware payload (Mirai)", "value": "3a79eb247a29741f46bc404bc193b1fde7cb6566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470862, "uuid": "923aebae-911d-4d98-ace0-2186ba97ed7f", "comment": "Malware payload (Mirai)", "value": "30448a8b7edf96284b27981eca49a8326c5c1ea26c9b637350a88e69ef275e16e57adebdbc58c417be71c741164d2406", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470862, "uuid": "e4c2f809-853d-4940-a290-119263288eaf", "value": "T15D732983FC81A613E6D0137ABE1E519D33257399E2DE7203AE126F107ACAD1F0D6B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470862, "uuid": "3222bd3f-44e0-437c-905b-ffbe3a1a9ae4", "value": "1536:zNJssPKDpdSTsObuLVoX7ek1NbJhvUt0G4iZA6WgFiJ:zNJsgKqKV071bJhUWG44F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470862, "uuid": "89361fea-eca2-4392-ab15-98e0d33adde7", "value": 75272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470862, "uuid": "8130c399-f40d-4ba5-97e0-6988b3b727f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470862, "uuid": "7b87e474-e202-4764-bc40-95f493b260b6", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72bc263-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463706, "uuid": "bb6e00cd-89ec-42d0-8682-0fd2f9667b5b", "comment": "Malware payload (Gafgyt)", "value": "a9544889b863fc44803ff0c65f4fdbe6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463706, "uuid": "d1a8e11a-8fac-4c97-bf63-de652a4a3d03", "comment": "Malware payload (Gafgyt)", "value": "19f94ee231feeedcb293e6b988ad00874b820608e67c41a4e1a73333592cda2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463706, "uuid": "236aa98f-4556-4b67-9c00-9e538a1e7718", "comment": "Malware payload (Gafgyt)", "value": "ff0b33b5e8afd23f25580fe433a639f0a11643e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463706, "uuid": "8a223d8a-ad87-4936-877c-e225bf27ea47", "comment": "Malware payload (Gafgyt)", "value": "caa5df0390357aeb6d860eace3d94615260f4bdc316769246ba05783591d4ed7065c3d0e9a21e0a01df610e472750a6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463706, "uuid": "872e80f6-b6a4-4621-8f9c-940916076a12", "value": "T126831905E9504727C6E127BEF79F828E73236E546B9B331156287BF42BF179D1A38120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463706, "uuid": "6a541738-8f8b-4c43-8792-50dffc770473", "value": "1536:EDn9MQGR5eQvZ+aaXkPeJcp/iFBxbQm8colKPzWtEtmy1pQhpfbQ7N:9QGR5eQvZ+aaXkoxbQm8colKPzWqtmyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463706, "uuid": "59512cca-95c6-4b73-a843-a1b77eb1a6d2", "value": 86205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463706, "uuid": "c093ca29-9fb3-4d97-965c-df539df70d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463706, "uuid": "f2458d69-5490-47fa-b3d9-f9e3bc455c01", "value": "cali.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ab9966-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499647, "uuid": "09fcecb3-756e-42b4-a58d-00ecb692de45", "comment": "Malware payload (Mirai)", "value": "5df8bf7a6f9451c2a82743790d848072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499647, "uuid": "7ed7c1de-52d5-415d-804b-ddab4a3dcd7c", "comment": "Malware payload (Mirai)", "value": "1a58d18dabb5c6634f666fee690bdc82492e1287a6fb04df41305e5b77141b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499647, "uuid": "2f29309c-55b2-4f3d-9cef-9f9903fbcb26", "comment": "Malware payload (Mirai)", "value": "4e383bfb1cdfe2ca56fbfc3543806d6ec4fb3433", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499647, "uuid": "59fae995-edcb-4ab7-bb45-44ebd31dd44b", "comment": "Malware payload (Mirai)", "value": "c5a5570d42894bdb38c736aa19ea77f8500c83dba5da98a60c58880ecabf175007aa25fd4d94262cf238befc2d8798e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499647, "uuid": "2e7a365b-a48f-4697-8023-68c2ee86260c", "value": "T1ABA30702AF611FABC86FDDB306E60A06348D7D5732B527757974EC28B61A1C70AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499647, "uuid": "aebb4862-fcd0-4d23-b7c4-89c1b00102e4", "value": "1536:gLw+IgE8Wrv2kUjXlm4ZAo6W+gGfxjyLdu/LXZSwubHf0a2jc2VcHmZycJ:kw+79Xl1AGuTXTffVXycJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499647, "uuid": "5db854a6-90b7-4734-9b0c-ae8dafd53855", "value": 100168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499647, "uuid": "bbbba79a-fc53-4b2c-8f21-f4ae25966bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499647, "uuid": "97d3931b-67db-4abe-97b7-b3e4b7ec4fcf", "value": "SecuriteInfo.com.ELF.Downloader-DN.91396655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173d6c43-31a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471625, "uuid": "6ca26a7c-1974-46ef-aef7-ec1fbce8ed09", "comment": "Malware payload (Mirai)", "value": "cfe940fd23724a1761bf20a4fea0fa33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471625, "uuid": "932a7a71-e379-454c-98df-7b21916658d5", "comment": "Malware payload (Mirai)", "value": "1a85f3fb20e23e4b220afb2c2c3a3dce30c71af30e1bb890c80975807f1382ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471625, "uuid": "24b0320f-5833-44e7-8d54-dfc1389d3bf1", "comment": "Malware payload (Mirai)", "value": "358d17c18662f201fec6289c2c2726321df9b82d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471625, "uuid": "ea977388-318d-455d-a972-775eb47ed97c", "comment": "Malware payload (Mirai)", "value": "c4dd8b99cd24d26c5d122a61ac38a6e8ea3726f21592a4d4408917c28f08d69a2dc17953c3f19232e57ff2c58ad7a176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471625, "uuid": "c34d92a1-5264-4b5d-933e-6c65de23db09", "value": "T19F734B213A352E17C4E5A07D61EB4722B2F9374D24B4CA1F7E722E8EBF1452071176BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471625, "uuid": "074fe02b-f1b9-47e1-bf6c-4c070eb9d817", "value": "1536:kLwVD05xZXjFZBc9wyMOTEwPjjqlbCioh1aStftMpdYm+a:sc975WMirSf2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471625, "uuid": "021504e8-b1da-422f-bb8c-51b2e4f393d0", "value": 79128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471625, "uuid": "09ce73d2-7f9d-4819-bd2e-05237fd41286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471625, "uuid": "46aacbe9-33cb-480e-95a4-9655dd8697a5", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c1048d-31fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775508712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508712, "uuid": "8fe1974a-3c65-46c1-b6b5-b7dc6722193b", "comment": "Malware payload", "value": "8968c68c213e28463adea0a949751e23", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508712, "uuid": "2cd58982-2655-4b85-81cb-eb2b1d9f5f4c", "comment": "Malware payload", "value": "1c715cd40331ba2ca6559d2fdb958e7f44053080f9ffd3d90bd1916978d336cb", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508712, "uuid": "6976ae1d-13f1-4b16-b2c4-00bc2a6a0add", "comment": "Malware payload", "value": "1f63b11060789061c09321609484407029ccf353", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508712, "uuid": "80ccf229-3c7b-4a0a-a98f-8f00cf38b6ed", "comment": "Malware payload", "value": "090336096231ff7ba9a5deac8d815ab3619d889e138359d28882d9a8ad26d4309d0ba40e7dfdec4b26f2489c69ee1040", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508712, "uuid": "1f3f4bc9-aef5-45ad-987e-cc6668861757", "value": "T12D634453126B6613D5CE37F57A4BA369F120FE413DE598A9BA9483C08FA974F3423780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508712, "uuid": "bdf82b2b-2213-41e9-b552-8b7326b3e6f6", "value": "768:7GBEHJTK6C6hBs+l4AbCW3bXxY6TiOsVV6ivddqlSTOUU:7GBSJTKJr+lp3bhY6TiOsVVDvddxTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775508712, "uuid": "f555ba70-382b-4942-ba4a-eb71d5b7a0a5", "value": 70120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775508712, "uuid": "c54c532f-cbbc-4a0f-8bf3-55e76085c748", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508712, "uuid": "14548137-99bc-4f6e-92e2-e65ce4ca31cd", "value": "8968c68c213e28463adea0a949751e23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5eda53-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507284, "uuid": "9a6c6666-cc45-4c8d-9256-fdbdaec969c3", "comment": "Malware payload (Mirai)", "value": "e6c89b3367a0781ee0de82e5aed9f1f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507284, "uuid": "e10749a3-6c8c-436c-ada8-ce69fbebf1a4", "comment": "Malware payload (Mirai)", "value": "1e9bc2f5a21e8feb629213c2f39c1952c3015fe2ecf4423629136bdb2f307292", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507284, "uuid": "695bdcf0-dda8-4047-a80a-050fddd908ef", "comment": "Malware payload (Mirai)", "value": "b7bdf0382c9f5bc620e3d499621ef7dc633f7678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507284, "uuid": "60e08fb9-0719-4b9a-a1bd-2a6424264ded", "comment": "Malware payload (Mirai)", "value": "191e326a6ef1ae1c0ffb61228fc72af8d0389de002b4dcbb9bc0adaff2fde3e8d4c65c60cb0793b23ba5187536a8b020", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507284, "uuid": "11fce242-0af7-405c-a45d-fd4af64edac2", "value": "T16BA3194AFD819F02D4D321BAFBAF414933136BB8D3FA71029D249F65238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507284, "uuid": "8f390937-1ce3-4282-92d7-994d265a81cb", "value": "3072:TsTrqAxyruxaXbsafwYH6GwmnsNMdtn1y/:AeuxKbsafwYH6Gwmndt1y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507284, "uuid": "f670e2da-df11-4b4c-9fae-efe32485e497", "value": 105888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507284, "uuid": "0c2fbeab-d716-46a7-a071-246def7c4a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507284, "uuid": "43ab785d-d043-4baa-9821-84c62df83464", "value": "SecuriteInfo.com.ELF.Downloader-DN.77399653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51371a-319a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775467396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467396, "uuid": "7c8dc50c-b931-4a65-902b-7f60faca58af", "comment": "Malware payload", "value": "afb2d06d93c62e7677b841dee0f1368e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467396, "uuid": "cc0fe5f7-2686-41e0-afbd-10c386b2849e", "comment": "Malware payload", "value": "1ebbf7035f69c40cfd61ca7bbf1c0785f5ec7d93d809a1561249fa0bbcb22844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467396, "uuid": "44c131b4-b7c1-4c74-aed3-b17e78e79e7a", "comment": "Malware payload", "value": "55de723ba5dab72b8c42aaf05bc8172ed9f279c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467396, "uuid": "b67e0c5e-b81f-4745-a64a-a25166671e52", "comment": "Malware payload", "value": "63a86d9e8dc5d843ccae945f7b01f87d2e7ae02d323899e3c742f64321b5b5f5b48936b23b91641854890a62b9f3a40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467396, "uuid": "80ad5923-fc52-4c27-b6e0-b397f3bdfdb7", "value": "T15A17CF03F356DA4DC52AAD3883A4A3A37351FC605736A35FE6C56F1C9C8B6C00E6D698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467396, "uuid": "e217bd70-e6dd-43a2-84ea-b5f87ddac903", "value": "bd9d18d07a19dda4789fd9da615f0652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467396, "uuid": "ef248962-267a-4b57-a205-420e0f9eb746", "value": "393216:9Gfxr+i+HRdD+HgP+HDUK+Hq0+HW+H4x5/9q+HABm+Hb2Mvcyf:9Gfxr+NP5Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467396, "uuid": "2df5d245-4b0b-4ab1-89b6-ab5962e005c6", "value": 19942400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467396, "uuid": "7564f862-e5c1-41b9-a352-900142117cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467396, "uuid": "320d1103-3233-4bea-b83d-50ba7c3516c7", "value": "swiftpdf_v1.2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c440187-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493511, "uuid": "6910a926-18f8-4226-9521-8e022393cdc7", "comment": "Malware payload (GlassWorm)", "value": "2a086675a04a74a81100f66a20688e03", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493511, "uuid": "89b7e8c8-8c82-4e2f-bd5f-3827a2eb8021", "comment": "Malware payload (GlassWorm)", "value": "1f51780838c5ca56336645bfc6e2812f4a68b8abd6d02bf62bc308b62a583bb8", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493511, "uuid": "d421dabb-4d35-4ec3-a533-6e8e2cf1db75", "comment": "Malware payload (GlassWorm)", "value": "ca0efede0d7c82f7cfc42abe8c9ab24d5485ca92", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493511, "uuid": "3118c1b5-d090-4d27-9e24-c95426baae88", "comment": "Malware payload (GlassWorm)", "value": "3c1cdc487c2044db522228f27d4be7a841a67217341e46622518f0112e0883d55d6d8766c567f69ea423fb1f2fb6ac2d", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493511, "uuid": "1ac678d4-6e3a-499c-a1f0-788d1c3b4254", "value": "T185756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493511, "uuid": "c2532a3a-e7ff-48c2-bf7e-a4dfc2156297", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493511, "uuid": "11257217-4f56-4c73-b524-1eeb08f1c297", "value": "24576:mds9Esxlce6k91UOld2LMxmeDozCMZyFFlYEymOCUwPPacP:mdaEglcAHNaYczYjyL2PPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493511, "uuid": "4b87c41d-84e8-4b3c-b7bc-20465022d3c4", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493511, "uuid": "2b12a003-e79b-4ca0-a79f-83e2ab87344c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493511, "uuid": "8af104ee-1088-49b4-a80c-1cd9f660c4f1", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c6e265-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502191, "uuid": "d27adc66-d87b-4c4f-a253-90ca193aac0d", "comment": "Malware payload", "value": "cd1ec04dd6b14019c57f336e773b8eb8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502191, "uuid": "f26afb34-d13d-4b15-8156-5babd4238249", "comment": "Malware payload", "value": "1fae9cd03adffad90966b47e49b93c4fa7e69587ea78191d73cf79ee68215e5c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502191, "uuid": "b685d367-8f88-44ee-a348-3f861fcc5794", "comment": "Malware payload", "value": "704f62d1b75d45532514295a6c79243e92746ad6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502191, "uuid": "a60aa606-2fa5-4966-ac39-797de3073984", "comment": "Malware payload", "value": "40f69e598a4f81d34a9c9785bb8e6195bd321fe29a4b33f33f5928048fd2c5dc650611c3b4bb1f7a4894da5604df493a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502191, "uuid": "24e5a35f-16e7-445a-9f28-6e546a0dca9c", "value": "T12A4733937B5D4E7EEE5E6C394CD2ED024A3B580A71BA04E7DA4DC1EC04332531BADA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502191, "uuid": "1c53f669-082f-4cd0-a41d-81a72823139c", "value": "393216:hXjJ+oM/Aylv5NWLADQ24+a28iHnxiM0IsqqloDE0RLhsiYTgMCRMJNl77o4:h8o/6v5QWQ24+aPILql6DRLhYEMp7U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502191, "uuid": "18fbb80c-92e5-46bb-b983-5e46f0fb0880", "value": 25396179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502191, "uuid": "98c2a781-c3c1-4a0a-8932-4048df12cb13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502191, "uuid": "b93d8ea7-bd29-49fa-b8e3-07a5dd79fed7", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d54c9b8-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775443047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443047, "uuid": "bdf6468c-f0bf-4ff1-b453-081b7c85385a", "comment": "Malware payload (Mirai)", "value": "325a70547d7f406e61b2e86e6f215903", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443047, "uuid": "0a2c8a62-41f2-45c3-85f8-ca8f2457bcda", "comment": "Malware payload (Mirai)", "value": "20a659bafdf109997932c0f921ea181e8d7ded2f27eb92da82fcd1200cf76646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443047, "uuid": "1e631e96-725a-4c28-9d8d-61a9e1d23a2f", "comment": "Malware payload (Mirai)", "value": "b3a299356a3a5498d927f9e1c1cd206ce70822cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443047, "uuid": "0ad0caa8-5020-414b-bfd7-12fc6da82cc0", "comment": "Malware payload (Mirai)", "value": "45670c6c06fd1268962ff764c62d0e922126c593b7188a875d667a60168ea4f3e60f6e7d1391f13cf2c5ceccb272a87f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443047, "uuid": "bddb26c3-42f9-453a-8813-c28d9fc5467e", "value": "T1B6A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443047, "uuid": "fe3c0307-072d-4148-ad95-f2cc562e53ec", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6YNYK:5ZzjJa1rZ62yqPy/ULWzj6YN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775443047, "uuid": "c49e8858-1d83-483a-b2c3-56c6b365e10b", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775443047, "uuid": "930bb53d-eb5c-4574-8d91-68c6a5d161f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443047, "uuid": "dfbe030a-c8fe-416d-8b84-18098a3b836c", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce7c0ad-3188-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775459824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459824, "uuid": "bc4a202b-dc52-4746-8338-60f0440cedc4", "comment": "Malware payload (Vidar)", "value": "d75b4f0739a47a47c79fada50a036f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459824, "uuid": "f7048cdf-46ca-456d-bfb1-d30195a98f62", "comment": "Malware payload (Vidar)", "value": "20aeeae33a3888cdd258a700df67e4109bca63a5c9ca3bc4d4907778903be648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459824, "uuid": "88ff33de-07b0-4e9e-a62f-57ec2ea0c684", "comment": "Malware payload (Vidar)", "value": "40e1dd36d6b401b94a42734183939b5dd1562988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459824, "uuid": "35cbfdbe-0bed-45ee-9f96-8db4c9d06627", "comment": "Malware payload (Vidar)", "value": "1a2516ea63eeaa219f7c58a4aeaaa1d5186206074cd83012f958882e5ee65fb08aa0823ba6c3e46cce48727baa6aacc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459824, "uuid": "bb53bfa8-42f5-4551-b0e0-f9d4e3733e5a", "value": "T12D958C4A7CD048B6D46A533288E391927B75F8190B3223D72F50AB783FB7BD06976724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459824, "uuid": "1d5ddf81-4268-4b56-ab47-6f02f745afe6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459824, "uuid": "f00e3cee-e5a7-484e-800b-713b85b15de3", "value": "24576:k2oIk92m2kGzEWvBBr4BPMFssGY0r+ixlwDC8UmIdbqGRWctyLb:k2Dk9J2kbgGY0ySK28UBdbVub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459824, "uuid": "2137bc75-ac25-40ca-bc1c-f861fa1d5b75", "value": 1898640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459824, "uuid": "585fb7f0-ddf6-41bf-9868-0bbdaf6e24ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459824, "uuid": "7a0311e4-64e9-4129-a897-11aef1ce2d22", "value": "20aeeae33a3888cdd258a700df67e4109bca63a5c9ca3bc4d4907778903be648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09362ed0-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493506, "uuid": "214debd0-6b2e-4944-aff0-da9f1b0f9e3a", "comment": "Malware payload (GlassWorm)", "value": "258eb5621ee435bf654ce2fdf4b344fd", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493506, "uuid": "894fdf6a-35ea-4306-8f52-ca78432c8d0a", "comment": "Malware payload (GlassWorm)", "value": "21a634d93f53c611356089ce472b3dd0fd6de5037fb98a48c8d64ac8133292ab", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493506, "uuid": "22c3e447-8912-406b-8027-0dd624273922", "comment": "Malware payload (GlassWorm)", "value": "f655aaaf518e3a1ddd3bb79ea6105a2b0907788d", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493506, "uuid": "94b3b9ef-608e-48bd-addc-92f38feb92a3", "comment": "Malware payload (GlassWorm)", "value": "c8106867821d6c1ee8d99e75320b7c7116931619e6dc4607ced71cd1d6f39aa7cfdaf622da259c6d49872036f6d1a3a7", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493506, "uuid": "cdad5235-f6c2-46d7-94db-38040abaa4a4", "value": "T1D725BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493506, "uuid": "e5fe997c-56e0-44f6-8a7d-d77799392948", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493506, "uuid": "cfb42681-7dae-43cd-8ff1-50e8d9a2aa22", "value": "24576:w+pqF2TyOEe0JRh+w+kY5bsY5b5Y5b+c:wsThEeiRhxYqY7YUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493506, "uuid": "5e1d2e95-d453-40e6-bca2-dbe8e838ef08", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493506, "uuid": "46aa7616-ad90-4426-9dca-0c1a97078027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493506, "uuid": "6462db0c-282f-40b3-ac6a-4364bc19ffa2", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2c3e19-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496944, "uuid": "a3d09b30-c389-4a59-a048-5db9295eb7e4", "comment": "Malware payload (Mirai)", "value": "917acb6dd5eb1d3cebf62aaedaaf8b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496944, "uuid": "b48caf97-ec84-42ae-9c13-8b5cddb2a111", "comment": "Malware payload (Mirai)", "value": "22436a2fd3d690e4ea08150fe3c2b373e9e4cb194f80c2c0eb292739dcc7ae50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496944, "uuid": "b50075f0-30fc-4eea-89ff-d3043b8dfd20", "comment": "Malware payload (Mirai)", "value": "44e87f17347c041d9191f699fac361e480c419af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496944, "uuid": "091deb9c-ead1-4b6b-9d40-8718277a7072", "comment": "Malware payload (Mirai)", "value": "694a73e66d6e4abc62133e51a3d1eec0d15cfeead83e679d9ff50673974e20857fe1e0de99148552c4259c0272330c7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496944, "uuid": "7902ff1f-cd54-4b03-bc52-9e16e7e52467", "value": "T1CE8319A7B500DE7BF40BF3B780930919B230FBF50D935AB6762778969E751E41422B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496944, "uuid": "d08ea851-3e9b-4117-b16c-a81c0b619408", "value": "1536:tYncJzuLR8LSbOqSuQ3kfW8tLG+h0EOt2GfaNVMFtzdpEnyCzmk:asulYSbOTz3kfQSXOAEfdpEnyCzmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496944, "uuid": "97d12943-56f4-4769-bdaf-e6dc3985a428", "value": 88484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496944, "uuid": "6fd40dff-5110-4beb-afeb-ecb775930956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496944, "uuid": "8422bcb0-c261-4287-b120-03a0ee6c2099", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9f2f92-3194-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775464791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775464791, "uuid": "998913d2-e175-4122-ab4e-66feff31d52d", "comment": "Malware payload (ACRStealer)", "value": "5981ef2d5d7442bf7ec67c44be00cd24", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775464791, "uuid": "bf4e5292-f92f-4376-84e5-592be1216a88", "comment": "Malware payload (ACRStealer)", "value": "236144739b557250d3a7f42e9557384b1c561256bbb7a964a9480cdad9db4bd1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775464791, "uuid": "8a936734-4136-4e31-81d6-07c6526ddcd8", "comment": "Malware payload (ACRStealer)", "value": "20d61cbaf4606fe09dee34d974b54217999860e5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775464791, "uuid": "b3d7aaf7-7be5-41f0-8298-dc30c3733315", "comment": "Malware payload (ACRStealer)", "value": "130dc26f69ea4f80bcc2445f2846b71b9cc9489fd6eec0355b5e290031156a8f56d6c9442b742025c01f114da9964e09", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775464791, "uuid": "5b029b41-3676-4c72-b33d-ae10aa1ac922", "value": "T188655B01FDCB49B6E116273246F752AFB73698090F32AA83EA04767DFA771D11D22352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775464791, "uuid": "8ade528c-30b0-4ef1-9c72-86151c67d4f3", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775464791, "uuid": "1a95a29e-d6d0-4c17-b577-dc314f0160a9", "value": "24576:fyrqsO4hk60QvLRde5w5rEutzvzPHuJY7vZiWsBA5IKKkjfoHxMEVI:fDiCiuGFb3Kkjfko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775464791, "uuid": "f365f37c-0658-4677-abdb-d0e548439334", "value": 1496704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775464791, "uuid": "00f621ac-9347-4722-a5eb-b586d3771098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775464791, "uuid": "6ab04d5b-ca40-408f-bba7-134b5bb46369", "value": "iP6SfaQlJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f7d4f0-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442928, "uuid": "d65ccb4a-7dd2-4c72-9015-928e7cf6e730", "comment": "Malware payload (Mirai)", "value": "41ebee7fd34dcce6d98311ed2672319e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442928, "uuid": "9cfe6e21-8d1c-4f13-82dc-87ce0ae20162", "comment": "Malware payload (Mirai)", "value": "23cc5f9fa2720461d6ecd23855ca60d64c9882d847eadb543df8d23be44c1cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442928, "uuid": "007988cb-f686-46ec-b695-9f5ec845858a", "comment": "Malware payload (Mirai)", "value": "383ddb54befb98ae4a0bdb190a61eb40aad33dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442928, "uuid": "87c32d3f-d735-48a8-8060-2171fe618a2a", "comment": "Malware payload (Mirai)", "value": "c23fc5a17923ac07537579cf572ac1a0224859578e96ccb147c3d767b679bcd5942215e160015a69d133f9ee91a23d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442928, "uuid": "f9a11ddc-1281-4dee-a067-8e84ea641e4e", "value": "T1E403024BD45A6CC1E95840F2D56780813EA15BE0F4F5B2E37740CAE5ACA6CE734F8E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442928, "uuid": "75032335-f6ca-403f-98d2-77bc65cee933", "value": "768:KWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5HW2c9q3UELy4:KWXasPGxplekBgTP654QwGptLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442928, "uuid": "b382d59a-529c-4101-8598-4963734c1fe6", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442928, "uuid": "aaad4956-1a94-4cb1-b8c1-7f7795825ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442928, "uuid": "1b2ce3e2-3cc8-4426-89df-86b398cf5d94", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f44e44-31e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775499398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499398, "uuid": "8066b408-c7da-4995-bcee-6c7f780e5447", "comment": "Malware payload (Smoke Loader)", "value": "4cb8a67b5045fb002db16ca1ff477a8c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499398, "uuid": "531bb76d-36f9-4426-ba1a-4f3c35c606a2", "comment": "Malware payload (Smoke Loader)", "value": "2530e6273267a83c2e2d978aa4f915598d9ddf658aea2276d0df056d64c83f7e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499398, "uuid": "c90f0499-eab5-4fdb-9f62-7f19eb3371f3", "comment": "Malware payload (Smoke Loader)", "value": "014f4f2dea5bb3d3379418e592d42597946bf4f1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499398, "uuid": "22758e7f-6377-4426-955f-a59f04f3c1d0", "comment": "Malware payload (Smoke Loader)", "value": "61f966aebd93894ef78e518647e34dbac842436c45cdd97177fb837d4f2dead1d240277fc790efd60ec8437c16fd51c9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499398, "uuid": "3bc99f7d-ca2d-4b08-85f6-25de26f4e174", "value": "T1898512666BBB18CEE1A41B3041B5A232867572B95FBB46DF3D4C9478E9017C32F38B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499398, "uuid": "ff0df14f-e077-451d-bbab-32f8c89d023a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499398, "uuid": "89661580-7279-4727-8ee3-c45a9a348209", "value": "49152:HSIWklUWn1qdbmziB+DUv6wuctSDvMPJ:HSw/nIdL046wAMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499398, "uuid": "08c0d19e-8cf4-4be7-a7a3-0e21d1356c73", "value": 1710592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499398, "uuid": "fbb72143-8dff-43bf-99db-0ad8947704b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499398, "uuid": "cae5c508-a04e-4399-bf6d-f03fe6ea7a64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7d75d3-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442992, "uuid": "cfac3c48-1c5e-4585-ac91-5d10795e17fc", "comment": "Malware payload (Mirai)", "value": "89f3d65e56e6f04eaceb29ef70eb2510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442992, "uuid": "de83f9ad-bf0a-4742-85e3-68d6611b9ad8", "comment": "Malware payload (Mirai)", "value": "2563d50bc30f89c7ebf35b9ae2a65f2dc598d5b251794a9f81cd388ca1c21b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442992, "uuid": "b925d4df-45d1-4bab-86c1-6c4f7b93a99c", "comment": "Malware payload (Mirai)", "value": "4e777c5b4766b77d77bdff78fe0eae8dc1842075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442992, "uuid": "2604f1bd-7317-4e9d-8526-3855d72460ec", "comment": "Malware payload (Mirai)", "value": "97dba6bf94bffc81ce052a40514cdbb2dece6bc82029343c97cc5acbe39190b7f93f308530b4de42247c706208c523c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442992, "uuid": "f02a182e-09d6-4aa1-bc35-1b0dce342b8c", "value": "T11F735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442992, "uuid": "761a6278-7f96-45d7-a02d-704be6e356a5", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7M6t:uJE+5x8TTRkg7IF+7gMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442992, "uuid": "ac50e967-5ee0-4204-bf2c-fd48cf1aaab8", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442992, "uuid": "870b0292-655e-44fa-b724-28862c62f791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442992, "uuid": "8bff22cd-d810-4c8f-8239-0c991b873fb3", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9e7f39-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507279, "uuid": "9fe2bd30-d660-47b4-8e8e-06a433120913", "comment": "Malware payload (Mirai)", "value": "c261f6ab4e8acea8f6ce5a0d1d60e0c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507279, "uuid": "33242fe1-8580-46a9-81f1-e52ee034afa5", "comment": "Malware payload (Mirai)", "value": "2698af1c30a51e1c35ab391c4231ba6b7a894bc8e1d9d16a4531a2ed7f4d1936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507279, "uuid": "16547a07-1acc-4f2c-8539-d465758f6017", "comment": "Malware payload (Mirai)", "value": "33ac9628e614e1c6feadeb162fb8d406fc3a5c3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507279, "uuid": "a23802c0-505d-4dcb-b223-a80355d0996c", "comment": "Malware payload (Mirai)", "value": "5e3fa888f1c8c092966b721f6d844ba67ce9c81c4b009314cf0e105d51285c13e595ae6e89aecab6f0be08f01cff6eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507279, "uuid": "776dfe16-cf94-4497-9303-863cce541cca", "value": "T1E2830946A353D8B4E94310B001A7FF7A5630EE721520A96FDB54FEF2A9339E27D07219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507279, "uuid": "378b360d-70a7-41fb-a41f-6a2b4b4b49b9", "value": "1536:hF6rvyCjEpqEIBgKAfKZyYGwOnkfez7A9c29Kl6VhbU931cY/orwPXh7qr:h4DyvIEe0SZGBJ89gl6IaDrwp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507279, "uuid": "8638a4b0-6602-4c37-b82f-92f148c8f501", "value": 82500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507279, "uuid": "77b8a825-bc30-4540-b6a7-6024e3293bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507279, "uuid": "36605bff-3b72-47f2-935a-7a6c8373ed15", "value": "SecuriteInfo.com.ELF.Downloader-DN.87235125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8d9e8c-320a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515633, "uuid": "ab94f9a4-9abc-4207-a411-fc3355b65dd8", "comment": "Malware payload (Mirai)", "value": "6886ca71283349ecbcd9f3a4ba62bf43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515633, "uuid": "33934185-1963-4295-829c-dfa4bf3b1180", "comment": "Malware payload (Mirai)", "value": "26dd957dac52d5b5d744a140d273652269b9d74f6dc9404f157b83d7c75484f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515633, "uuid": "f2917aaa-d84e-4405-9192-8c066804e0fb", "comment": "Malware payload (Mirai)", "value": "3f23fffa20449b1f84f0246395401ab71e05b89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515633, "uuid": "5856d50c-791d-4ade-94af-db5515b3e77c", "comment": "Malware payload (Mirai)", "value": "f7aa35a58671fc417a802df88e3a94e34dd88a84524c49316b41f80a22f5f7bebc3b09b10aef901b804860e3f6bf0fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515633, "uuid": "4cc80b6c-a0e1-4665-b330-ddff5ae59366", "value": "T104731981FE57CAF6D81754B141E6B63E9A30FC2A4435D6A6EB617FA2CF235C03206358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515633, "uuid": "c342a903-e958-4a0e-8309-5d0370d92dc4", "value": "1536:5UUB696Czr6FQjTEQTfmLNgCWBqz6VuZFtK8ZJ44cq8:Zc96C3/TNTfmLNqwz6sZFA8ZJVX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515633, "uuid": "4166e79d-b99f-446b-95b9-7080646d2187", "value": 74004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515633, "uuid": "047232fd-3d2d-4779-a027-abe93ae15acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515633, "uuid": "e79c92b1-6a2f-4f46-a838-00e3469bc3bb", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9f1f04-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502476, "uuid": "164cb0a6-c31a-40af-b873-0b925e984144", "comment": "Malware payload", "value": "f9d569a71e1c49f9452b7131326f8639", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502476, "uuid": "049ae58b-4cb6-4ae0-9329-37e25bc6e754", "comment": "Malware payload", "value": "2735e12030c195fb5454e4736c51b55b59664b93cae9f4bd5317afcd9c2af0bf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502476, "uuid": "fa2d7665-a948-468a-87e6-5d90d0144df9", "comment": "Malware payload", "value": "f93a1abbd12f0f865e16d68e631edfc64075b958", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502476, "uuid": "cb779f98-7b45-4360-b7df-42b9a29cad3a", "comment": "Malware payload", "value": "3e7e2cc7efdd48b31eb501db7030ed656a8ef4a620f93b869f332040c86aa32416c49887b1e8e65074d9685fa30ea8de", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502476, "uuid": "6c83645e-f5bc-49d6-aaeb-90f29a052ff7", "value": "T1DF345B0417EC4B5AF1FF47BAE475216183B2B962793EDB8E5C4864EE2D63340D910BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502476, "uuid": "c58ae73f-361a-420c-ad89-9bb529ac14e0", "value": "6144:5jyGS2X3+dEMM3bjCzLgxU/+LLN+uxap6elDYcw3c:5yV2X3+dENGaU/2+uxalZw3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502476, "uuid": "436e5635-8bb7-4153-9c39-9f13a548d81d", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502476, "uuid": "b90a4e13-ac7c-4f19-9255-198568b0f435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502476, "uuid": "a7d5f349-e6b2-4801-a9b6-0818226c9a76", "value": "BaseZipInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddd9252-3208-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775514559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514559, "uuid": "a91c447a-2467-4eeb-ab8c-e1119ff45e01", "comment": "Malware payload", "value": "862fb096e682675598bf68335207d037", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514559, "uuid": "c7cf5db1-b30b-4de4-8972-59d096e7795b", "comment": "Malware payload", "value": "276f925d0f07b6a134d0290d5d6b6bd2490f99e2b364ccdd17592c4041a67396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514559, "uuid": "323404e7-b0ee-41f2-a6ef-24492b39d8f2", "comment": "Malware payload", "value": "305d58b947047d34122d95ab29cbce0ea89dba32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514559, "uuid": "ecc13c25-c1fe-49f3-8c1c-f8e4d08a0a50", "comment": "Malware payload", "value": "83e7e9eda7718bc4021077428b84ff02feceb2c8c293ef7d00d143d290e756d6b83d5c5422446b4b847aacd6621ebd08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514559, "uuid": "4595eeee-7fa9-4389-a6cc-7fb29a012fe2", "value": "T1DF23FA8BBC81CA1BC5E021B76F2F9285331257F9D2DB3667CC1A4B662A5754B0E37B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514559, "uuid": "7df977cb-dac7-40a6-a347-a3f0114db3c2", "value": "768:YItoabQ7seIzY+u+L+Y8e6PiFNHWPkkNtAhk+s+2+K+e+h+i+++S+n+D+7+sUuj/:tQ4Jq3Laf3hd5YFZ1+SadB4T5B+gHroy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514559, "uuid": "92f23d8f-d926-4be5-ae49-a7610bd224db", "value": 46660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514559, "uuid": "5f0c9a26-3db2-49b9-9698-59218c7580da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514559, "uuid": "eaf544ec-4e4c-48a3-b747-dc5a545dd025", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397d4379-3189-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1775460086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460086, "uuid": "7e65b836-32f9-405f-b92f-959187cd88ce", "comment": "Malware payload (SheetRAT)", "value": "4e4f12fc574559e8bf84bfe074f4cad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460086, "uuid": "7d0a2fc7-714d-4b75-831e-ba6636e023f2", "comment": "Malware payload (SheetRAT)", "value": "27a2505cfd32ca1fda31e58c1d2ddee7e4726b8305fda10b779851e259a2ef9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460086, "uuid": "b8a330f8-da2b-4108-add8-93dfc70eb6e5", "comment": "Malware payload (SheetRAT)", "value": "dade266ab97707f55ce2b091bdcb14474691c5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460086, "uuid": "1de96033-8bbd-49e3-8bcf-00c1a9cf9833", "comment": "Malware payload (SheetRAT)", "value": "0898b7ac8d8e6dd51ca5d9c23fa80e5307e1f9e53fd8aa7158d513d78f4fb21a3c850c7a256ce918447f0314b9deabac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460086, "uuid": "fc05f8ad-cd79-4b44-b8f8-f3c2f824d30e", "value": "T14F15237A5EC166A0D0A1AEB524E2E195AE7487B330FD2DDF65A20B2CC511F50FD03FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460086, "uuid": "7df7a819-2dd0-4c6b-900c-40685af0d43e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460086, "uuid": "b83e84d2-a86c-4985-8e96-b9f493510f10", "value": "24576:eMSSuyVF2DHjSk3g9CSUqC/7fPFuE0IwgL9/t:D972nw9MDfPkKL9/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775460086, "uuid": "5dee60cf-c020-429e-b839-625bcb3aef34", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775460086, "uuid": "342e85af-b741-4b29-9e6f-407417e6313a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460086, "uuid": "a4f6d318-3539-489f-b99c-98a4ad331e4d", "value": "4e4f12fc574559e8bf84bfe074f4cad5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f639e0-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463762, "uuid": "c0b850d9-44b5-40f6-9450-89900d49aa77", "comment": "Malware payload (Gafgyt)", "value": "b38dc102cc4176ab84ac691f48c99c48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463762, "uuid": "482f9cc6-2e3c-4637-ac70-a5f5fe6f48f6", "comment": "Malware payload (Gafgyt)", "value": "27c0459780fc6a5ba81d40aa60e8afe6316ad28a1627042c7ff0bcbb02b6ba1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463762, "uuid": "4b7d6f67-c5f3-4b64-9404-35c8e89b7376", "comment": "Malware payload (Gafgyt)", "value": "2cae402a270794f57626ba905f5f9659e75a4954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463762, "uuid": "b6fa4339-2797-4818-bf60-183fdf34d565", "comment": "Malware payload (Gafgyt)", "value": "6a48182c105ebd82e623fea48cf6944d62860374c5818c1803a3408b75adcdb65130218e1cf70b151478687c1e140168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463762, "uuid": "e5815ab5-2e65-4644-ac52-7d686a9bfefe", "value": "T14163E841FD454B6BC7D13BBAE7AA82CE73212D587BD73301562939B027F57A82A38124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463762, "uuid": "cc320698-6571-44f3-aba4-fc62866e2b9c", "value": "1536:BXp2qq6zkee/0SvEZRdc1TAqJrACF5RsQ4/HCSbz2:Pq6zkee/0SvEZRCNAqJr7oQKiSbz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463762, "uuid": "fd9360b7-154d-43fa-8b82-0efb1f714732", "value": 67655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463762, "uuid": "a7a36df8-3a6a-40b9-a74e-66b9d3a8ecc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463762, "uuid": "ca65e84c-c584-4ea7-b1e4-19f7492f75e9", "value": "cali.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ec9060-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440973, "uuid": "8450f4aa-5ca8-4cea-af3d-6f65ce729327", "comment": "Malware payload (Phorpiex)", "value": "1b457c819311a45e3b450cf300530210", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440973, "uuid": "6e924b4f-74df-4ee9-8a1f-3579c1b4b599", "comment": "Malware payload (Phorpiex)", "value": "288793e163822a17c1ca66ff6f5c2f944e854fd7e70e4be686b444f036aeecec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440973, "uuid": "504c898c-755a-4ea0-951d-2aa937934785", "comment": "Malware payload (Phorpiex)", "value": "0d602a6286609136919b8e4abab0c481a45a50f2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440973, "uuid": "5e08beb2-d2d9-47c6-b3d3-6759e3224300", "comment": "Malware payload (Phorpiex)", "value": "02610595a26be5fb86a2f9a2d97075295542cce0193438e57625f885a4ccd329858cbb0ec573aad89c814824410c5d8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440973, "uuid": "7a10c5be-9a5b-4d16-bea9-da6c28a449b6", "value": "T18A823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440973, "uuid": "62b5698f-39f7-46ee-8f61-9afdf3e8ea62", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440973, "uuid": "51a4797a-c77f-47db-ae09-d6e5faf41384", "value": "384:3I78VGwSRFqw/lsx0xu9NHRgdav8U9cr:kXhsx0U9Ea0Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440973, "uuid": "5df5568d-a6f9-49a9-bad1-39ae28e457ba", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440973, "uuid": "d01b8986-2d6b-472d-999e-4f38f44698cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440973, "uuid": "f5103c76-6ede-4133-936c-df17ebdc384c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca165b2-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496894, "uuid": "4fd3f2a8-948b-4bec-af41-b53645db5b64", "comment": "Malware payload (Mirai)", "value": "f829a7c20e57aa8c897f46e95de57df9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496894, "uuid": "fb5246bd-8ed9-4009-a97a-b5507fe03c60", "comment": "Malware payload (Mirai)", "value": "28e69a616310d44d8711e54315a10bddba94f03bd4a599dba2807e84c6b65e22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496894, "uuid": "a5c7a082-0c50-4000-8b6e-ff56d78bbc85", "comment": "Malware payload (Mirai)", "value": "4e6c3cebfa51ea5067b1e24a31690a3f9c05dc8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496894, "uuid": "649c1fb4-5abf-410a-8f62-d2c9f91cd266", "comment": "Malware payload (Mirai)", "value": "ecd73ac6c010b3a41b4cec844c7f6d2292cf9866b4893b31caffbd31d19f38e9114ff9525c6202c7fdbdfe2a3ac1166e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496894, "uuid": "9f6fc5ba-d32e-48ed-aa7c-17d23d1f6e6d", "value": "T1766349139E129F0AD55B60F020F68EB25B62FC6549132EB6B53AEDE48903DCCB1523B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496894, "uuid": "a1c0db34-973f-4f6c-be78-216c906183f9", "value": "768:jGLaLYwmKiyk25Ms1feYL7v9+0YSKuh5goauy3x7o1w1jQCa0X5of48OtGLqIcXT:KWRZWTeVV7Kuh5guy3xc1IQCaMALqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496894, "uuid": "21000d02-dc4e-492b-b3d6-fee68f49a74b", "value": 71460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496894, "uuid": "08962fa1-f0c2-420b-84b7-486cdfeabb72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496894, "uuid": "9c54a9f8-4b7b-4d9e-99a9-f3f03186e0e3", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afcbbba-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "e4e626cd-da24-4555-8e08-a0b625047744", "comment": "Malware payload (Mirai)", "value": "ae81bc650bc75f077059839df3256d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "ec0de77e-767c-41a7-8cc0-597b096c1f6c", "comment": "Malware payload (Mirai)", "value": "295de775c9b59ba5f4f2cfef2a7ddb2a4a98afebd71bdf177b526d9330e61134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "bf0a4c25-4d05-4684-b85a-2a9972482028", "comment": "Malware payload (Mirai)", "value": "32d13c8e1a2bf425c2c39fc9846317b6b0a6e978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "6b0d7c81-1a50-444b-9078-6b217b14f6c2", "comment": "Malware payload (Mirai)", "value": "4c8852079bc664064a378fc8e92a2fd773d9e2223349319148e7f787f784d86c8139c2c04745db0d04e8d4f392269fad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "1c19f222-86d2-4fd8-8b04-6898a57da4a6", "value": "T16B733991BD815B13C6D012BBFB5E028E372653A8D2EF32139D266F21378786B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "5770cc50-f19b-4d63-be1f-370296078e4c", "value": "1536:yu2Z1jY80ld4xpG2jKnbhhz2HVPAV9sOvss/hfs:yu2Xs2jKtV29A3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442990, "uuid": "19212452-0225-4cd1-ab31-f7af0ad37ea2", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442990, "uuid": "ac2c3336-5beb-495d-b233-8d73fa2acfa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "5a3bdfdf-1e6c-40fb-b0ab-3c32d649a0e8", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee29650-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775486080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486080, "uuid": "a304e4ac-c726-4a56-b30c-cf84a8009de6", "comment": "Malware payload (StrelaStealer)", "value": "c93bebd0948a8d7a79986b369b886ec4", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486080, "uuid": "6a81360f-6494-458a-a27c-4417d1edf89b", "comment": "Malware payload (StrelaStealer)", "value": "296bf78a478cb3cf554d448e9538d43797aa180af89a098cd6a68543d5e6a0dd", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486080, "uuid": "39f75b8e-1a4b-4804-a926-643c4c446631", "comment": "Malware payload (StrelaStealer)", "value": "dfde776bc45e69d6c8da1d37f7f26ea9f70c8e63", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486080, "uuid": "968b9e66-886a-44ea-bf65-63340ad7d553", "comment": "Malware payload (StrelaStealer)", "value": "ec8c12e1e0c3952246b2c0b53fc6ea28ba2a1c9b3a5b79cdcb8e73da83206b7f9ed658be4a5e8037fda1ca9d432c3aef", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486080, "uuid": "70713b79-d3b6-46a0-a031-5388c27a32d2", "value": "T184B23F3EC985DFF00B6A31A5A52F791664140323B9383A4DB8CFC1993B35A50CBB55EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486080, "uuid": "537d1ee2-036e-4afe-bbb6-98ec8f1dd9d5", "value": "384:Ks3FvUyfXETv1STTc8IfVwLbhc3+npLTlmKD77nSfjBHZbZhBcXXbCjwgtNFNbfq:KmCUTQJQGCxfDnreR63QxnjJpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775486080, "uuid": "62d5e802-183b-46ef-86e9-2a1810a2b1ab", "value": 23698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775486080, "uuid": "2569fc24-71ad-420d-b238-0ddfed196095", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486080, "uuid": "35ee2f37-7605-4031-9afb-e690f1fc81c3", "value": "Confirmation slip-025521443553574554#.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be40216f-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463745, "uuid": "826ca7e4-56ee-489f-8295-903cd2c134ca", "comment": "Malware payload (Mirai)", "value": "7cfe783644890e8714cb248113499af0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463745, "uuid": "86e35bbb-2bc9-47e5-8450-69139f3fddf2", "comment": "Malware payload (Mirai)", "value": "2a878369fc31716e19c37b89a0dcbd2569c536672ab085624edc6f45aca20cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463745, "uuid": "76d8c954-be66-4619-a4cb-53cf5a7393a9", "comment": "Malware payload (Mirai)", "value": "192ad5e58666c4c1f5c56c9e9565096826233ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463745, "uuid": "7cf88d4e-bd74-403c-ad5c-8415291b54a3", "comment": "Malware payload (Mirai)", "value": "15fa06ab31721ebe90916922899ac4056b7301e1b3600ac835db0e529cfb6985a4a9e32ca573769d7927c12f1ede9fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463745, "uuid": "248c74af-e75e-443c-bc14-8d77d196f01b", "value": "T155B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463745, "uuid": "158073a1-337a-452b-b454-b37255d1ea97", "value": "1536:xUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45Zvd:6ixnUHz4Z+5ypkn3E8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463745, "uuid": "453c00cf-bab5-4311-a097-43c7267f4b63", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463745, "uuid": "92a49e09-c142-425b-bedb-f1811143a8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463745, "uuid": "b79d6946-8ba8-446b-911c-35f1893cdc28", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aa1b84-31ad-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775475460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475460, "uuid": "c72f6118-3139-4f96-abb6-8a88e6cb060b", "comment": "Malware payload (NetSupport)", "value": "34e9b7cf145e036847af8806f7f13211", "object_relation": "md5", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475460, "uuid": "f1b33d00-95f3-40be-91d0-07e4091a752e", "comment": "Malware payload (NetSupport)", "value": "2b02ac7eb661502bbe47f12c8fe5444ecddc8697bf547431d7295cd2e44a991b", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475460, "uuid": "ae05f772-ad5b-4061-aa8c-621c5c0b5408", "comment": "Malware payload (NetSupport)", "value": "4ff7f045e9901391dc160f2d3a773b38537e0306", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475460, "uuid": "145b534d-1e18-4d66-8ec3-ca3d5ac6faeb", "comment": "Malware payload (NetSupport)", "value": "46fb534fc48de267b2e4d328fca9f654fa86adb190afe3f40051eba47d32b48bfa3f55fd0854e1cd9a2cd709b95e9d63", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475460, "uuid": "47166d35-1954-4c05-8c72-93ae463615b4", "value": "T12F967CB88B84975EAE6E1907E078571E67F37F26D09271FC5B62370B26AFC085239C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475460, "uuid": "89148aa2-5d7a-4150-aa19-c2c146370c60", "value": "49152:KM3oGXEAcIqi5t40OQEoxzhwYI9ObHP4iH0RFblMKkp1mzxHK:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475460, "uuid": "a94396ea-db4f-4c64-b24f-5a8006065ee8", "value": 9410790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475460, "uuid": "ba1bb3fa-2abe-4c44-9097-2225e1afd676", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475460, "uuid": "c48306d2-9565-4142-b54b-5c20e7fa24e1", "value": "i88.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ed934b-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "669fa45a-4961-42d7-855c-271ae0d50196", "comment": "Malware payload (Gafgyt)", "value": "d5040b14ade4254e2186712fe62156c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "2154df46-655d-4e18-a093-b953f5d94e22", "comment": "Malware payload (Gafgyt)", "value": "2b9271c1d64c7aed6359bf19f77312d8faacb5951058ae4a29fe86c49cab3592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "f845f27f-4a9c-4387-828b-a9a94e94950e", "comment": "Malware payload (Gafgyt)", "value": "fa54ace524852b3ba679dbc439115109b8fb87aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "5b7e4582-8071-4914-b641-11e607a7a4bd", "comment": "Malware payload (Gafgyt)", "value": "695a59e5a7ab80dbdb6fa2bdf5457a2d3e1ef199cb1c17d6e720a90f3c7aada1db8bf7701200595c1aec446a8f8dbd49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "19cae389-5362-4f09-aecf-7c7a993c2a0e", "value": "T14D8385793A21BBFEE2B9863047F75F70C3952D9226619785E22CFA180F7128C1C5E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "a1e5ce12-da00-4701-ad5a-07501a244488", "value": "1536:qLVXMU5aUW927y2PTkYcMBlwai2rKihl8spQ7T3pOpUH1msI4beapa2:482tEalPpQ7gpA1mCCapa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463699, "uuid": "38b1a5ac-4dfb-4ba6-b8a8-c771ac3d7a55", "value": 82033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463699, "uuid": "150db29b-122f-4f6e-8397-81c3bb8ab49a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "7d344620-b96b-4413-a468-185e49c5097f", "value": "cali.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73b68f2-31f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775504643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504643, "uuid": "6444f71f-dc7e-4f57-a45a-b6eab7c67bd8", "comment": "Malware payload", "value": "f12ddc9ffe6e7248d6e11298b97736ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504643, "uuid": "ee5238c1-0bcb-4c40-a2ff-2ffdd3a4e12b", "comment": "Malware payload", "value": "2c60006167b5587388272204a86ba441acadecb2eb2ff0ec8582c6f2de64ac03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504643, "uuid": "bb4e79b4-38c6-41b7-9783-52e99a4c20ab", "comment": "Malware payload", "value": "e0622532c43939f2056510659830170a7c1cd056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504643, "uuid": "5c19aa07-7dcc-4281-92f7-49674e83d3da", "comment": "Malware payload", "value": "58e763905b6e96e7c6832a28977d4f29a2eef38d8568d09ac56cb757349530dc9af2bdef12dfdf5d07e7f6e7123230a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504643, "uuid": "d61cdeba-2910-4ff8-b5bf-077f7e2e92c6", "value": "T1B5155B42FB1C4563C8470EF0193F53D6F7257A4241F9922A770EAB672621E3ADAD3389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504643, "uuid": "bb435194-06e1-4fd8-a321-d83b6d52ffd4", "value": "24576:ebr5vdsnoADJyxjYaP8Bj5ojX8UoagoF2U0tp:eX5vdYoCk5Yaij6jXkagoF2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775504643, "uuid": "8f83b0f6-8245-426f-9443-9ddd86f590c0", "value": 927916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775504643, "uuid": "5ce84b58-ba91-4a51-b185-33952334c176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504643, "uuid": "1ad9e0fb-aa04-4873-8fcd-3813117cc680", "value": "clientppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373252a6-3184-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775457935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775457935, "uuid": "d09e00f1-b063-499f-a05c-754a45d435c7", "comment": "Malware payload", "value": "63a7bc16b38eb55f953525c0febf630c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775457935, "uuid": "cf381554-c02e-434c-bc07-a5e4cb44d6a0", "comment": "Malware payload", "value": "2c721bdf2b6bce9a1ea7878c9a7a9c882b11f21468bacedb76fb47fdeed45a42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775457935, "uuid": "1b7da954-6e5e-4bbf-b0f9-f8e47c8d07e8", "comment": "Malware payload", "value": "823b23b647b562e048f1b23f2ee62b1fb6f04979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775457935, "uuid": "3ddc473c-740e-49b1-acf9-457e4386250e", "comment": "Malware payload", "value": "3287cb8a8c2e055de79c21add69f2e6c28ef480f5c58093c10cb4078fbedc92143f24a9d51079a43053c960aa5a73432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775457935, "uuid": "34941d83-b061-460e-8ea1-0220908d5e5f", "value": "T17207AE0FF357D60AC6266D3886E193A22375FC606B2EA30BED856E1CD84B5F00D997D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775457935, "uuid": "349fa94a-56f4-4e87-b6e2-5904f7f041c2", "value": "1bf7c25cd6099ee20cc931161e32fc3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775457935, "uuid": "ce3febcc-ab44-4530-96d2-defce7b27015", "value": "393216:ze9Oru/EK/+HRFK+HqQq+HABN+HDQ+Hz+H9+Hc+HPlBBvcyVx:zMOruMK+/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775457935, "uuid": "915f6de0-5ec0-420f-b0ef-d4c6257213e2", "value": 17353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775457935, "uuid": "184003db-f64c-4f2e-9c7c-1677aad5d8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775457935, "uuid": "a7e9cf83-964c-4cec-a23c-473a224d7eb4", "value": "prism_v1.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5e9d7a-3205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513327, "uuid": "06debb8e-543e-471d-8437-cfd660ee2480", "comment": "Malware payload", "value": "ac0d3e3561fdbcf37574b9919be2684f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513327, "uuid": "b3498da9-7d20-40c7-9a31-db013254099f", "comment": "Malware payload", "value": "2cc229b2faad8dcc840cb4504b47d6f5fc49c3316104607eef0e8c14b899a0fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513327, "uuid": "a8b00524-b0d3-424c-bee1-0dab1d5ebc3f", "comment": "Malware payload", "value": "c2c0f2a73642c46ffbfb18b07bfb4be16a2462a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513327, "uuid": "ef4ef5f3-2178-4449-995a-0b8f557b2d6e", "comment": "Malware payload", "value": "3e71612ea23c330a09fe15e6f8e6214768f91e5674c4dbe39f07c96f43f636f6d2d0e551ce39e34005edb01bc343aa69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513327, "uuid": "157ecf0c-11b6-4861-810e-eb69e38651ea", "value": "T1A9D42916F8808F62C5D1257AF65F82A8731347B9C3DB720699189B383BD786B4F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513327, "uuid": "8722d65a-03de-4da3-9d89-ecc9e07b81e8", "value": "12288:Ymhj/s84ZcJjzjxTHWzcWF+USlgpNxDFkqF/mVc/Y:Lhj/szIj9HWzcMzmq5mVcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513327, "uuid": "96184306-44a4-45cc-92c9-abf35baba6d2", "value": 641076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513327, "uuid": "f6a340f3-6855-4522-9e7c-905e1e5cc151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513327, "uuid": "0e21f0b4-e21d-42c0-9463-cd16f2ee7d6d", "value": "siiarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c30e2c2-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463634, "uuid": "d6461a11-201a-4852-b4ba-a0d0124d073a", "comment": "Malware payload (Mirai)", "value": "5ff353c0d859eb4f9b9a156277d842cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463634, "uuid": "3a53bfa2-d0b5-4f8f-8323-0b38901590be", "comment": "Malware payload (Mirai)", "value": "2d351e6f9b18ef1b14a3cbbd6762f8b248fca06991f30a0f09a4fd7c3f9392ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463634, "uuid": "ed25a13f-a3e7-462f-b108-963fb984a188", "comment": "Malware payload (Mirai)", "value": "e9fb67f3aa106896ac39c5cf6393975d6995537b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463634, "uuid": "49f0dac4-cc6a-4dfa-a065-f50ab3eb4257", "comment": "Malware payload (Mirai)", "value": "c9c02ca02eb85e32c1fde75461ebd6365b6d5280012f2da4c7aed7a7d04c42f0e745d7023fee84f7005c0549cc5963b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463634, "uuid": "cccb1e53-c11f-42a3-a38f-d5ffa444b416", "value": "T10BC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463634, "uuid": "06d80133-f731-41ba-b459-be0b1539880d", "value": "3072:f5D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1l:f5D76aX9aKTcRQVnoiYq1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463634, "uuid": "7304bdbf-0987-4911-8c6a-122f0bdb9ad7", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463634, "uuid": "7ea2478d-e3f5-4be9-906e-10633095ae39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463634, "uuid": "35743e3e-51b0-4ebd-a4e0-328de1e8ea1b", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587b861d-315d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775441241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441241, "uuid": "841f1a0f-ce5e-4872-8aef-c1ad99b6252f", "comment": "Malware payload (CoinMiner)", "value": "363306f3a710e89dfe6cb954a88276b2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441241, "uuid": "7dbc54f4-4595-4ba8-be27-77ffca5e1b9b", "comment": "Malware payload (CoinMiner)", "value": "2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441241, "uuid": "c41ac9d9-5f4f-45db-8f63-6ef49f3e0388", "comment": "Malware payload (CoinMiner)", "value": "14ddd89b4051292f6c7efa3c3ce8f80e4e01a9bc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441241, "uuid": "6bd4be21-9e77-42f9-8294-ddeeab373184", "comment": "Malware payload (CoinMiner)", "value": "2ff44109209eac5a3309f1ac1d8010c15715e4d7cb313432fb752c57f53098d8cbac9043651bc80610df8ce55604ba32", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441241, "uuid": "94efd5e7-1d14-4f37-b447-4df5e8b0fe5f", "value": "T118322B2B7E444231E7A089F90439528B947C16736B87B3DFF73391590B952458442FFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441241, "uuid": "d8da03c0-2612-463e-91a5-dc846ae2e98c", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441241, "uuid": "77f537bb-c737-4662-a139-a95abecc6f15", "value": "192:joG2w8wNihBMksVxAhRYuOqzPFJxTEZmFhruc9:joaDwsV2hQmPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775441241, "uuid": "96a9059f-6818-4a32-8aca-515afff8612e", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775441241, "uuid": "787d9b40-1b2b-4397-b9c4-b2c2c4d6ff5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441241, "uuid": "7897d968-5bb2-4af9-b508-966467a4fbab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cd06d0-31ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775475963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475963, "uuid": "4faf192e-d24b-423a-812c-c047c6672b18", "comment": "Malware payload", "value": "1f2be250cbfa2af243bbc224824b651e", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475963, "uuid": "804d1c26-d1f5-4f8b-adbb-484c6b77c7e8", "comment": "Malware payload", "value": "2efd7e81066ff737a06d137e00256d4ec9e0c34f2e99e12a62a94fc116d957cf", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475963, "uuid": "05a2b61f-dbcb-45b4-99a7-34d0a4632a37", "comment": "Malware payload", "value": "e8cd112b5c66b754ff647fe2c102d763bb311a08", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475963, "uuid": "6fca3f50-a77d-4620-afb3-ca01e847b1d9", "comment": "Malware payload", "value": "2d1bfe2da869bcbdfd9b83b61d0900d3396cb322179fe7c8562951ae8e750d78b06c452acac518eae71f1cdd001067b0", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475963, "uuid": "4c0fac44-5ac0-4716-afc3-5cf81323b282", "value": "T15B128E0ED7C48CC2D1ABF6752E948256D966D6CA86E600050AF913C8FFC1EB76631372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475963, "uuid": "176ce609-0883-4928-8780-38bfa0c82a40", "value": "192:bsjRmyca9fbpkjXskAPyXXlKaO/Ax8/dI+i:AjRm/wksuQJ/g6dI+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475963, "uuid": "04051678-c61f-4c4c-96e8-f219efd5ee64", "value": 9190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475963, "uuid": "55549100-6d4b-4114-983f-84fc8df8aa12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475963, "uuid": "36ec3f02-274c-4825-b5ce-dc9e72efaadd", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b573c33-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775443044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443044, "uuid": "740b4912-388e-4e38-83cf-d323ad070242", "comment": "Malware payload (Mirai)", "value": "6821aa4bb048ac2f7ff6ab29c7bef5cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443044, "uuid": "88cd6a08-b628-438e-9928-a4c297167ea4", "comment": "Malware payload (Mirai)", "value": "2f0d1aec4a4d5a6109e3755fde8e3de45389d5e7f04344a7bb3175ac4b278d13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443044, "uuid": "1416a847-3b76-4d8a-b83d-abbe9fed99c1", "comment": "Malware payload (Mirai)", "value": "baced1738d31881225bf9d8cd466d53a98f668f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443044, "uuid": "e3b86642-238e-4756-8a2c-685297aa5d16", "comment": "Malware payload (Mirai)", "value": "a52982aea485479713f58f54b4191b6306d980c7f0cf3199f9c0423276285f299d033710d3a8b433b1e64c95511b5bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443044, "uuid": "d118eacc-bf7a-4218-8b40-8ddb79d2490b", "value": "T100831895B8814B12D5D512BEFA1E118E3323177CE3DE73129E206F24778B96B0E7B612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443044, "uuid": "369b6dd8-ee03-4129-b203-dc615730a79f", "value": "1536:ijnJbiILiU66im3qjDIPsSDvauDVhQ/MYi60PmzysO7NA52Y0s/hG:aHLU0wIkSDvau+0PmzysOBAY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775443044, "uuid": "80c4acac-5cd7-472e-a34a-ff453c3eed12", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775443044, "uuid": "6c7be0ac-ad93-44f2-bef1-8aee71826ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443044, "uuid": "fe6ed12d-4eda-4e4e-b523-883006ab2385", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6177dc9-31cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775489152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489152, "uuid": "5e363973-1b8d-4017-bc6a-2993a6047d9c", "comment": "Malware payload", "value": "556bca96c1b9a2b5869850587e873d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489152, "uuid": "461daa44-73ea-4d04-80db-2074defd01e0", "comment": "Malware payload", "value": "2f4c73f09e78a886f6f8e260c1222081352a060392a8482966bbdefb3e90ebf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489152, "uuid": "3b3c89a3-e420-4b68-9c2d-cf17ab14952b", "comment": "Malware payload", "value": "40b436b840f690146063eaee28cbd36ab8bc22cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489152, "uuid": "b4d1cc26-5b55-4e44-9e64-00b0de6dc01b", "comment": "Malware payload", "value": "663dcadde65361cc821446977138bf4012419e389e17a6c5f8b72dca4a991c36e1c83a3b1089f1406e1da2f379894bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489152, "uuid": "e34e5696-d82d-4618-a26a-affc01747c91", "value": "T1DC380207F365E90CC527A5707662A31563A5B418471FE3FAF65B2A25ACFB2A00B5F3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489152, "uuid": "34e758c2-867f-4729-a564-20841db57ccd", "value": "bd9d18d07a19dda4789fd9da615f0652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489152, "uuid": "d74731fb-9adc-45ed-817a-9eb171189b55", "value": "3145728:hKrb0uSYrMEaLI+OVclX+OVclMPqWNmAV4:Yr8YrMErXq9Xq+PqWNm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775489152, "uuid": "40117ab9-3e84-4c93-b115-5fff7018b3a2", "value": 103391232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775489152, "uuid": "e372b944-2fa4-4602-bf9c-3e8a4bc506fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489152, "uuid": "c81a16dc-098a-41f5-83c2-1b1077c43204", "value": "swiftpdf_v1.4.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ed9a73-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496935, "uuid": "06e90509-48d0-4c94-a105-21334d7daf47", "comment": "Malware payload (Mirai)", "value": "716a257b92713789d5a1a4848fc616c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496935, "uuid": "db8b8e87-67d0-4f52-97ab-e601c4815caa", "comment": "Malware payload (Mirai)", "value": "2f6a0890510340f6a6293661be64c5504cf11ba786aead23e889833c6624536b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496935, "uuid": "89e52c36-08fc-43bc-ac9c-c36e081c1bcc", "comment": "Malware payload (Mirai)", "value": "af8888947bd19af5ce96d698313ca5f41f462101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496935, "uuid": "f6f0d623-c2e9-46a4-94ad-d8debf8c9740", "comment": "Malware payload (Mirai)", "value": "b54d9040e9b553b2ba1cf892e3314f98ae05cfcd90d06e5972368be17914f31598d78543fd145a8b0a88632eba2a5c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496935, "uuid": "3084ae02-d5d0-4852-b9b6-b9184c18d39c", "value": "T1DC93DA4B7E228FAEF26982754BF34E31965877D727E18681E26CE9401F202CD541FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496935, "uuid": "f5fe7506-25db-4e7f-857c-d2611ae7e013", "value": "1536:xETyfcDs8HlUws3SXE0NEeIGBs1ITJJ7l:x1f6sNf3SXE0N0c6Ijl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496935, "uuid": "6bb833a6-9c95-4eef-8df1-8752c74bf510", "value": 96072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496935, "uuid": "880b0382-e8ba-40e5-af50-5306b8166bf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496935, "uuid": "dee9faca-5d8d-481e-a695-e75bccbdedac", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a80f2e3-31b0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775476839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476839, "uuid": "4718b69a-9a88-411b-9014-85635e983964", "comment": "Malware payload (ACRStealer)", "value": "78342248f21ff166ea27e5fb76da8c5a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476839, "uuid": "79d93e04-72d3-4e6d-bdd1-f6c7f7da41d7", "comment": "Malware payload (ACRStealer)", "value": "30103ca4c75758700d2aa823221e41031d064326ba215a541b2793091bc2ec65", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476839, "uuid": "7b1be749-d835-4791-b4d5-009ef44dfba4", "comment": "Malware payload (ACRStealer)", "value": "e3edaa87e9713e0c07a10dd3033844644eeb19d4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476839, "uuid": "b70caaed-7e2f-4849-98e6-8cb6bfa6efe9", "comment": "Malware payload (ACRStealer)", "value": "88e5208f3d519bfbf580a45642a412c2420f6b35a91d4d0569d9d2ba74a3169fb465ddda4e1428ea9ce4d3e1653ef136", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476839, "uuid": "5ba2af8d-f564-4d55-bcb8-20c63b842acf", "value": "T1F8656FB701013477FCA445BC954F334D858DBAAC3E5E9BCB29E4C7FBA502B0A8898657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476839, "uuid": "e0911cd3-3377-4c9d-8ec5-2c2549b0a81e", "value": "ba4314db01695e6a84ee697fe663c4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476839, "uuid": "88e5bd38-8954-4ca9-b464-1af37076b580", "value": "6144:vVILT8lVivwP60DLGF7GwnR7b8kUB+0ckQkqmFBSz80RlSIS3K8up//7UOR2G2jA:voT8r6csbGFpS80RlUq1jUORk3x+7aqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775476839, "uuid": "ddacc7c5-41a7-4e89-8947-7056083836a1", "value": 1457192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775476839, "uuid": "31f1a66c-78dd-417a-9b61-a22afe72b24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476839, "uuid": "168c56ee-7ef6-4e5c-bc7b-b54c243f4760", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077ac117-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496939, "uuid": "0b19bc9a-2e43-41b3-9d86-848e04cd2410", "comment": "Malware payload (Mirai)", "value": "78f8f020afc101b7aa1974ca7e48809d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496939, "uuid": "5e8fb6ac-0104-45d6-9ba1-faf3cfe4e9eb", "comment": "Malware payload (Mirai)", "value": "307341c64df3bfdd082047a6a6c02c35f9c71051dc02de0e095cc98f567b1451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496939, "uuid": "d7f4c733-5c07-4f76-830e-e729f2db50ea", "comment": "Malware payload (Mirai)", "value": "bec75dd489b85dbfd12dba50332c7e2cb4389295", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496939, "uuid": "70a9fb85-7ecd-4853-99f2-2ce1d5e0ff3f", "comment": "Malware payload (Mirai)", "value": "2ca1b18760d64a8eb7fa89bb5ebfd4ccdf566303220d05036468cc7e6f2526820dbe92af35218bacc9557055b3e1090a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496939, "uuid": "ce9d4db7-ec0f-435e-8ede-13a032fec676", "value": "T1A6833A27BE720F27C4C271F522F30738E6B5ABAA1C78451ABD612DCDAB641D031567E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496939, "uuid": "ec300fe3-81c6-494f-8d3c-60588ab5f027", "value": "768:MO3SH9G1N4gdWxEg1ZL0Br8Dq9uO+lM5VeJjR6oa1tIWnPKOtG9sIb:MO3SH9G1N4IWxEg1t0BrQ3lM5ztlJtNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496939, "uuid": "323ceb37-f4b9-4e28-9076-8d73bcda170f", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496939, "uuid": "792c0069-5ccb-430f-8c72-f342802b6590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496939, "uuid": "4985ccc3-a930-49ab-ba81-fa06f68754ed", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562908e7-31b9-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1775480750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775480750, "uuid": "a0138c39-9c71-48e7-aa0a-86a31a11abfc", "comment": "Malware payload (RedLineStealer)", "value": "494753620a36fc7694abd06ead8dddd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775480750, "uuid": "3d5a4a07-48e1-40ba-91fc-730ee4f282b5", "comment": "Malware payload (RedLineStealer)", "value": "31c17f9d3909a74cd700db4869526ebabe64dbbcb0d85574324a04d333ae7928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775480750, "uuid": "01bc0849-1eb6-4e2e-b246-56c73d22edd8", "comment": "Malware payload (RedLineStealer)", "value": "fc7d3303d92c6d815c24bd9efbaeea6f7ea90098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775480750, "uuid": "ff3dcee0-50ef-4aa7-92d1-93d813237227", "comment": "Malware payload (RedLineStealer)", "value": "3ae60d8085e4ea78716aa8eca25eac63f28f86724bb52e91ad53e711fe19bb1489f4b8cf5de32fe8f0b1c4f7c113f82f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775480750, "uuid": "f0c23433-3a16-45e2-ad26-a67734781167", "value": "T146A35D3067AC9F19EAFD1B75B472012043F0E08A9091FB4A4DC194E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775480750, "uuid": "67db4e25-d834-4515-bcf1-4d821cf59335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775480750, "uuid": "a04de870-766a-46f1-bebe-87da73831f43", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2n3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775480750, "uuid": "906136f8-adeb-47a9-a688-4e03f8687344", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775480750, "uuid": "6eb94570-77a1-4f99-b84b-ad38f2e58052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775480750, "uuid": "c39bbcfe-ccb9-42da-84a7-84c8d22c0673", "value": "494753620A36FC7694ABD06EAD8DDDD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694502b2-320d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775516860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516860, "uuid": "ecfc4de3-94b0-42d1-a5a0-515dcc4537d2", "comment": "Malware payload (Mirai)", "value": "cb8d19a41560228b4bfe9f156eeffd9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516860, "uuid": "eeeeab80-8c88-42ac-954d-dd2a133a2f53", "comment": "Malware payload (Mirai)", "value": "325c86399db8c6a2cc1628b967f75db693420e665ad8eb24524614bf297740f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516860, "uuid": "00a5eb1a-f5a6-41e2-9395-666231243c39", "comment": "Malware payload (Mirai)", "value": "ff211b0028aaa44c016012cb63d293e326895c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516860, "uuid": "91a9cb55-adab-493d-a71e-bb3ab75ded9d", "comment": "Malware payload (Mirai)", "value": "3fc70a427d46df02fb552424e7d715285037b9a8584b97f0f0c4932095abfed141ca56ae4973f518ee7ae9dfe3c26a0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516860, "uuid": "40596b8b-0039-4a6c-b800-9cbed21656dc", "value": "T18A732C03BA42CEEEC45AC1F45BF76631A922FC3E093672DD67E4BD912A49DD03958710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516860, "uuid": "0c3e907e-f331-44e7-bf02-36f8dcd5eb62", "value": "1536:LWT7WjP1CgEHmawYG777PNrY1I04pRH/8M7LsyCA9A+3C:CT7WjP8gE6vPNr2+RH/tsyCA9ACC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516860, "uuid": "d612bf85-80d6-4f2b-a6eb-c99eaeba6308", "value": 77368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516860, "uuid": "13dc1c2b-58f2-42c2-9b40-4d428e065d2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516860, "uuid": "626e0fc3-f1cc-41d7-b922-d1ea98e1e519", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea32970b-3202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775512352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512352, "uuid": "62174842-499d-4ab9-9d3b-33927cfbae35", "comment": "Malware payload", "value": "1354bc7234c7ca47786f75ff2379ab1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512352, "uuid": "2fd26e5b-7c2a-40fb-b3ba-77c04f793792", "comment": "Malware payload", "value": "32f19b5779a76cfdb0f47577fe1dae3a62d566d857440e29e16b0bebf44fcd99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512352, "uuid": "aa164ea7-6417-4118-ae6e-2a91ab3125d4", "comment": "Malware payload", "value": "d67683dccc6a44eb6c769254a26b78702bb8273f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512352, "uuid": "bed3ac78-56a1-46bc-b89e-f2824ab16bb0", "comment": "Malware payload", "value": "a1255ddb27dd003eb4d9c5c94edec287fba626d92895019e4d31621a8bc3ddd7da50df7973e82b774a339204a2bff63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512352, "uuid": "ace58e95-617b-4445-b7c3-b6aa01b17b35", "value": "T173058D5BFE5E3C47D2DAE33D9F4E83B1A22BB190C31341573581432CA4C6A9D8BB1699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512352, "uuid": "0c857494-507c-46da-8544-aa9bca8a988d", "value": "12288:3EWQ/QLXFLIofENCAp50Gg3gFK0S9MUXRUDcMw5gltYMq9l6LJxz:09/yIofENCAp5y3SK0uX6SF9ELJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512352, "uuid": "98fbd796-382b-4cbc-a45f-1c2ee36a75bb", "value": 863816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512352, "uuid": "de218b6b-94e0-4e95-b12f-017bf1464584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512352, "uuid": "80d2a0dc-470b-47e0-846c-b4c4177ecc00", "value": "clientaarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a541c990-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463703, "uuid": "e37840ca-1e11-43df-bd8c-5bc0bcc587aa", "comment": "Malware payload (Gafgyt)", "value": "c53b74a7ee423dbcd744a39c9e0e9a24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463703, "uuid": "f876d477-ca61-451b-a4c3-90ca23c14600", "comment": "Malware payload (Gafgyt)", "value": "338d8c7541025b68966b239c3a5ff15a5d1b0bd984d5af054e4e1b55d5ce47b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463703, "uuid": "a1e9bc60-1c66-42fb-8afe-a7f2ab98e1ee", "comment": "Malware payload (Gafgyt)", "value": "d005a27ef639ca254746c31049facbef63ce411b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463703, "uuid": "446cb462-df49-4738-ae3b-2e40c826ab0f", "comment": "Malware payload (Gafgyt)", "value": "fc003133552c97a58c18cb41d5c1d19a516672bcd8e6e8c6dda904f12b613f6e3b2e607ba6aa091a293a70953ebd63d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463703, "uuid": "55a6e2e1-de48-4907-b9ec-b8708b9ab201", "value": "T1FB532B2B6251C4FBC48707F41ADBA5A09923FD3A0B33A10673D4BD796F329A59E5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463703, "uuid": "fb231889-5744-4063-996d-756e3d7d4cf7", "value": "1536:sOLxu3CMvnJ1cm4BbtWlnzPrrcaiiTzRDS917Az72x:Lg3CWT4BJIzPEaiiTzszUz72x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463703, "uuid": "a7155edf-1cfd-42b1-bc79-df60f553247a", "value": 62742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463703, "uuid": "5f5b649e-d4e3-437a-9f87-7f166041940c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463703, "uuid": "268d909a-729f-4fd7-b1aa-a2c1cb678ba5", "value": "cali.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c0b11d-31ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502037, "uuid": "f06aee82-cf2d-46d7-9b26-51429a00f894", "comment": "Malware payload", "value": "5f69fe13efd475cc7e4ca62bf5a659d1", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502037, "uuid": "dfda06bc-2259-4ad8-931b-5a062365ec4a", "comment": "Malware payload", "value": "33f2ccccdf25cc1b293d481edcf3e7f70c1bc75d4240d591531379bbe1f15f80", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502037, "uuid": "061155dd-1c7b-45ae-8c62-0af720221bb8", "comment": "Malware payload", "value": "92ffbe07de00842f30f08a14008e775ca3308210", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502037, "uuid": "1a2d8e2f-c7a1-449c-8a90-32c214a1eb8e", "comment": "Malware payload", "value": "8941a68525d33cd5dd03291f9cefa75c21bc10f6e4938a81aa75c1cda1dbb160ce7913b39b24efe44145a550284c9c33", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502037, "uuid": "5e4aa9d2-d152-4e58-9806-3593794e3605", "value": "T18D5733D5FA8D49BDEFAAA47859EBEE014EBB000160C555AFC68CD79A49331D703F8E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502037, "uuid": "ba76fb6a-a573-41ba-9961-0498d1d1caba", "value": "786432:h4tpH7JdqzwJVeTW7grG2Q7siytorfMI6vc7v7KBCJdPXFNhN:hYpH7JdqEJYTW0rG/7/joc7TKBIdfhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502037, "uuid": "ade8c364-720c-4876-b5fd-58a7df019725", "value": 28081897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502037, "uuid": "6f45b02b-da90-4699-aece-c1eacdd1342f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502037, "uuid": "51067d21-ca63-4068-8f52-2c7594fc17a8", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc82418d-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496921, "uuid": "45c031da-bdf1-4c06-b6d6-9b82dc73c6d2", "comment": "Malware payload (Mirai)", "value": "e995ae3bc1a26e4f35ff92a34de1aa50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496921, "uuid": "3f4ce065-d317-4601-8f0f-c2ed0cc8014e", "comment": "Malware payload (Mirai)", "value": "34ed3a655fdf010265730f654f29c8fb79bd9175d5c025413dbcbb2273a6fc90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496921, "uuid": "d4b27c55-0abe-4b6f-a57f-24ccdb22e5ea", "comment": "Malware payload (Mirai)", "value": "2c5026a925a7370534b6b17c0dd3ac4d9016744f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496921, "uuid": "3532cd71-b4c0-4791-abfc-54cb2e00e443", "comment": "Malware payload (Mirai)", "value": "044c49f516eadeb381e37ef506c60ae77dfec08a7fba66edb0b88f2c87e8020c7851c78d960e3693cabf6a18f3b14669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496921, "uuid": "e0f67e92-0652-4a86-9931-c6d8df47a2ff", "value": "T17A932A86B9818B01C4C321F6FEAF554D33136BB8D3EF72128D24AFA4278A5D7097B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496921, "uuid": "179f5b79-976b-4ab0-8c8c-ec4b8f2b7da9", "value": "1536:WgnVEOKtInl26buSdpBBeAxYkuGjIkGgM4kQcY7+WXYo2xBWnBd6uT1TBt90a7Z9:rVHzY+FtTx90ac0KupWS6NwhVnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496921, "uuid": "0ac4e645-1e5e-4421-9aab-b4be53e2234e", "value": 91240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496921, "uuid": "f0f220cd-7c69-4c5d-bdca-f4faae97d371", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496921, "uuid": "52376085-c924-46ad-9a38-40de7c6d5856", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3870ee14-31b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775479412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479412, "uuid": "f768165e-8c22-42b6-bd60-ea047e157e50", "comment": "Malware payload", "value": "e7fb5f1702f8baf2683433d1b302e2ab", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "ydZXHTFS", "colour": "#9095CB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479412, "uuid": "01801f3a-20e4-455b-b567-61b33053fd30", "comment": "Malware payload", "value": "35ae5a9054c55869a00cea31b43c2ac972bbc60d0549b3b1e086c02469c5ed9b", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "ydZXHTFS", "colour": "#9095CB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479412, "uuid": "e420d961-7a32-4a47-b9d6-d301786f96dd", "comment": "Malware payload", "value": "8944e9ecb98e8a1bc624ccb9a11491cc7c68e266", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "ydZXHTFS", "colour": "#9095CB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479412, "uuid": "63a03368-f27a-492f-bcd2-a18be9b4d789", "comment": "Malware payload", "value": "fdc3195391d879eadfb2fe1d29ef3edf93e06b348168005829c98bfafde32ce1d57f5bcd8fd37b763c44761ca8cf62c7", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "ydZXHTFS", "colour": "#9095CB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479412, "uuid": "310901d5-5464-4dd1-8524-ef9f8e41b057", "value": "T10B4533E7899CCFFC4762C2010C11051F95EB6A9E0937B98C629BB39E12CC55E9F6DD11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479412, "uuid": "4b50aa21-996c-4707-9f51-83a0b2236158", "value": "24576:XxaAstla/xvnBhYZDy7coEs7y3wONTY6kLZDm:XgQ/xvvYI7cky3lR2Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775479412, "uuid": "b16769e7-3522-4561-91a7-25b9aef79a6d", "value": 1181210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775479412, "uuid": "dfbd5894-f3eb-42ff-972c-0f0869ec9afa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479412, "uuid": "61326aad-07a8-4708-aa9a-8fa04e7c599c", "value": "image.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf33604-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501592, "uuid": "f551feee-0239-4f9c-a7af-a204ad00cb70", "comment": "Malware payload", "value": "4f252576f7fec1f1a472194b59ff2d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501592, "uuid": "6bd944c6-4d35-40cf-8f0c-539247fcdb4d", "comment": "Malware payload", "value": "35bc82d55b05bce923d6eb229cbf2462a8c4c8bb1a2b711451a8713cc19d9118", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501592, "uuid": "4e017876-0c7a-4d78-8a6c-97ccb837e368", "comment": "Malware payload", "value": "bebdde05593e33de1480ca89ff1af11e74a0304d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501592, "uuid": "4741aa0f-2910-42d6-99a0-a7ace7a483a4", "comment": "Malware payload", "value": "f092ea14e2d292b4155fed9f79ca3b29369a6525bd70a8b7079e9d33af3388884aa25c09c36d058de0b831ffae6b2054", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501592, "uuid": "170fa79d-c4cd-400c-a230-cb0758a28307", "value": "T12263410ABF611EF7F86FCD3706E52B49308C641A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501592, "uuid": "c8d1e810-952b-4126-a1f0-972303ae44bc", "value": "1536:nxo6M86eAtqV6lf2VNufYuI0Kck6n2MFiwbZn:K6MjeAt8692hulKV6nkwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501592, "uuid": "d62078cb-e0b3-4c18-98bb-fc86d449b43d", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501592, "uuid": "b635cf91-4e1e-4ef2-8946-6c2fab12dd4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501592, "uuid": "b54c34e5-68e9-407b-ad65-6b04263d28d2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2bb242-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463740, "uuid": "31e64814-e290-49b1-ab08-aef69462cf35", "comment": "Malware payload (Gafgyt)", "value": "4ad306331192f58e6d0903fb2346c746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463740, "uuid": "69f7b597-adb9-464b-8932-b66239069e46", "comment": "Malware payload (Gafgyt)", "value": "363cb0b6bdd66193ec537f2a2222657a8389c493e8e8b091268b748795c04c9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463740, "uuid": "32df4917-eb2a-4a9f-9b23-23b9e8fbd011", "comment": "Malware payload (Gafgyt)", "value": "fd25be66805d9a5c0160d3cc77d0aa3baa674b31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463740, "uuid": "3ab267ba-4081-4eaa-bed3-9075bfc023ee", "comment": "Malware payload (Gafgyt)", "value": "02c2ad24ad64b95ac41288e2c64bfaabb104241086dfd3db50335edcc22fbf8f70ae3ad5bdce180651ea3a7f00abd8df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463740, "uuid": "10c53734-a277-429c-8da6-d38bdbb80fbc", "value": "T18DC2C05D8AB63DC9C6FC2D34D0A803579D58708162EDCBD5C3748C886FB4D2B358E5A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463740, "uuid": "77d677ea-26d0-4a24-b003-1e86c1d79af4", "value": "384:D50LelzhAGIM2Ds3Waz7i3bXgIlBi4U3+3TrRWGVCz7zZ8euR3N1aMYbKP:D5hlzhA42DtaXXUV4+3pWTNCtNvY2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463740, "uuid": "326378d7-a338-4024-8c79-e2a36b3dc210", "value": 25760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463740, "uuid": "c0b2a23e-541b-4238-8b5f-e9e6606d14b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463740, "uuid": "c84b51e0-0bd3-4a22-8eb6-3a59ff819c16", "value": "cali.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ec462-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463643, "uuid": "76bc5c36-414b-4bca-b6d0-062ed423a9c5", "comment": "Malware payload (Gafgyt)", "value": "fa97907a77b8dffbe3e2464780020d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463643, "uuid": "3f3370c3-6e80-4420-a7c3-9e01aa31bab8", "comment": "Malware payload (Gafgyt)", "value": "365bd19979a7de7b34cb1bc01d35d7f4b4d4b0cda3996021fd88616457c3554e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463643, "uuid": "b9e7515d-6164-4083-81be-b4373c386c8e", "comment": "Malware payload (Gafgyt)", "value": "016a55fe0b6666b20aa29bbf08f015b7abe88224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463643, "uuid": "f7732dd5-e9a4-4741-844d-e8b2e803d446", "comment": "Malware payload (Gafgyt)", "value": "5f52da7b5ad97d951a55732e7b9dba147850225f5ce7d1b391f062448a74ebf1a15227f78b11f9af407c3fcb0d51a141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463643, "uuid": "c60dcb53-6bc0-4261-b54d-cbc5ac6f7f09", "value": "T13013F2E6851D71B1D2B00D37E20ED14212CE56F8F1F7A6353B585350BBA99B3F0A07AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463643, "uuid": "631bbe9e-d14d-44ce-a6ad-f95348bc5913", "value": "768:2oa01AcbhGPk9yYfcsYtvv6Ynsz0CBj0dy3KzO2q3UirYbmP2XuhFa+44+CpJUaq:221bhpdfcTSonC+83pD2XyQ59u6kDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463643, "uuid": "b6b84e1f-3de3-4ced-8206-e3260524b06f", "value": 45076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463643, "uuid": "4acc92e1-5f6b-48d5-86f4-76ff306159c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463643, "uuid": "98804603-38ba-44b0-95fa-ae0fdc78a2d2", "value": "cali.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f354a6-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501584, "uuid": "cbc264f5-dbaa-44d8-b001-cf107c133d32", "comment": "Malware payload", "value": "100f5f87b50d2f5895d8ea9e365e7395", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501584, "uuid": "7657f8d5-30da-40f2-917b-2365702299ff", "comment": "Malware payload", "value": "36da70c8b00b173fd5318242ce3b51ae0c03ca528440067458f0fe36ca4da628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501584, "uuid": "e80a62c5-804e-4f2f-9f7e-6d98ee19b05f", "comment": "Malware payload", "value": "f1fe0d3b99ccf84df58dec8e4af674cece646ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501584, "uuid": "7cc19dd1-1e63-48ed-86ce-b2d0ecb20cd4", "comment": "Malware payload", "value": "57bf327a16d8682b270e5af5d84a945ef05695fcdb55f8fdf4650c535ac72eeac3dc00af746368dee8fc7d4f91816809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501584, "uuid": "6b335d8a-fe1e-470c-80a1-38bf8308a6d3", "value": "T187333A13258089FCC40982B147BFA62BF562F4BE4234F58D6BE87E26FD5AD310A5D4C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501584, "uuid": "4109f91d-a506-40c3-835c-e4614aed0433", "value": "768:FnjJrbghrXpCJ9t3C0q0GNls1qttNo7MM7a0KGxDopKXobZ7/cKYeTBn:xdwG/t0XNlEqbC/7a0xxMd97cBeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501584, "uuid": "47e56e76-9e52-4e68-b15f-b41001922a0d", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501584, "uuid": "cd019b4b-0730-402b-837d-050eed7b735d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501584, "uuid": "1a36408d-5463-4d40-a609-1d93fa7f345e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1278ef11-31fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775510272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510272, "uuid": "c7ee4bef-8941-4475-894e-3d3594e87cb8", "comment": "Malware payload", "value": "09e8087abce716826fb777c047db2749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510272, "uuid": "19675ed8-3e57-458d-96b4-e8981260365f", "comment": "Malware payload", "value": "37721e6b938293cab3193367c9f53226baef67eb3b233c76aef376ad0ca42106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510272, "uuid": "a2a34a5d-d73d-469d-a323-5ea9cd3b233c", "comment": "Malware payload", "value": "16f6a715e32224fedb9e6bb9c46793033d5bfdd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510272, "uuid": "4805c951-af14-4e11-878d-9ea811f0224d", "comment": "Malware payload", "value": "0b908ec7480a7ee3ff8c84abd9c77684bae562b6940145d4f61a5b65c86c77159163266e7213922ffe413ca2298865e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510272, "uuid": "a82717fc-c797-448d-a15d-0f323145a40d", "value": "T1D8083331AAECB0E9E1456EFECD1935E5111B4C8BC1BD202E704F4B7B56A1B03A971B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510272, "uuid": "337877c0-5586-41a2-83a2-8b52bd34ff50", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510272, "uuid": "6f7e8084-ef15-4f47-a819-2f3f65c20c8d", "value": "1572864:ubBAV6xf92QoFXm94eybqP/LOCAAUsu0pmTH/2Ca6sgXZNd:ubBAoxf7odmVVqPAlpmTHsgZNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510272, "uuid": "20d63d04-03bf-4158-ae74-22e476625220", "value": 77973613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510272, "uuid": "c8cf0e08-c820-4d19-9415-448395c643c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510272, "uuid": "a4b76b14-3618-4752-962c-db8489765e8e", "value": "Professional Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f2cdbe-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470872, "uuid": "1324f3af-50e9-4ac5-967d-5ab2b6b00a46", "comment": "Malware payload (Mirai)", "value": "e4c6e56d4213dc44fd6ee1c4d659276c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470872, "uuid": "f8b87a2e-ae16-48b4-859a-bae3b39331dc", "comment": "Malware payload (Mirai)", "value": "3862cb9a8103b28cf00fd5119deb09b3d8d1f62e1a02acfb9365a7ab3428e9bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470872, "uuid": "e4ac3488-e5ad-4280-b358-2c4b17510507", "comment": "Malware payload (Mirai)", "value": "7e082e1f4d35b3a1ba3dd535648c3dbe3c205a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470872, "uuid": "554c6df9-a4a2-493d-92e2-515a8b0b7e6e", "comment": "Malware payload (Mirai)", "value": "265edec59bde8417d36f5c6b372988bf088e9fd62ffd56fd6f29cedacf3f748e6ea37c387c0244ca2215413ee22e472a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470872, "uuid": "a9dc6368-a496-4e2c-9e36-48baed71fcaf", "value": "T1BD632B07BD4480FEC559E138437EB13AD577B4BD1238B6EB27D8FE261C06E611A1D868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470872, "uuid": "1da74014-f90b-4d36-ae88-bcd8fbfc1788", "value": "1536:YkWfE2Q2Yn5GlvIRsecdj4omzAerWxfSDb/ku6OpLOMEJua8u:oM52Y5GisegT/hUb/kILOME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470872, "uuid": "1fdae81e-2c2d-48e8-acc7-eef8aea2f817", "value": 72464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470872, "uuid": "f55d5a1e-1d4b-43e8-8665-bb1a70264f97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470872, "uuid": "3a280898-baea-4188-8c18-86451878a455", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f121075-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442943, "uuid": "eb5323ff-dde8-47cb-8e75-f271c702dcf6", "comment": "Malware payload (Mirai)", "value": "414c850c435f9434d5f71ca262ca5a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442943, "uuid": "6a09b10e-da59-4df5-9166-8fac8e9a0792", "comment": "Malware payload (Mirai)", "value": "390c0b992e3a0547ff65880a1a2073f9245c7b4c6be1187b02fe52f7ec1c98e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442943, "uuid": "e5582fa9-8d17-4101-a5d8-f761ae351990", "comment": "Malware payload (Mirai)", "value": "4f08fdca1cbc8e4c27b5a985ca5656244c339190", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442943, "uuid": "0eadfc6d-9c2d-4fe9-aec6-e1026125d6f5", "comment": "Malware payload (Mirai)", "value": "2d1c0a5269e50e85e8a4a413a0a858635ffa020fb0bd6ad8afff790fcf739b0d3c515f55c04ee0828de012fcacca029b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442943, "uuid": "47194421-02e5-4a36-844d-8b85b5f3c622", "value": "T13F539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442943, "uuid": "b5429fd8-75c1-42e6-8f99-127ea1103d6f", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYPWgpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYugQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442943, "uuid": "31cb8251-2ed0-445f-920d-5d48deec9ce8", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442943, "uuid": "e89d8ba3-f00a-4e99-ad46-33e9c374113d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442943, "uuid": "87df390b-5126-4e76-b692-98ca91432eeb", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192a0806-31a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471629, "uuid": "41e9f624-f7aa-4012-8ca6-16716e5b299a", "comment": "Malware payload (Mirai)", "value": "577d58288a6410a903d31d940939234e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471629, "uuid": "181a2f4a-f703-425d-a803-5eda96a0f7e1", "comment": "Malware payload (Mirai)", "value": "39138d2dfdf1402d7e705c643804bd7238a597c3ae79927d8c0900fdfa33caf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471629, "uuid": "2c75b12b-2f74-4ce2-a68b-04022819783c", "comment": "Malware payload (Mirai)", "value": "3e022e15ceb66985b3e4255385455ab882c99f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471629, "uuid": "6d3c5ef0-3ed8-4aef-ac89-841849486c0a", "comment": "Malware payload (Mirai)", "value": "f6f5521436c18f1e43c6b8940bacfdf9ead2a1f0786f5ceac119d5fe5950c6fbfa01dee1afad37fefd824e038f6090c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471629, "uuid": "2a6c4544-9a5f-4ab7-bc5d-cbf843dfa07e", "value": "T180634BC9E683D9F9EC1509712577FB3287B7E13A2168DD9BC79869328C82A01F5062DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471629, "uuid": "e2106948-09ba-48d2-a9f9-9d5832e6a420", "value": "1536:Z5/LEmGCsOrSHG+h7an9DHsMJe0QsoNIDnCV3Oau68atCK:ZZ9GxOrSHXK9zsMJe0yeTie0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471629, "uuid": "6975f482-6dff-443b-8c04-5d111d664ae3", "value": 67092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471629, "uuid": "14025c44-e0a9-4790-8a60-0973e7ce6f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471629, "uuid": "5f1a9967-780d-461c-9295-0d4e8ba8925f", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c974518-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515846, "uuid": "54323e97-ca54-4757-ba5a-24b6a3216e72", "comment": "Malware payload (Mirai)", "value": "9511e54c96cdfacefeb8d26d8e018fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515846, "uuid": "4dfa340c-ba12-412a-843b-18bb4885b1f8", "comment": "Malware payload (Mirai)", "value": "395a4ceec1105ea4e4bead3ea654c64ae047bbce8b6483f39de12de48ad18e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515846, "uuid": "ece6a14f-1b36-493b-94d6-1d90ec034c84", "comment": "Malware payload (Mirai)", "value": "d8532b85f5a11cb4dfd72441565a70ed08bf33e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515846, "uuid": "17b6fc0e-1db4-4faf-919f-3f0c5319641a", "comment": "Malware payload (Mirai)", "value": "29a4e43204531c4ab6a8c12180044ea8b188cebafc0839685fa0da5b21803d89712ee00959f3e763883990db14cfa82a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515846, "uuid": "7c5463f0-7786-4c06-80d8-d357896a278e", "value": "T154732881FD47CAF7D81754B441E6B63F9A30FC2E4431D5AAEB65BEA2CE235C06206358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515846, "uuid": "9742f334-27ff-415e-8680-09e97b820304", "value": "1536:WbReNFgRZfeaMt4Ywm+4rWncch8qLcUHyLEWyD3:WOmZfeaMtx7+3cchDA8yLEVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515846, "uuid": "68012998-7169-42c7-aa76-577050b45847", "value": 74004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515846, "uuid": "09d94e97-669a-4f90-b2cb-f43063777ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515846, "uuid": "69830f17-662d-4ddb-abb9-ab47254a09eb", "value": "SecuriteInfo.com.ELF.Downloader-DN.11142798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e062433-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775472925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472925, "uuid": "ea18ee01-f31b-4298-a629-5bbfe2f80bfb", "comment": "Malware payload (Mirai)", "value": "b4826e4801a34bbc7dfe3a9be23b6d2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472925, "uuid": "705d756a-12d3-467e-9ffa-aa5a317cbf31", "comment": "Malware payload (Mirai)", "value": "398a4b9eb6fccb915674cc1ee53475cc7b7183d54a720b363321fd5945d6f59d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472925, "uuid": "1f9d7217-563b-415b-b148-b02fde46aa2a", "comment": "Malware payload (Mirai)", "value": "938673cae3cf276a47e66752565d62e245dba9ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472925, "uuid": "b6a7d7db-47c0-48d8-b4c4-30a30aee3bd1", "comment": "Malware payload (Mirai)", "value": "a41556bb893efa52a5724f050ecf812842942ea20de0abfb71913a7a416429f58d3acfbab8aea5aaa4ae19bc015b8eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472925, "uuid": "471be40c-ec2b-4386-88ca-a566e5d8d832", "value": "T1AC730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472925, "uuid": "5792f5a6-e368-4f7c-8e54-ba69cf948338", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjA0g:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472925, "uuid": "5010db79-fa50-4e31-9dbe-3ca6c5514715", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472925, "uuid": "4f4784f7-bda5-4108-af14-52224f75b835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472925, "uuid": "d41510b5-b6b7-429b-8d56-6e7c9e7275f0", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859da075-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463650, "uuid": "d4fd715f-76a9-412d-affc-d12116d3454a", "comment": "Malware payload (Mirai)", "value": "ebee820fd155f7e1e93d61cb127a00e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463650, "uuid": "275cb93a-6415-4c34-b55d-1c7b69241c2e", "comment": "Malware payload (Mirai)", "value": "39bea49f694f71113619706b0df298fefc29139f9006b5031a287dc4b3b351c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463650, "uuid": "abac6119-5be8-4a8e-95e6-bbe1c5320698", "comment": "Malware payload (Mirai)", "value": "4569fd45dea730a8d13a0fe574e91bcaeec8e010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463650, "uuid": "d7aaf226-2f1f-4abc-b0cf-d85fc3b49966", "comment": "Malware payload (Mirai)", "value": "b894f29b068dcf954225d63a34d97f01ecde74625839a2ab49d541ab5fb65a8ec4e4c6d2754f15f28a33b926a9f2b011", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463650, "uuid": "3d95d62d-1784-40fa-a3e3-cac2504bc3e7", "value": "T1C8C2E0D387A4C462F11690B56F4DABF8F193B83908ED05A815238FE08275949DF20D3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463650, "uuid": "913d0fa0-bde1-42a3-a1c4-8c29b42695e5", "value": "384:h0WWMfdriGrm0LCP9EWMKm/zhVjfBQPV7cNwAAWimagle0aZCb6jDIpba6QqV:8md+P0LCP7uFtSPyuVm7haYb6PYt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463650, "uuid": "a9a25f91-6344-4e69-8b12-39c2eddd5494", "value": 26216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463650, "uuid": "c15b5ae5-021a-41aa-ade0-3603b1e4f4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463650, "uuid": "81174c31-9d36-4214-8231-e6500960c9c6", "value": "cali.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4a117f-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440979, "uuid": "d10f9298-2fd6-4e62-8f26-7a4698e3aa4f", "comment": "Malware payload (Phorpiex)", "value": "a6ba822be61410fb3a5abb3832c9f68d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440979, "uuid": "d578e338-b179-4edd-bc0f-1f0f4b279823", "comment": "Malware payload (Phorpiex)", "value": "39c064b7e80aed53c6dd9eb06207b9cbd334a63b83e2fd5ead7727005a12a3b6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440979, "uuid": "657fa72d-9d10-48a4-9d6a-b0c74c7e5554", "comment": "Malware payload (Phorpiex)", "value": "1a7e766ecaf2ff66675e24163abd80facacf7405", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440979, "uuid": "7a008f98-c3e3-4af3-a38d-b60077b402a8", "comment": "Malware payload (Phorpiex)", "value": "e98a3608819474ce6ed39873b17df72b1ff62915e1051d89846f40896d16aef8154634c800d41deaeda15c0b886be839", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440979, "uuid": "3e5e0bdc-2666-4178-b647-eaa83a44f608", "value": "T12E823A0FB9424216D0D100B4A672867BD9B9A87637C864EBF7D48AED0B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440979, "uuid": "fa64f5e2-eb50-499d-9da7-de0a84261bbe", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440979, "uuid": "9e3389d5-4cad-4ae1-838b-97ae7d4518e4", "value": "384:UI78VGwSRFqw/lsx0xu9NHRgdav8U9cc:VXhsx0U9Ea0Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440979, "uuid": "1f5a7673-10ec-4ce1-818b-238db3114429", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440979, "uuid": "4ca92d5c-e9ed-4c45-8c2c-59e60a59f673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440979, "uuid": "f772aeb4-83b6-4375-9176-d51d55045d8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d9b093-31ee-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775503537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775503537, "uuid": "be3648ff-e3c0-4142-b7f6-42e74b4e6673", "comment": "Malware payload (RustyStealer)", "value": "6cd8cce1e43d80d9b4b19e0e4a64a6dc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775503537, "uuid": "0b7dc172-a22f-4b1f-92aa-1c23dae6c517", "comment": "Malware payload (RustyStealer)", "value": "39d9484fddd8ed768d0dffbecd446700029c693d88371830b8edefd68f712612", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775503537, "uuid": "78be3903-0814-4755-822b-a4ca27ea1eb7", "comment": "Malware payload (RustyStealer)", "value": "6e19c524571169d33a0e4168f6c782fd2b5af386", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775503537, "uuid": "4113b807-288e-4ad2-8ebf-d37374b7642a", "comment": "Malware payload (RustyStealer)", "value": "7f21fadb6812690700fa1208203a430284b6d0fa91680d8b5b58e25c966968633baba8dab9490cf78d15bdf63d7fa12a", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775503537, "uuid": "c0ff6bec-2f48-4934-9faa-b2f91714aa84", "value": "T1C8051226794095ADE40AC0B8D35659B28535B0AB0F31B2FF07A555393E19FF23E3C729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775503537, "uuid": "d78a41e7-8f43-4546-8e31-f9560556631b", "value": "0267f97138abb2f350e65e419b67c4ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775503537, "uuid": "b11a9291-cef3-4b2c-bc32-cf50a536fd86", "value": "24576:r2R3yDXGiPti3IQbSuPQftjqMNLIpGBQBQ5:r20XGiP4Y+bWqMNksBQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775503537, "uuid": "fd9fa2a0-aacf-4b6e-8881-3faf2ca0be60", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775503537, "uuid": "9a874784-854a-4c4d-9022-ce3b5b154404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775503537, "uuid": "4db62cb8-5a23-4cdc-a3a3-3d14392cb50a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e4736-31a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471623, "uuid": "f3f6b3d6-b7b3-4cc1-98e9-6e72ec7255e4", "comment": "Malware payload (Mirai)", "value": "33c3a13ca947e6b1fbd059a45305144d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471623, "uuid": "e47e83d9-3216-4e1e-a9d8-617c51a8aec0", "comment": "Malware payload (Mirai)", "value": "3a6bbae2e93670400b2a39e59c16e7fcace3d72a70c319cebd1bf1c858eb9c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471623, "uuid": "98f4baeb-e640-447b-a305-86ccbd7e4076", "comment": "Malware payload (Mirai)", "value": "8861bb07804c5ea510e78c0f04758ec1e83d8078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471623, "uuid": "8eb7d7c3-c013-4bc2-9667-6f4026dfc245", "comment": "Malware payload (Mirai)", "value": "d1d77fc94b30a4c46164cbf67df3acc78c9268934fe5252313c527445f9bdcb34a5c6d9e7628eab1ec3fdaadbd31fae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471623, "uuid": "6ca0fe5c-5f29-4fb9-a656-cbfdbc2dbe34", "value": "T160731883FD81A603D6D4127ABA5E518D33256398E2DE3203ED126F203BCAD5F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471623, "uuid": "a6ae7030-9eb8-439f-a111-8b41a7ff7534", "value": "1536:t45wQcg8w2+n5Lq1VeoJvAuKXHNWyoVaVvxkIQjGjzmZA6WMFPJ:t45wQ78pFvAzXHkOJkFjmoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471623, "uuid": "9fdda3ba-b61f-43b8-b23e-951fe9996873", "value": 75276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471623, "uuid": "b4a28efc-69cb-46ab-a8db-d99eea6c2fdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471623, "uuid": "0d3861ca-4f7c-457e-b0af-4a645c835780", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e0b040-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501547, "uuid": "403b3397-fea2-4175-a8b3-53b2d8c2ba1b", "comment": "Malware payload", "value": "2c36ea17310355d0629f9436847e2dc3", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501547, "uuid": "f28eb72f-3160-46ad-9f20-5e25287a5474", "comment": "Malware payload", "value": "3a787a7b850b92a99d20f52747f1e13428039a149b7dd6295f6ca11995d88e0a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501547, "uuid": "372e5fd9-27e0-48c0-bd55-c8590165f145", "comment": "Malware payload", "value": "c411741ed4713f111948ff85f580fdbf23d81f76", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501547, "uuid": "60971768-8f4e-4b32-afd9-e4c58b301dd8", "comment": "Malware payload", "value": "a524ad2947c10ed557af9e4907f9865b15437bcdd2ed79ca379906be5342f3d81439b3a21b34bcc231d096d4dba8631f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "OilRig", "colour": "#1D9F57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501547, "uuid": "15fc6573-7f2e-400e-aabf-b8a41c29c9d2", "value": "T1ED6594178915C782E42946F8BD031EA96F5B2B1CE9D23AEF11235ECF3D202664DDE12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501547, "uuid": "8bf87a4e-4f50-45ba-844b-6d121685ce5c", "value": "24576:8rlNSREIjCl771rVRpKaPwV8kaUMkj7kWk7xuhai1oM54t9OwdeLI:8rlNSRsFhVRpdgJapgk9qaSl52O5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501547, "uuid": "0190be2a-e4ad-4c0d-a70b-cc1cc674ad10", "value": 1415774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501547, "uuid": "6a482be7-86af-4c31-8124-5099772eea0c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501547, "uuid": "ed259881-1099-45e0-84eb-b83b042e3af8", "value": "0014.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83ae76b-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501611, "uuid": "cd127aed-baa3-441c-87c9-0584b21876f2", "comment": "Malware payload", "value": "0ebac41703d69b4c8c85b3336d638d55", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-2635", "colour": "#F7307E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501611, "uuid": "603ee181-d27d-444b-b45e-b4749447dfbb", "comment": "Malware payload", "value": "3a82fb927562b0350e7181b23a3c30474cee09aefdad6b8a850ce7f81ed9b36b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-2635", "colour": "#F7307E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501611, "uuid": "e4ddcaa3-a6da-488b-970a-26c9ed3f15ec", "comment": "Malware payload", "value": "353ce9c880388f6139659dfc608fc372c02652e1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-2635", "colour": "#F7307E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501611, "uuid": "b8e34a03-340d-479d-a7c3-84c39f20f30d", "comment": "Malware payload", "value": "2f495e46f1bf35161f6ba1e85f2dd90a7c975d97f49286057ce81beda93960c49547dab7bdbefd487f190e7c93f282db", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-2635", "colour": "#F7307E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501611, "uuid": "739367d6-2c87-4d4b-a8c2-90c539a8650b", "value": "T172E533DC86D2CB1523AC0F4169271CBAC9F56D62D9C181BAF21EB2448FDB6F5369C10E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501611, "uuid": "9f089184-97e8-4127-868c-5a0d322afd65", "value": "49152:8qShwVmPEA20paVgkofgDrhiuDtSn8VC3fvMalGp/Z0KxQ58oflzJu:8AVmMA2h/M3OtS8VCHMalKlxQKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501611, "uuid": "754d117f-8eeb-44eb-b698-ab6e6480b3bb", "value": 3276547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501611, "uuid": "08c22669-7200-4576-a895-bc38e2db60e1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501611, "uuid": "befa5a60-4652-48a3-aea9-731a3f287142", "value": "file_install.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334e0041-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775493577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493577, "uuid": "8c59ae40-f505-4a1e-b51f-fa36879db363", "comment": "Malware payload (Mirai)", "value": "55452f98c49a2b42665fa60609589388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493577, "uuid": "bd39ad51-f2dd-4dff-bc57-6957d9565a38", "comment": "Malware payload (Mirai)", "value": "3ae5fdeed012fdf6fcfff1a6c35a53f5ab3e33e4d812fc84cab200e0dc6d82c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493577, "uuid": "a193df3f-7224-418b-9120-1246687068fa", "comment": "Malware payload (Mirai)", "value": "0bb35963d0979c8d5223d6ce82b6adffe6fbd146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493577, "uuid": "2f019d0d-46a3-4705-a042-8cfe2fde26ba", "comment": "Malware payload (Mirai)", "value": "4e5afb762e3031613522b4e4814e180b15bd34632522d3ad92b3278d8c36702f2e3517f2390b771d708934be9015e2d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493577, "uuid": "acceb6a0-8bad-4a5e-976b-a1fbe15b7602", "value": "T162157C2EB2B2F1BCD00BC03457DBCAA15535B47522222DBB26C4DA353D6ADE51369B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493577, "uuid": "6faba95b-062e-4afa-987d-8f57fcb372bf", "value": "12288:znxHUgkNgitkzO/S+tqIZdEHtY9s60SFoyez6JzM/vDie0isz6aySdm0bbbbbbb+:znxHrkNgj8xt/r2XDiqszWQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493577, "uuid": "38ff0974-c983-47b5-881a-c842bdba2cad", "value": 957040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493577, "uuid": "202e06c9-e3d9-4b25-b938-bb68a2330711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493577, "uuid": "7d27f685-3afb-4a75-af8a-7786d3db5eb8", "value": "clientamd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c08fd6b-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442911, "uuid": "57a48b15-39bb-4c1d-a74a-ada13b3e1cc5", "comment": "Malware payload (Mirai)", "value": "2d10e6cba80dff2a57f14ec98ce2b17b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442911, "uuid": "32229d28-f5d2-45c3-a19a-4afbe6286985", "comment": "Malware payload (Mirai)", "value": "3b1580c108eb2cd36bd27dd28cc9cbef17575e7049ddc4aae41019e10fec1ee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442911, "uuid": "1124e309-2908-4ed4-9095-00042acd4af8", "comment": "Malware payload (Mirai)", "value": "24220cc7861e52417a5bd56e2c11b83c4cefcd94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442911, "uuid": "3f60f777-d0c8-4f99-90a8-2b0d39ca336b", "comment": "Malware payload (Mirai)", "value": "1011b24b08248e7c27f13db29cd81eff2818dc2f8f37bae5da6c632af1f899c9474d1d37cf9e4908c14a0d47f6cc11f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442911, "uuid": "a72131a8-4085-4b6d-8862-0ddc75914948", "value": "T14903E171E61519F7C9FCCDB7510F06949A9271C0A66F8EC825088CA8FB75B5E3ECA0D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442911, "uuid": "a5092c44-57d8-4569-88e5-e871d108d8ef", "value": "768:mVyIwYjG0JFjqdRxrlbBWpvMmj5BWStQ+csjghthV/W3:mVyYjXJhqdRlllOLFBZ2hthVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442911, "uuid": "aa55ad30-f95c-4bcf-9514-8b2183cbecb5", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442911, "uuid": "72e7d075-0ba6-4a17-a614-d5cb403e24a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442911, "uuid": "6bed04aa-ca73-44ad-b874-68059684deba", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a97dec4-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463659, "uuid": "35770a82-03b3-42c5-a6d9-4191c77d83db", "comment": "Malware payload (Mirai)", "value": "e0b77abdcd1effb5ab200317116e500a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463659, "uuid": "bcaca53e-a823-48c1-b17b-f636f935331d", "comment": "Malware payload (Mirai)", "value": "3d605b4e113d87780f36a26cc04f647e04f65744c8c2055d1dc194d0c39652ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463659, "uuid": "b000e008-0c38-4701-a436-f221021b5620", "comment": "Malware payload (Mirai)", "value": "76884a7f984b779653a6264226a1ca28c1559036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463659, "uuid": "9f97ae07-a68f-4734-84e8-fbadb369445f", "comment": "Malware payload (Mirai)", "value": "74380983f1f7ae102e02a55cb663798b2ad27ace0287cf79074a017d3e12154bb5461795b19ef5f1f1624afc35ed430e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463659, "uuid": "fd02c815-4d61-459a-9403-22871c2c6a72", "value": "T1FAE3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463659, "uuid": "38a0b7c3-2c39-4047-8111-419b8e2f488a", "value": "3072:UxjJw1Cc/0s6YAPwenUr48pzfR+JonEy:Uxlw1xAop0YfRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463659, "uuid": "871ac818-23e9-44fc-b254-9b4e28b3627a", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463659, "uuid": "22146c40-9b4f-4b6f-8eb6-31d1d34a3af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463659, "uuid": "c44c9f7a-92c9-41fc-a9f0-53ad2805234e", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109327f8-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493519, "uuid": "01264d94-c2d9-485e-928a-7a806f7626be", "comment": "Malware payload (GlassWorm)", "value": "f3613fc8d4c1069e0796f4e233a426b8", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493519, "uuid": "0f99f3df-0fa5-46c9-aca6-31c66e4e67a8", "comment": "Malware payload (GlassWorm)", "value": "3ee16b73ec84f6d1a448bdc6343a17d93bebe515f306ad3986729493443389be", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493519, "uuid": "075ed245-6004-4f62-969d-e4a50c1263c7", "comment": "Malware payload (GlassWorm)", "value": "a872e008547fcb3f78a929aa2099085de640c9a4", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493519, "uuid": "bb38b0d8-b4e3-4518-9f14-ab08f16ad3af", "comment": "Malware payload (GlassWorm)", "value": "a4641f7f487257d53b5cf2903ef7938c7eb53d1a0f21539eea266d6278753bce3774b70b9c97dd3a3c03c148d6d9e888", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493519, "uuid": "926bcd2f-8cc0-4173-82e3-6a81002e6bb2", "value": "T15125BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493519, "uuid": "49774ac3-185c-4366-b5dc-a79d7c0e8f5f", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493519, "uuid": "1553ec02-372e-4518-869e-c58b90913f5d", "value": "24576:I+pq+2TQOEe0JRh+w+/Y5bsY5b5Y5boG:INTLEeiRhmYqY7YOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493519, "uuid": "f60a17cc-fafe-47db-8532-c6164bcb8422", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493519, "uuid": "7e581b09-0d2f-4e37-9edb-c8a55d600b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493519, "uuid": "78a4f10c-8f01-4084-bec7-76e774138f6c", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083769f8-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515838, "uuid": "973190b3-3d88-4c2e-a345-a05823a272f3", "comment": "Malware payload (Mirai)", "value": "55c9d737c5840fe3dfefc2eb9ab65aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515838, "uuid": "43ed9645-999e-47bb-a888-701094ec4ce6", "comment": "Malware payload (Mirai)", "value": "40cd6b2a6ff91936d95570583fd0e68fdd94be35741be65145b6894849e98307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515838, "uuid": "9626e238-975d-4e1d-829d-5e9a9de1b7ab", "comment": "Malware payload (Mirai)", "value": "88d5ba6bd0da3a8e0d58cc3a8d39cb4016a84d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515838, "uuid": "cd45241e-9b35-44a3-a627-dc91f17a5fe7", "comment": "Malware payload (Mirai)", "value": "0b0c8228afe58dc989f72921d7b0dabbba8fd6c74fd42563c0f6086ab08f62c373c9b624d1ee74c84a174a7093127a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515838, "uuid": "5806a86c-5a90-4358-9528-148e27dc20f5", "value": "T13E834C67BE324F17C4C2B2B512F30731F9B5ABAA2C78415ABDA12DCD6B141D031577A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515838, "uuid": "debab958-8b14-488a-87d9-e4ca56249f7f", "value": "1536:S4/Nl1DzsTFHEUtPld1g8bbCtRh/gZ9OxlM5Qteto0/:v/NlV+HvGHWYxl8zm0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515838, "uuid": "0b7a0f09-eb06-4f39-8297-8e2b768b4594", "value": 86280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515838, "uuid": "3b220545-e883-40ad-94b0-01bc0f6fd79d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515838, "uuid": "13ca4146-1fbb-492e-85bc-f976021e4a0d", "value": "SecuriteInfo.com.ELF.Downloader-DN.87512331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dee9bd-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463696, "uuid": "cbe6b891-10e8-4faa-bee0-43907e4a3c42", "comment": "Malware payload (Gafgyt)", "value": "50c927de2447122d4f4e6341d2782c57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463696, "uuid": "358f40b0-db54-4d5c-a8c8-884248f78a28", "comment": "Malware payload (Gafgyt)", "value": "40e23261afd448a44b7edb3054004d50e27c696806cdc8d2716e2748af3227cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463696, "uuid": "71fd7b59-6a92-4281-a707-1d2d624316cc", "comment": "Malware payload (Gafgyt)", "value": "c57d31cf7400f1e47dfd1868e1402cf0ebd1f193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463696, "uuid": "94cc3f0d-6334-4296-93af-32b1eed43a98", "comment": "Malware payload (Gafgyt)", "value": "a0da9196d17fab8155c1c4cd9c63393f13625bdc8bee56db19f4b084ef8d0302352eb695c070f0970027816494031cae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463696, "uuid": "e5d1787b-e3d8-47e0-9f73-c7a0b3683ec7", "value": "T178C32909EA408757C5E127BAFB9B828A73239F4477D7330546287BF43BE57A99E32005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463696, "uuid": "6c007b10-3c35-45d7-a996-8eead473ce2e", "value": "3072:12GYuEQTZVaa3Mar1b+qE64UlEVSByAM/9jCAQmTw9mo9JN:ky1b+qz4nSB5M/9jCTmTw9mYJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463696, "uuid": "482f0934-1583-43aa-ba3e-64b55f2a1792", "value": 123430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463696, "uuid": "da93aaaf-7160-435c-b36d-d4b572b667f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463696, "uuid": "8b9e14e1-aedd-4e34-a927-93bd889595f0", "value": "cali.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355a6b72-3205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513337, "uuid": "21667070-5d4b-4fbd-8799-5046e977506f", "comment": "Malware payload", "value": "9918cbf44391c92f838adf21a7a542a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513337, "uuid": "0f138657-9b69-4f4c-af0c-6b97294cb51e", "comment": "Malware payload", "value": "444785a04fb5b11ea8e68e04d962ce7efa3735d4b376fa83ddb32b201a0c8e19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513337, "uuid": "df952d26-14b7-4ef3-8d10-87c8c08ba692", "comment": "Malware payload", "value": "abd8875c79dd32a6f035fa47f79811c240c1c6ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513337, "uuid": "7d437056-2dac-4e29-a927-98179e6770f9", "comment": "Malware payload", "value": "935dbd0706b12a81c2604baa2119a35153d1a05edbb16877fec3c7e7ea92777293c556f8f247bc234f0175050823e578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513337, "uuid": "8a1c55d3-6447-4579-aef2-0e3db02a72df", "value": "T1DF440859F880DFA186C038B6F75D46A873170B79D3EFB1058A255B343BE786B0A3B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513337, "uuid": "d1feff47-64fb-457f-8d12-c2df355a3962", "value": "6144:wVROqqv2qtRSYOT2ZbdWRHOBB8cM3cZAk7ROwXTgcn8l:Y/qvfRgAXIp3WRPT7n8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513337, "uuid": "e32b73bc-ebaa-4847-8b8f-03dc46a641aa", "value": 271994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513337, "uuid": "528625af-d26d-4942-81df-f7b7402a4097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513337, "uuid": "4a596ca0-e248-4fc0-b79e-777de848911f", "value": "sockarm4n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf45acd-3198-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775466615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466615, "uuid": "68e119e8-8485-4e2e-8de1-b74a2e339b6d", "comment": "Malware payload (CountLoader)", "value": "d15b93fcc58c7dcdec73313a32d9973c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466615, "uuid": "8511ace7-f002-4225-8183-9a33317e9fbb", "comment": "Malware payload (CountLoader)", "value": "44d9a3fb370930a9f93ff93fc290635621540094de4c95f21896891e2587d941", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466615, "uuid": "570caa86-1a1b-4003-bb4d-024c7ee7fd79", "comment": "Malware payload (CountLoader)", "value": "468f1e1d844f475007203933e9f3717cebe2c9dd", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466615, "uuid": "206bc2ad-a39e-41c3-a270-03c82033ed66", "comment": "Malware payload (CountLoader)", "value": "22ef387af5cce6e79b98042458c22d1cc258038c26b69a4cfd2259c138374d399b2eed96ff075f302ade5e7de840d1fa", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466615, "uuid": "575b62a0-0dd2-445c-b064-30403471ed22", "value": "T1C2D3EFCD999A8CF5871F242B493B9D128B8D9163121EC8A1BECD9F543F275B0F0BA5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466615, "uuid": "1e844c5e-6d5f-4b29-85c0-43d4ace92edb", "value": "768:37Jh6+65WvLLod6UxribYPG8yM8AAe6f6u6a6n63wRJa4pwq29SqcrXc36pQ4wCu:thdLYGYVZlZwXy2yDwEBkizS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775466615, "uuid": "ee6fa3ea-33e0-4e4d-957a-8f21c7c29943", "value": 141253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775466615, "uuid": "86e7ad68-d4da-4d37-a8c0-d665247e298d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466615, "uuid": "ab01ccad-3390-4267-865c-7d4a9330574d", "value": "Work_Edge_Template_183.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d04a31-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775497181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497181, "uuid": "4573cb8c-b088-437f-b48e-63d488ff7ffe", "comment": "Malware payload (RustyStealer)", "value": "548f851914ba220dc09a823c223a9e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497181, "uuid": "8858c8d1-a831-45d8-8c09-5a45fea01c57", "comment": "Malware payload (RustyStealer)", "value": "4581ab13d25cf1fa9f782dc981282a3e41163d6544b13faf6c43ba1d43511684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497181, "uuid": "4cf61b80-f848-420e-8f96-84d1decefc68", "comment": "Malware payload (RustyStealer)", "value": "703af374d9541e32ba3326fc4f007a90c63e036f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497181, "uuid": "f7495d3c-17cc-4129-930c-886f34fe07f3", "comment": "Malware payload (RustyStealer)", "value": "a17ab51f170c33f2c4c56f998195d0339803352b16cad57f6634249ea380f3f2aac3f1634424712020ac3370c14ad7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497181, "uuid": "32069539-b52d-4d45-aab6-5a718d0ca847", "value": "T1D5567D43F35292EDC12AC0749355A333FA72BC89433576FB6B944A313E56FD06A28B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497181, "uuid": "0af65494-2afa-4ed7-a8a5-2979c369fba8", "value": "f4a8266b5e365bde48b9f99563e199fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497181, "uuid": "b979643a-a275-43bf-a3b2-6a5ea91b7fd7", "value": "49152:AVd/B9RamRH2LSFtkhOfDEgKwODpPmjp0d9n6kEqKjoZL77Uq57PBwXlOfMT8XwL:u92lEIgKdD4syecOUmarq70CYb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775497181, "uuid": "65af9f7e-3765-4afc-95df-3c40b90182ff", "value": 6444032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775497181, "uuid": "25799ae2-f0b2-4007-9727-a6241bd96a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497181, "uuid": "9aaab32d-5b4d-4345-8cd9-3cd107179e1f", "value": "app2_v1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449c8a0f-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470413, "uuid": "7a2d1453-db02-44b9-824e-3b2e06fd2cd6", "comment": "Malware payload (Mirai)", "value": "a8350950c6a2b7b97c0ffe8918cddc97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470413, "uuid": "c7764c80-2d57-4474-8d0d-4b3264fbba54", "comment": "Malware payload (Mirai)", "value": "459bfca9f896d52ad6130a3db516ef7c7b55542b98d8ef386b5a8e153b1fc70f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470413, "uuid": "e06ff1e0-9b16-4b22-ab06-9159a6dd1e54", "comment": "Malware payload (Mirai)", "value": "dc880a08fa4d933354e3444556ec139527ee6566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470413, "uuid": "460f0475-bf9f-4dda-9a2e-20a63a6b8428", "comment": "Malware payload (Mirai)", "value": "ea2aca3b4e7bd599098da1a6f2506d4ed1a9ef9a21f018e58cd68b25e34aebcfeed1794f15b3be863b12fc976ce0e90c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470413, "uuid": "5951719e-6141-494d-8226-acad0bd4a3ea", "value": "T1C5434AC4B183FAF1DC05017C307AEB325E33F0B6613AED9BD7E455B36855206960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470413, "uuid": "070dee87-8fd3-419d-8b82-df414368545a", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbEoPRdQZl7dDFfG:xzuXndFq4ZthB/VUfOW4oPnQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470413, "uuid": "1d73a0c4-a0af-4496-ae4a-b737ed2670e8", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470413, "uuid": "d9f33bed-3a65-49ab-aecf-31b4f442d3d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470413, "uuid": "2dcae00c-b903-4011-b57a-b1e9a4ab3683", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13a0776-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496902, "uuid": "dd9c8dc8-efa9-4d02-bc2a-8102bc08649a", "comment": "Malware payload (Mirai)", "value": "c2775f6e1ddff5dd2d1f706a675a710d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496902, "uuid": "6e8c2127-2edd-49ee-a0e1-5278c010c68d", "comment": "Malware payload (Mirai)", "value": "474b55656d9be9d999de9a7cc9a7a9a55880fb3b4f685901088e78790b1c98bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496902, "uuid": "5c51b104-df36-41a4-abd9-265a1fb0d16f", "comment": "Malware payload (Mirai)", "value": "e0ada734f93e5b85fe3ab65c37fff0ae139a1628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496902, "uuid": "099d3606-6a2d-4ad1-aac3-ac398bc49352", "comment": "Malware payload (Mirai)", "value": "f5200b9dd7f23ec557d09be8c10d20a747ef8fe869363f0cbb8e6dccf3e0e89385d4f27f073425843dfc4b3d7600297d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496902, "uuid": "3760faf0-d1d6-45cf-b8d2-de13e2e30cea", "value": "T153A31846FD819F01D4D331BAFBAF414833536BB9E3FA71029924AF61238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496902, "uuid": "250ed7bb-aa4d-4166-a24b-63b86a461a65", "value": "3072:i7Kr67JKfTm5SXjoa+L4AvFeuBXFJdi8u7/:gK25Sjoa+L4AvFeu5diN7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496902, "uuid": "f7aa869b-7a1e-4574-83d8-0eb4bd440fb7", "value": 105928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496902, "uuid": "9ace2bb7-9848-4fa3-ade4-57c8d470864f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496902, "uuid": "e67bf151-f384-4c83-be38-9f9e97465ea5", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fa1cd5-31a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775472219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472219, "uuid": "e8336b9a-71d2-4404-8037-1d65e0e330ed", "comment": "Malware payload (Mirai)", "value": "927d066238334b5727d5e53791af4e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472219, "uuid": "68302b92-5f89-47af-9cd9-493ee0b2ba03", "comment": "Malware payload (Mirai)", "value": "47d7b7f44920c232a29b73f0ff4bce9879bcb82454756613c305f31ec494d2b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472219, "uuid": "bcea2bf1-fc4c-473a-96b1-87d65c49666a", "comment": "Malware payload (Mirai)", "value": "c7a75e6f6ec9c1f70eecf164a8a4aedb9f3e3da9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472219, "uuid": "770c30e6-0c59-4e08-b6f2-26d649ba107e", "comment": "Malware payload (Mirai)", "value": "67101f35a29516d179547cb015851c8750a0e3ee4723fc216195b7fb94a84459e6f05e851de7dd47b06630ddb61c98cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472219, "uuid": "1be18b0f-7a59-477a-8d5f-4ee39add621f", "value": "T15E734B86F401DEBCF81FD6FA81114A0EF92162455E430F26E7A7FD936DB20A44D67E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472219, "uuid": "3ef5f072-5fc3-4355-923f-32aba8cc954b", "value": "1536:rIkt4iS4L4l+yICDc5VGNM3kwpToc8nxKspU7AWTA6ZZ4wi:rIkt4X4L4l+yICDc5x3kwpUylTAIZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472219, "uuid": "598f7fde-58e7-41db-9eac-ac2fae51940b", "value": 73880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472219, "uuid": "40578dc9-4263-4f76-a6e9-719ce7fc2fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472219, "uuid": "17c181ff-3711-4f4e-89e8-68c1ff0db0be", "value": "mao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cbf3d5-320c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775516631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516631, "uuid": "c341f006-828b-41c3-b280-7a6eb06fb0ae", "comment": "Malware payload", "value": "97f5f5e9cc916aa75f23604495d5160d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516631, "uuid": "75bbdf8c-7ccf-43c7-9caa-71cd54db567a", "comment": "Malware payload", "value": "48954e1f829141cfee8ec7e4a90e6d1c197d459b9648e8de80f0ebf0955d3f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516631, "uuid": "e1e68da6-39ce-4d43-98f5-404b0a13654c", "comment": "Malware payload", "value": "0b69166b799b8492e5b7a01399e2d76642e3be2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516631, "uuid": "62963f73-c593-462c-8553-db380b2b85f2", "comment": "Malware payload", "value": "fd7d0ac01a462bca50a26f9dabf1ebfc934fcc619137bea7c5ff53ec5fad9105929ca667fc69bfd5358a25e7aab83b28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516631, "uuid": "5770b4b0-b133-45c7-9382-b5a61f5a285e", "value": "T1A5F45D89E7C2D4F1F66300F10A8FD7F21964521A5053FAF2EB8C26977472B622E17369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516631, "uuid": "d2a5160c-d760-41af-877a-5a4518407433", "value": "12288:P10Z0XhhxJhJcb1YKeee0XY9ttxA5cKkkEwEG6fMmua5rPyhRr8pMNULu/:N0iXhhxJhybDeeeTttxAmKkJwafMmua4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516631, "uuid": "1f63db49-10a1-40f8-9948-aedc2e04ae64", "value": 775232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516631, "uuid": "3b496022-085b-4524-b8d2-71e0d7d4b8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516631, "uuid": "4711be2b-5d8c-4347-964d-ead17643eac5", "value": "sudpi686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb0ebe1-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473109, "uuid": "7365aa3b-732d-430b-a006-66add6d4bca6", "comment": "Malware payload (Mirai)", "value": "ac4d36edceeae91b59227624efbd8b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473109, "uuid": "8f4963a6-62d9-41b0-b41b-4e6ab50dc6a6", "comment": "Malware payload (Mirai)", "value": "491ca52fe6e0f4c8cb262237617e4e43aaf2ce74d3ed13cbf959bd48192466fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473109, "uuid": "67befd99-f974-4940-87a0-565415eb7a25", "comment": "Malware payload (Mirai)", "value": "22fb509f6028da7bd73a1ec2c422ccb4d3c16f0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473109, "uuid": "2e137fef-82c7-4faa-b45b-a9e6916e4d04", "comment": "Malware payload (Mirai)", "value": "41d999de109eda473c4460e97ec5d188a07340f7328018ed0bf0ead2c3cd4a22bf29dba5c00405a856ce32674010b8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473109, "uuid": "94833b0f-39a5-4189-a20c-55bc110f0fd5", "value": "T1ADD2D07EE5B441C6ED8E0C3E80CD3BA10E56D1C1631BDB9577218C895B32C5BF16A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473109, "uuid": "044071bd-2ff6-4daa-b2ae-c50a779deef8", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orj9+yrjRWGVCz0Nv+:jMYHb62x4ahQ3CfdwLjc+ytWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473109, "uuid": "56ace290-e43a-45e5-a78c-d88809a1db95", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473109, "uuid": "c8ced532-22dd-490f-9751-9ebe7406cc4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473109, "uuid": "87205ee8-28be-4af5-b5ef-32c82665d14f", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef71bea9-3196-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775465975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465975, "uuid": "aa77209e-deda-4b6d-a21b-f77b85c8952f", "comment": "Malware payload (Mirai)", "value": "fdee2e7a8df81115812c67a68a21bddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465975, "uuid": "4a00ec74-2c40-43af-ac3e-183d022fb25a", "comment": "Malware payload (Mirai)", "value": "498eb3260c37e6b39480ddc2c3aa0899065b99a75d587ab81e8be8d6045bae15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465975, "uuid": "c415275c-25cf-44e4-a5b0-58c3c0be65d9", "comment": "Malware payload (Mirai)", "value": "329a647281722c57fa1b25794396c236ba1b7498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465975, "uuid": "4f003fc0-15fb-4f08-84b3-31cf924e7876", "comment": "Malware payload (Mirai)", "value": "17d44bc1c122fb00078bc6f322decc2500ae7100772912ea66baf035ecbfb0ee6e879757f69fdefb6a1e85daa7e2848d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465975, "uuid": "212097f3-0a26-4807-b129-aacd75906d68", "value": "T1EE64F1CAEF11BD3AE9C006757A9B074DB3B59B99C3C3F150F190C62E39A9185AF660C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465975, "uuid": "1a5ab763-1cc1-40fd-8b82-313c61844b90", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiohKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSi4KqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775465975, "uuid": "d98776fe-8ecc-424e-b849-cc11efbbca41", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775465975, "uuid": "66cc0aff-60be-44ff-9e7f-c2b1c529a49a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465975, "uuid": "e774ab23-fedb-4052-9f41-ea6c2d80de8e", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94127d45-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463674, "uuid": "1c18b630-eb88-4f61-92b6-28c8fcc77707", "comment": "Malware payload (Mirai)", "value": "a4ebc58e7eb21d1dcc5e92baadf7a5e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463674, "uuid": "603f1eba-a1c0-4969-a719-e46a7ac5b259", "comment": "Malware payload (Mirai)", "value": "4a38b31b4ab29b7e5da48d77ddec5aae6f8795ca2455fbdf2d1659120b0404cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463674, "uuid": "6f004d9d-8cb5-4f20-845a-04d83da84436", "comment": "Malware payload (Mirai)", "value": "85cf43b097a36d55a05bd3b9e40e46cfe981eabb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463674, "uuid": "f33b220d-66e8-4bc8-b1af-f45c0460a1fc", "comment": "Malware payload (Mirai)", "value": "30317e675819fbf74ada8c8a21812363b7e3ddbb6cfa62937c49472df91fd5b63eb6682456b1b1fa3e0e987fc2bed7ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463674, "uuid": "90d61ba7-aaa6-49c7-813b-cde4276f792e", "value": "T1FA32C407A7B7AF1BC4D027770193072162AA9FA56025472F7D0D1C4E6E9B3812D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463674, "uuid": "72953ebc-4d2e-4554-b79a-ac3f885efbe1", "value": "192:xvPOR1CQOV/1NxfAzVHaCD0SdbNlDqM+2mKdc0Ew+e+f:xvPbbzfaV6CISd1/c0Ewkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463674, "uuid": "8cfea2e9-183e-4108-8e4a-11638ca69dc1", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463674, "uuid": "86cd8497-5f28-47a4-8db4-211b107b24c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463674, "uuid": "f3226be1-d853-4ca2-8d71-3ef14b959e50", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60db1470-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442973, "uuid": "c842a0e8-25ae-4861-a4f3-0716d129326c", "comment": "Malware payload (Mirai)", "value": "b5f616d6a832d7b661102b66273b0b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442973, "uuid": "44249d0b-4c5e-490f-8ba2-379255dc83a8", "comment": "Malware payload (Mirai)", "value": "4a4b9d777f40c682c0480c89080b443c4c6134ab3baae12a7e60b1436dad9f0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442973, "uuid": "3d7d83b1-d007-4dcb-9ead-5caefcbabfeb", "comment": "Malware payload (Mirai)", "value": "91238c608237e2149ccceb0365baa676752cfde4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442973, "uuid": "d7610232-2154-4e39-9b77-378ea4fd0090", "comment": "Malware payload (Mirai)", "value": "b3d3e7fb80085e95a8b34f9f5f84e349e6c7f5df601dc3834965200ec6ebf95e53332ae3394a81536bc73918cfdd7e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442973, "uuid": "2f6efda1-2924-46fd-93f8-88c4a92642f1", "value": "T1FB03F152B159AC34CB717872E1594B1D5BE803DC41EF7223196AF16EB0E42EB32B92D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442973, "uuid": "6cea2eaa-bc29-4144-9a79-482f1d89689b", "value": "768:cpjSxHiUtOtWQDe8oiclLd8zrdLGV13BxtNRGQderKkQW6g39KCK9q3UEL2b:cNSwUtqDUpdE5LGV1xDNRGQQKtWH3MCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442973, "uuid": "c825fea2-559b-48a5-8e4d-21dfcb078727", "value": 38024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442973, "uuid": "bbc1e41e-77bf-4e93-853c-37866d4650f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442973, "uuid": "c1229d67-cd82-4a4f-9d14-f2df72eb269a", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a865cc84-31b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775477882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477882, "uuid": "7162af22-7b0e-4efe-aba9-0589d5eadaab", "comment": "Malware payload", "value": "df6dc87cdb7c6b533d25e61a751108dd", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477882, "uuid": "db60b626-8107-488f-8416-23742082f506", "comment": "Malware payload", "value": "4ae3fc3844bc7588e3e47adcc162b2a1a5b123b58a1d6e870d341482606407d6", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477882, "uuid": "283af2f6-9d25-4eab-ac8a-1afd421e93ef", "comment": "Malware payload", "value": "51b15e69ae64fcc9b31b6f156f4cee97732522a5", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477882, "uuid": "2e8d762e-8b89-4b5d-ac5f-6dc3d3dd332d", "comment": "Malware payload", "value": "b88f687f0369691b0fe809a596258763901d6a43de6c3347f5521fe42ffe45d181725d587ec7ba68132eb0ca2ceab49e", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477882, "uuid": "034eabd0-10d1-4974-806a-c891cb61dec5", "value": "T1E8A43B41B3319092E8D35EB057638B755EB01E082D54B72C87F17B2CE9A1F6ABE0DDA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477882, "uuid": "1f72ac00-878d-4800-a748-fd725d8d1602", "value": "928d0699bc8c6e79f702e49744fd94fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477882, "uuid": "afe1c80f-8404-4c28-8263-8361cd8a6022", "value": "6144:GdUVMrcBBo/qPtPmjnASClAJIU15LsMUGtImjC7BidE2/rShWiVkg8yEWrJgWy8y:GgmTnCdNlG6yE4WhjkaEwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775477882, "uuid": "f6308759-f4b9-4168-a720-e30b91e7f835", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775477882, "uuid": "24ed1c28-4275-4161-a820-34fcf2c6f8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477882, "uuid": "9b8c309c-0705-4fee-8ad6-a3eea1045abb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51156d75-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442946, "uuid": "ad344019-7a71-41fe-a6e5-e1215d6e25eb", "comment": "Malware payload (Mirai)", "value": "5a0449e724b50ac7b94f3d14e199f1c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442946, "uuid": "8aff4d99-8c16-4f38-b60a-809adc3b9bbd", "comment": "Malware payload (Mirai)", "value": "4b53e656c982a0e09b919895e3f69fdc63738b76c7860f24e807ec4a0f03e9ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442946, "uuid": "88895715-0ee3-4efe-b840-e69a6cb036d2", "comment": "Malware payload (Mirai)", "value": "e539d4b382f33a2188cc3f0136502d2a356c1626", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442946, "uuid": "2109f7ab-76b0-43fd-b377-adce00f3d9a1", "comment": "Malware payload (Mirai)", "value": "18a939f066b03989d68dbf46d2d0c40d8990efe1387bacf3083466e31ae2cc701c2646bce39e9cda70c135bc4d96f554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442946, "uuid": "baa8692d-1161-4125-9c8e-24a3c206c394", "value": "T1F8F202F1C122CA18D73D427D85EE2E4D2C45A8589D04E0B9EE84BD734712F5CE9B4B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442946, "uuid": "02563765-7192-4bdd-97bb-96dd485c45de", "value": "768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okf5GUuV27nbcuyD7UHQRjS:E4B1E+TcAYC9owuisCM7nouy8Hye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442946, "uuid": "a22648c7-9983-4196-bacd-94f3c1b4832e", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442946, "uuid": "d969493f-affc-4cd8-b146-1dadc2ee9dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442946, "uuid": "62353b04-df4f-4b87-bf47-7c58ce19a44d", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c55e91-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493497, "uuid": "59a4a32a-8eb3-4499-8588-ed66c27513d7", "comment": "Malware payload (GlassWorm)", "value": "0e19588d3092abc3dffc9663deb6ea1b", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493497, "uuid": "69fc2ccf-a04a-41a3-9451-267ffb70b57a", "comment": "Malware payload (GlassWorm)", "value": "4c8221b118341c55830cb3b72cff793cd633457d70473a20a1e68c8e5b65222a", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493497, "uuid": "770793b8-703f-44e5-8f5c-bf4f1b5b64de", "comment": "Malware payload (GlassWorm)", "value": "de9ba3540e14bc9f3ac5fe508ee59f8c29ac8d13", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493497, "uuid": "15a58fd7-b80e-4564-af39-386e63b3e3ed", "comment": "Malware payload (GlassWorm)", "value": "a6a85f23fd17e5a1679e706fb77f0262abc6d2d0dfde70a40e569cb80f85a8d0dcf35a69dfea9d677f9a42ce385c8a30", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493497, "uuid": "1add45e3-3fbc-4c03-a5dd-9ab08cec5cef", "value": "T146756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493497, "uuid": "f01fc49b-bcbc-47de-aad8-2b100f057feb", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493497, "uuid": "3366e614-3e8a-49e8-9aad-b8eec1b35ee5", "value": "24576:+ds9Esxlce6k91UOld2LMxmeDozCMZyFF+jEymOCUwPPplP:+daEglcAHNaYczYdyL2PPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493497, "uuid": "fecb62b9-d2ce-45f8-9618-7e4eb92cdad2", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493497, "uuid": "d2c2ac9a-abbd-41f5-898b-dfce3ecfac5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493497, "uuid": "dbf13d87-e4a5-4bb0-aa82-0fd5fad6f0a2", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d06ce1-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499644, "uuid": "ff3ec9ab-4947-41a7-8a5f-b8f8ddbf0d43", "comment": "Malware payload (Mirai)", "value": "8bfa18364a692605e5ead2aadef79e37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499644, "uuid": "98abdd2e-a1f7-4b5d-9388-23fbf4c64252", "comment": "Malware payload (Mirai)", "value": "4c87ae0d1648f4f06e8dcd843a2bd534cffbf9e32c4c8fc3b86528a721eebe12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499644, "uuid": "4953ce19-a974-4d1d-80d4-ca136659e3fe", "comment": "Malware payload (Mirai)", "value": "43b25fb6bcb20b1f5831b97911fcdc039a7f1c37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499644, "uuid": "aa5088fc-14d1-4ea7-9bbb-11a10f5c9ba7", "comment": "Malware payload (Mirai)", "value": "15a0927c6fcd8364cbc5fab3ef5237dbb8993ef552196a8144481a12482ff26d88f4ec2221b1da115815476dd9a40d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499644, "uuid": "4df7c233-4a07-4df4-8ae2-1c882c1a25b9", "value": "T1BF831886BD418B03C5D321F3BBAF4188371A5BA9D2EB7243D929AFA123474D71D3B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499644, "uuid": "04cdfbe8-ebf5-47ec-9ec3-a84bb4962194", "value": "1536:SgoB4xQcPRwfPFsfhJHJh+AcY0QFbuCYV1e2DUnI5FA7WkQGl7Nx64agMDS1oOn0:K4vnekj8zSMgU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499644, "uuid": "b001247a-1515-40eb-82a0-91338df6ca66", "value": 86348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499644, "uuid": "28640b92-1295-47de-8864-37e65b603286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499644, "uuid": "063197e6-3f5c-4ab4-a36a-e29473568a37", "value": "SecuriteInfo.com.ELF.Downloader-DN.75869817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b1e115-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775485771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485771, "uuid": "7b792f74-7d82-4275-bb89-187c2774cb32", "comment": "Malware payload (PhantomStealer)", "value": "76bba35618907f1962d1db96497aa1b4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485771, "uuid": "a3361a80-06c0-4bbe-a85d-93cee2c3499f", "comment": "Malware payload (PhantomStealer)", "value": "4d0f0fde3e1161d1b776e24739f2ddf0979e3dc6be33b1b832dd5a74d6660e93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485771, "uuid": "55d948b5-c661-452a-bb71-742c0039b5c4", "comment": "Malware payload (PhantomStealer)", "value": "9a57d7f90cb4d4916b4ec067eb4db28768da1d2e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485771, "uuid": "35542dc3-1e7c-405f-b52f-a2aaf120a56b", "comment": "Malware payload (PhantomStealer)", "value": "ae19712a764e6b23d2c3697f8f3f2abbd60d2d587a0a3e3fb555b569f6179b531d6115cbae3ba3cb6706a8fa8dfb2cf7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485771, "uuid": "e93ca7dc-86bf-4c77-bc55-17acf729cc1f", "value": "T1B353F92E8ED348E4B53B85B884123686C509A2E187707E456FF964FF879CBF64244F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485771, "uuid": "7e3d4f2d-2a1c-45d0-ad92-e37831736e37", "value": "1536:InAeQQeouvZ1ivzMDwp+pKPiaUZw4DAY6TALEX9Kq:H1d2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775485771, "uuid": "70506490-c931-4ccd-83f8-bee105c4bc31", "value": 63779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775485771, "uuid": "c08eabff-73a8-4290-89bc-e39b893e4a87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485771, "uuid": "46485f68-267d-4ef1-9424-e0e6bcbe0f5a", "value": "jobrpt_BONCDE_WCOMP_45058_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e678ec-31ef-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775504149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504149, "uuid": "40d173db-0127-4879-98b9-5fb817f040c0", "comment": "Malware payload (DCRat)", "value": "09bf35f9e7b6a184b5071e94e0af063f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504149, "uuid": "de3ea1a6-54df-429a-b91e-d10b4de4eb76", "comment": "Malware payload (DCRat)", "value": "4dc059fdbe4bd6f659150b89a649882586f462a40ee3ea0c8a957989f8d5b0be", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504149, "uuid": "5fde8db4-ee1e-4542-a9c4-06191ca179d6", "comment": "Malware payload (DCRat)", "value": "8e3719e340a5bcea7047479ff5bf552066ebd1c6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775504149, "uuid": "fbf037e2-3984-4c94-ace7-2e2ddf6eea3c", "comment": "Malware payload (DCRat)", "value": "bcf349bea01fbd1c7bb01b0ba8bdc407bd6eaf27369e2361609810931d2189c99d1b4d29384a84d7d9560733a1f77e6b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504149, "uuid": "fd2e9ed5-b8c3-4801-8db1-8a777d276dc9", "value": "T1CA556B017E44CA21F1191633C2FF850847B8A8512AE6E71B7EBA376E59513E37C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504149, "uuid": "d907ea13-d6c1-4264-9066-8d03373aec10", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504149, "uuid": "fcae1b9d-cf80-4baf-ae7d-a4537d1a558b", "value": "24576:J2G/nvxW3WI8Q+KIeFhNVl06eHIxLVvNxawMGkH23l8:JbA3hZIe90ELOGkGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775504149, "uuid": "4505f8bd-151e-46b5-83ab-cfbdbdf53774", "value": 1311900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775504149, "uuid": "e17c51c1-e6bb-435b-b53e-40a61e9b0ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775504149, "uuid": "62e6984b-3d87-4f48-902b-7129734d890f", "value": "09bf35f9e7b6a184b5071e94e0af063f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e46a595-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442995, "uuid": "9d88d5c8-8652-47b2-a082-8dc50da26f51", "comment": "Malware payload (Mirai)", "value": "42003ab2e0a71e924413f89b204c60af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442995, "uuid": "697ac161-c03c-4539-a041-e2c108c6f7d0", "comment": "Malware payload (Mirai)", "value": "4de6c0b26d482f73192091f5cc598fe40b3a36f7c90789179d32aef9157f4add", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442995, "uuid": "36091b2a-ddde-4c3a-896a-866fd1786155", "comment": "Malware payload (Mirai)", "value": "77fd994c796cdc9a43d9884ad8719e72ed826054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442995, "uuid": "a2a4d250-5b27-42d1-a316-ac20e270bdab", "comment": "Malware payload (Mirai)", "value": "05ae94f59f058700d77572395a9bc4ec7fb377d75a7a0e2fe514b4f52ab14445b1a9f6b0c7649826b85ca52db5a8e65d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442995, "uuid": "84a6c7c6-0c49-44b0-a149-f205fd7cab26", "value": "T1F9733985F987C6F2C407483042ABFB3FCB32D8A511B19B4DDF569F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442995, "uuid": "f5e79c77-4b44-4e42-b3c0-1a593acf74b4", "value": "1536:8A9Uqtm/qzBpeKm2XpQmj7qWSICRzBbkivom3aJ2ddLNn:8A9U7KBcKm2Xp3jnrCRzBbVvfddLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442995, "uuid": "233ec11e-c104-479d-b817-b226825a37a4", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442995, "uuid": "3fd42eeb-2e7f-49f6-b2a9-631f0dad80ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442995, "uuid": "6f93dfe0-5072-4a5a-8bc2-2af5a94ea63f", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5b5524-31df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775497191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497191, "uuid": "ad24ff4f-e65d-4f72-a061-8e598d1f5b59", "comment": "Malware payload", "value": "7dff41dec587c2e81fcfa6edbc5c8c13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497191, "uuid": "ae856b1d-b7ee-4088-a669-c63be45b1463", "comment": "Malware payload", "value": "4ed3e0c26bf123e3ba95e455329d34a21b9336078fc9de36f00b6fc08a8d74b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497191, "uuid": "fd467b21-d43a-459b-82f6-8a8902d609ad", "comment": "Malware payload", "value": "2d57fb56128b4d3d9e2005bdec7990bbc404c8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497191, "uuid": "26a0d659-999a-47de-92d8-71f3278985a5", "comment": "Malware payload", "value": "5c74d2546861ec5f902f8a511962e198395ba20f73b00da03c079e48fbae6b5d062164715f6ee02bb655137046c6b843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497191, "uuid": "4cd17553-4a11-4138-91aa-42781bd10c9e", "value": "T148567D43F35292EDC12AC0749355A333FA72BC89433576FB6B944A313E56FD06A28B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497191, "uuid": "420c42e8-e9ec-4b1e-8bc3-3201cae190b1", "value": "f4a8266b5e365bde48b9f99563e199fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497191, "uuid": "c8ca0dd0-aaae-4eb3-829f-9c40065072bd", "value": "49152:AVd/B9RamRH2LSFtkhOfDEgKwODpPmjp0d9n6kEqKjoZL77Uq57PBwXlOfMT8Xws:u92lEIgKdD4syecOUmarq709bby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775497191, "uuid": "c99cd61a-d71b-4d61-89f9-f42cf1aef7e6", "value": 6444032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775497191, "uuid": "489d5226-c2f2-4c89-9879-42c9aa5dc279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497191, "uuid": "9f54fa23-36eb-4c3d-8b91-19a976ac6e19", "value": "app2_v1.0.2-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee9c955-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496898, "uuid": "835eca05-7b88-4c45-bda9-ff90050c5080", "comment": "Malware payload (Mirai)", "value": "359352df10813a486ac2d2b7f4572fe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496898, "uuid": "31f57dcb-f608-42cb-b78f-8b874602eb07", "comment": "Malware payload (Mirai)", "value": "4edd73db2ffb2b536e04c7dc1995781b4961ea1ea0118ea6efe7fb904ec5dd73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496898, "uuid": "0d5853c6-ca39-46de-bccf-86424547afa8", "comment": "Malware payload (Mirai)", "value": "ae0013d851999c9a8e6cd4e98b5caaf4d90a8688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496898, "uuid": "01f29489-2a44-4814-8650-1fe8df271dd7", "comment": "Malware payload (Mirai)", "value": "9cfcb01f7c03dcc310e38df2ccfa5ebd7b6c235554c6068872e87baf17ccfc6313e6b3cc3c4b28441600c2a15e217ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496898, "uuid": "47f7d870-3457-4d48-8fd6-f3156cbc076d", "value": "T16A132BCABC819A26C5F012B76F1F9285331393B5D2DB7257CC4A4B356A5B64B0E3BB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496898, "uuid": "e37fb891-2280-4999-a089-0ed7090fa22c", "value": "768:11Eo+x19iB4z6o+Z+0+v+qeIzI+K+3+NQ7ma1V+eXok3TpoO7xQS7EU0gkCT8e6C:Yn6B4z+Av22dOmf0eXRlHh4CMsokgKum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496898, "uuid": "c653e1f4-46ba-48ea-9c23-30891a3b5605", "value": 42564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496898, "uuid": "6d7c31a8-b7a2-48ae-bdf0-f043ca22b76d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496898, "uuid": "1ed20a3e-679e-41de-9412-29ad1c1ad92d", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5321380d-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470867, "uuid": "a7555f7f-cda9-41d3-a53f-99f56afb8059", "comment": "Malware payload (Mirai)", "value": "f4e17843eec608a8f8afb4a3b1de74fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470867, "uuid": "97dcffc8-a8e9-4787-a9fa-310452fbd929", "comment": "Malware payload (Mirai)", "value": "4f1dc03cd39d5b8a6a1e774459d6047c66cdeb53acd8d49b8dbab8499ff9d127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470867, "uuid": "2df2b0a7-760a-438a-bbc1-286b8bbcb6cd", "comment": "Malware payload (Mirai)", "value": "4e7118d0f5a811386fb6ff00338921f651ca9e09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470867, "uuid": "ee106708-39c8-4b01-b13b-bb791b4729a1", "comment": "Malware payload (Mirai)", "value": "86e07e2bdba0f16f704defd2abb18baf951acde4ab608977fd7806a51651a19545358c9d6071f097bdd2631928b2fcdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470867, "uuid": "cf10c21c-cdd7-4eb5-bf86-9458fe6494b2", "value": "T128535CC8E683D5F9FC190AB12573EB368A76E23A2119DD87C7D86536DC81A02F5072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470867, "uuid": "d32d5ccf-8b84-49f0-ade3-71a5c3191d58", "value": "1536:JACtfiKg04H+zQT1Yxwx0xsOIl/Mplc3Icv5G+u680t:JACtKKg04H+0AO0xsTuplc3IaMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470867, "uuid": "5ec5d03e-4180-49d5-a08e-1e1a80a67869", "value": 66036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470867, "uuid": "66b91794-51de-4fd9-b89e-687ec1c68b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470867, "uuid": "378e98b7-d963-4852-a273-2258143eac88", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072d9ff6-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515837, "uuid": "76a3304d-ead6-45dc-b26f-3c797148a429", "comment": "Malware payload (Mirai)", "value": "efa78d342b817d41116f714543a00544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515837, "uuid": "fbe2aff4-81d2-4263-8a62-e44dd89abfa9", "comment": "Malware payload (Mirai)", "value": "4f2b7072221a2637d54e4e7d04827fe2636f67951d1914061453397a2b682414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515837, "uuid": "d59b86d4-0ee0-4386-83f1-eaa54ea335f0", "comment": "Malware payload (Mirai)", "value": "9071c5af3d84dd90a73244476be2f87fe9b32b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515837, "uuid": "80e6eb09-8d9e-406b-912e-1bebb4da8cf0", "comment": "Malware payload (Mirai)", "value": "fb3cc4b11194552113c0abb56fe27b14d1095c45035c92dedf2447dca6442ca4f73503543ad0ac60c5f4a3f2bf3a1367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515837, "uuid": "dc231c09-fec0-4c3c-9758-25b53df4b22d", "value": "T18283094AA393D5F0D84315B001E7FB395530EE720530A96BDBA4BEE39A339DA6057329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515837, "uuid": "b1dfec7d-35ca-4826-a09c-363daf264a38", "value": "1536:pXz7BiIXqCUHLw+gIYNaY42vjLHR02BQZ7VoXvjzbd5UY31c+/oveVS74nr:R3naCEMdvlBpBQZZofjzXa910r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515837, "uuid": "0cd174cf-560e-4545-8bca-04055afcaa89", "value": 85840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515837, "uuid": "95944c4f-42cb-46e5-8db3-ea89f6f859fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515837, "uuid": "aeb1fa0d-73a2-4bfa-93cb-06e78ec3314b", "value": "SecuriteInfo.com.ELF.Downloader-DN.15734351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b8c76b-3187-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1775459251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459251, "uuid": "73de9044-4941-4c43-85a9-c90b08ef4242", "comment": "Malware payload (XWorm)", "value": "77a3a62c78e1562bb22a29d9874532bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459251, "uuid": "59680f86-3a71-4046-85ab-bb01dadbae3e", "comment": "Malware payload (XWorm)", "value": "5174ee9a27dfb547aa8e7e817a7a5570836803fe6a24e58708087bab7552188b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459251, "uuid": "ff252a89-bfd5-4dab-a61b-2b335d2d2f77", "comment": "Malware payload (XWorm)", "value": "99dfd46e6c4474ad8826ac182ddf46f67891b430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459251, "uuid": "55672a5e-aebe-4747-95ad-2b5ceea8a8d5", "comment": "Malware payload (XWorm)", "value": "b37ba6a6c7d428490539ab435c2bbff248c67f6b78e010bc398458d043aeb2193e4ce7b4b7a52ae555b2e507eb665099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459251, "uuid": "3c6399e4-d125-4f8e-842f-5e9762f2809b", "value": "T1BD35F110666ADD12D4A64B7148F0D37407F4AE91E422C2175FF67EEF7E3AB822984783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459251, "uuid": "f69524d7-eb3d-4a08-89d4-205ba961ad02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459251, "uuid": "7f7a0d1b-b74a-4c17-b823-0d99a1cad372", "value": "24576:jOrSJJSHwcViNmskw1LMNgk1xRWhl0Y9r:jQqUwlNWHxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459251, "uuid": "f76d4c13-675a-402a-8e39-d30e07578f81", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459251, "uuid": "aab80b9e-faab-448b-8218-e8c77e0a9141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459251, "uuid": "3c974518-924a-4804-9795-7665bc48bfb7", "value": "Commercial Invoice and PL#ZC00170.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a984e86c-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463710, "uuid": "6273dd7c-2fcb-413e-9279-7ef56b51b96b", "comment": "Malware payload (Gafgyt)", "value": "0088710021ff0b9263cfd275d1c32a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463710, "uuid": "8c3374f5-3f9e-439f-a7d0-8dee3e4bdbf4", "comment": "Malware payload (Gafgyt)", "value": "534125ca418195fada50ad9bfa7a47a11ea8910294ae2f57daeb34ca5fe515a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463710, "uuid": "f37ecdbd-45f9-47fb-b340-ddaceed1e8d9", "comment": "Malware payload (Gafgyt)", "value": "1ab97de4604e378b89263fdaa91288b5e583ff2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463710, "uuid": "3aba454c-aa29-40bf-9b9b-c6c8bff8c824", "comment": "Malware payload (Gafgyt)", "value": "2b5c10ffb749bbb842fb647231a423c3c9d3bf862fc0e09a2d1b3d65305838c72c56078eea5e5564c5e65acdd88396f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463710, "uuid": "6398a2d5-8f08-4316-ac58-817aef3b8699", "value": "T11563E841FD454B2BC7D13BBAE7AA82CE73316D587BD7330156293AB027F57982A38124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463710, "uuid": "74503b28-3c34-4144-b492-4d7df8f3c5e9", "value": "1536:DXp2qq6zkee/0SvEZRdc1TAq+rACm5RsQ4/HCSbz2:hq6zkee/0SvEZRCNAq+rcoQKiSbz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463710, "uuid": "dbd03d83-bd64-4d14-bd2c-89830885d44d", "value": 67655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463710, "uuid": "932a9735-0f26-4a57-bbfc-13db3f3cce67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463710, "uuid": "08a5fdc1-2086-47e3-b4fb-8a308baaf2f6", "value": "cali.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5622b15-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440967, "uuid": "e1bd319c-7ce2-497c-9089-ab3ed6953709", "comment": "Malware payload (Phorpiex)", "value": "1a1f47e1f32e8cc048d75aaada3e9c4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440967, "uuid": "2666f7bc-924c-4c7c-983b-e788d42c6047", "comment": "Malware payload (Phorpiex)", "value": "54116d0ee4028ab6c8d5fb2e2bc99c0c563ec68ab03519d07394e21cf11c7275", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440967, "uuid": "b507b8fc-7060-495a-abd4-90b5ab7b4986", "comment": "Malware payload (Phorpiex)", "value": "f8d65dbb1490501cb7d1888abc6e95738b6804b3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440967, "uuid": "b1f35b70-80f3-4889-83d2-576802846232", "comment": "Malware payload (Phorpiex)", "value": "b7b2f8fbe32ba7f08abcac0c442b268ef8002514bd63759a93af6a55214bf02c4633a7a24aee4be610c0ec986aeea47c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440967, "uuid": "0583d325-c141-45d4-a3fa-0864d5530d21", "value": "T159823A0FB9424216D0D100B4A672867BC9B9A87637C864EBF7D44AED1A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440967, "uuid": "7eaa09ee-f3bd-47c0-92b0-6174d541474a", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440967, "uuid": "acd2f412-ef57-49aa-8435-4d0a8f37b609", "value": "384:CI78VGwSRFqwDlsx0xu9NHRgdav8U9ci:3X9sx0U9Ea0Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440967, "uuid": "67421b4a-bcbf-4431-9be4-70ce2008bcdf", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440967, "uuid": "4864270b-0329-4e5c-a1d8-6b3a2bc41d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440967, "uuid": "bac5132e-adf5-401f-b69f-2c321f9b60d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650ddcfb-3188-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775459730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459730, "uuid": "b68efa24-fe72-47e4-9934-768ee60ef428", "comment": "Malware payload", "value": "17d07a0be985ce25d2698258e067021f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459730, "uuid": "1803d723-3142-4d5b-84ca-514eadae848e", "comment": "Malware payload", "value": "568d04d5476593d58e023be6027037ee7523425a0cc1186f84476e7c9fea3761", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459730, "uuid": "8f14a49c-a7de-484a-a19f-3551d58ac7b0", "comment": "Malware payload", "value": "14aa21eacc934e5915ada3ff43d108481b93e8ae", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459730, "uuid": "d3cc33f0-4a3b-4264-85ef-d52e41ecbc02", "comment": "Malware payload", "value": "4d95dc01b40247f8a5b83223a47c5fe1e87277b8d51cf0e99d78f33d6361eb1297e7a6ad447a3325c652026e543c9472", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459730, "uuid": "1cb6a3b8-656d-4761-ba28-91630cdef197", "value": "T1C8978C0773E50199E177D1388AAB9103EBB2B8161734D7DB32AC03652F67AE09D7BB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459730, "uuid": "b8767b1e-e378-4b5c-838d-12746e36ecc6", "value": "174435db180feb9caa3b336186ee6a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459730, "uuid": "e5069ac9-1492-427f-a58a-9a91338da3a7", "value": "393216:/zBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMs:/aW1JhQlR7T9KxagPV11m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459730, "uuid": "858a51b3-b217-4c74-92e2-72eec8028c8a", "value": 42790400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459730, "uuid": "20939328-4b3f-425f-a9cd-e6df630066b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459730, "uuid": "59e85326-e0e5-4c25-920e-69cee52a0f79", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba7084f-31b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775478746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478746, "uuid": "37bcfbc0-868e-4907-ad3e-87465fbd7e33", "comment": "Malware payload", "value": "b2cf5630f9089622340776438eb50e63", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478746, "uuid": "0d7f33a9-96b2-407b-8855-37dde3a9d782", "comment": "Malware payload", "value": "574352d0ad1c987594be210faff07d09f032d34ef418a5c5d618ee7862683b3f", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478746, "uuid": "a38e5090-3f8d-4203-be48-60edc3304145", "comment": "Malware payload", "value": "2ea00f59755ce98686e9ac9a86add38d51e51249", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478746, "uuid": "0fabea7c-7f50-4293-80d0-1e0442e87c60", "comment": "Malware payload", "value": "4bb2955b4d8219fe7ca9c42c9417bc6cb4ad7b4674f6a1fd2f97c4ef0912dedbc19bc18f7a663395e0b4af9292f7d96a", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478746, "uuid": "c987654a-9ac8-44c7-b661-c7cf56e768e9", "value": "T123F4331DD34F86B6E4D0C149ADEC0A4712B3ACC88477BD198DB66F7F375BA172528A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478746, "uuid": "7d6216ee-c4c7-40e6-a148-7a564fcc8df5", "value": "12288:Mg9nOzJAFni8PhtHR9Pj+vLCMN8qvTPyK2F6uLDBLcyCgC7BTOgWk:MunWOh1fqtN8ATx2LvBofBOJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775478746, "uuid": "fa483803-629b-4a7c-bf7c-648c68c59dcd", "value": 749410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775478746, "uuid": "3052aaee-b046-4248-a72f-043193b81007", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478746, "uuid": "62b13759-db79-49c0-8ee5-089b4184a6eb", "value": "image.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c947b4c-31ff-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775510745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510745, "uuid": "8444dbaf-f75f-438c-ad4c-0a1cff6b18d1", "comment": "Malware payload (ConnectWise)", "value": "1fdc5a6187575b28421c3b1b4d717985", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510745, "uuid": "8e31cef3-3220-4f3f-95aa-63cb664db7c5", "comment": "Malware payload (ConnectWise)", "value": "59c94d04ac85928d405591dc776feb1d9a9ed1bf11ff91166c72707be559ea16", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510745, "uuid": "032b9fc3-9816-4c15-9813-6c3f57cee5c5", "comment": "Malware payload (ConnectWise)", "value": "b8834cf9aac2fa193daddccf27d09d5e6d04a404", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510745, "uuid": "8477052b-99ee-4cfc-9d95-117dc49c1621", "comment": "Malware payload (ConnectWise)", "value": "768693d1cbb4d8dea4aed5f95d64d83a1db2feb48eabdcd6c7ba9ef338978f7b26b75f26356b58fe6effa6ee3e023bed", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510745, "uuid": "fb63458b-e645-486b-9b8d-36b16401d168", "value": "T1CDA623116BF8D278F1F12A39D876A0B1A53A7D519E23C12E2324791E2C75EC0CA63777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510745, "uuid": "4259afcc-be25-43a7-9886-a2796f645059", "value": "196608:4Hxcp9ym3nltDUJVNHxcp9ym3YHxcp9ym39Hxcp9ym3KHxcp9ym3:GGplpCGpmGpvGpYGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510745, "uuid": "c992eeb3-5f20-4c14-9dec-2355bc657f92", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510745, "uuid": "50a35ce5-56c2-4a16-af8e-0b146ffc4740", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510745, "uuid": "0ccdf1c8-ccdd-43d6-88e4-e02a285e46b2", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e022d58f-3188-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775459937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459937, "uuid": "68056848-84be-4fb3-a978-100fd1e3bbad", "comment": "Malware payload (PureHVNC)", "value": "00b8901aae0163dc99632eef2d4ab289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459937, "uuid": "2d26c820-0f16-4a4e-af0c-56a2ace7c2fd", "comment": "Malware payload (PureHVNC)", "value": "5b05520489442578ca57f50941bac97e499e0fd3a5ddc1fc47f7c53e2fa84df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459937, "uuid": "f4553f15-c7ea-4195-8b0f-777f5011c80b", "comment": "Malware payload (PureHVNC)", "value": "6ef0f1cad1574488418f6e1c91bbe7907531904c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459937, "uuid": "c22ae490-12e6-482e-b81c-3f0f4a886f7e", "comment": "Malware payload (PureHVNC)", "value": "be895e18d24eb45f24071af5e79a2b5bc92e8b85c398e4d33cf323a1d0d04124ac2d2c6841b93f4673cf6504242f460f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459937, "uuid": "5fca096e-7641-4a53-8a19-809f84988df8", "value": "T1BC65124466A9EF02E8AA6BF44C71E3B403F46DE92420D3175EF5ACEF7439750A809787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459937, "uuid": "3877a30c-8c86-4fc9-a147-c08a066994b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459937, "uuid": "90e27593-e072-4cf2-9452-02e0ce5ccd58", "value": "24576:ArBHp7YP6hhV8bH7OqiYiLlqFLfriU71FQMpgVEJ9WzA9duBAZf4Jzuo7/gmt:0J46767BwLEZfD/QMupHSZauo7/gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459937, "uuid": "31366b54-ec3e-4a44-a39a-bf93346ac899", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459937, "uuid": "c4c9a30d-a1da-4839-85d7-71fd29ba69ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459937, "uuid": "4bc4b135-cba2-4c8a-ab95-2f29d58beac7", "value": "00b8901aae0163dc99632eef2d4ab289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b889a98-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442937, "uuid": "fa10e8e5-74f8-469e-9396-d12a061bab8b", "comment": "Malware payload (Mirai)", "value": "d933e55218cb80cf9f380ac97e820c0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442937, "uuid": "4360b673-4cb6-4401-b4ef-41c2c1609c24", "comment": "Malware payload (Mirai)", "value": "5b45de880a1af6576a725c54e9c28d803bf2d888ebc2e93ca3ba36be027555b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442937, "uuid": "52bcb648-2eb7-4306-8579-607451137f87", "comment": "Malware payload (Mirai)", "value": "a50dfff243b3c7251d6f8af0cc4fed6f76c8d804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442937, "uuid": "f894a25a-a7f6-4e99-b8a8-fdf26d847dbf", "comment": "Malware payload (Mirai)", "value": "ee7f0e65f46d0fabe0b6c29c7fa0ce5a7aebd55eda9cc1c09c7ff39d44d001708424728b777b9e17a167b16db6ae3add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442937, "uuid": "cc7731a1-ca31-425a-a857-55f7c10efc6d", "value": "T1D8F2E17021628C55DE702E764E2AC35B3AD5C7F4E7D4F2A2341082ADE50F4EA66F819F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442937, "uuid": "2e16ba6c-8fc1-40a5-92a5-975b3f59c396", "value": "768:RkbNfB2uZnay/HqGvHM2rEjQpzSwJaYVqh9kzbynboWp9bs3UozU:Rkbf2/OHLM2Qj2zjEh1oo9GzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442937, "uuid": "b77ad448-7a61-4ccf-ab69-6a0bea0d9d0f", "value": 35536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442937, "uuid": "a22cd345-199f-4e74-8bfe-2a1d53b1f359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442937, "uuid": "4a6746d7-220d-457f-8120-e43de64e06d5", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbb179e-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775486051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486051, "uuid": "94f5e0d5-2264-4749-b8a1-7c3eac8a5ca4", "comment": "Malware payload (ConnectWise)", "value": "d1cec04c549911555079bb0d6f17bde8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486051, "uuid": "b7173826-f676-4a55-8d6f-1f5ed9f2838d", "comment": "Malware payload (ConnectWise)", "value": "5bbb1e4d714fac5f326d55fff88e1267f537121d64cb4ba488bb3f7a7215021a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486051, "uuid": "afd3f111-7433-4ef6-a1cf-9522a60e805e", "comment": "Malware payload (ConnectWise)", "value": "8a7a69108ef9a3f7b69ce2ea2c6bddbec5c17b87", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486051, "uuid": "faa11a1b-37a0-48a2-8483-69d26d42e3ec", "comment": "Malware payload (ConnectWise)", "value": "ed776fd119676f073b06b2497c3a853faa6bb3908dd5205f2f064bd08522323456a5e6e4b759babbf98833c247973144", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486051, "uuid": "0b9a634d-d77f-469c-9d07-3b79ac82a48e", "value": "T10A628315BEA4B8CA17434BFB672B31D8FDDE2CEB35458846F68CBC48EA58121D885533", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486051, "uuid": "ab9b1a01-5ace-4c9d-bd2a-8687f803b76d", "value": "384:Xv3h0Rzu0/HHMiR9oWKAib9b0vQqyTKC7mjc4CwF8UozVk0e0:X/h0Rzu0/HHMiR9oWKAib9wvQqyTKom2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775486051, "uuid": "015510c2-b4fb-4d40-9c07-4f08dcf1735c", "value": 15875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775486051, "uuid": "cb40bd60-6b0c-41b7-9f09-ee9f7de1fa6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486051, "uuid": "1cf8e67d-2b98-403d-af39-d681118ad14d", "value": "Payment-WIRE_COPIER.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b455e7-318f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775462815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462815, "uuid": "0272afe2-3808-4a8a-b420-e79a76365bb8", "comment": "Malware payload (Mirai)", "value": "f2d5837da4ebe93a67ec5b0a8a8507c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462815, "uuid": "dec6d5f2-2c33-477c-ae1e-0d3335218f72", "comment": "Malware payload (Mirai)", "value": "5c8b5af28a09f79f4d8c4050b4462624ff6cf35effd57e553e74c6c85531264a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462815, "uuid": "211e2ed1-c7e4-49f1-89ec-0b3e49eef997", "comment": "Malware payload (Mirai)", "value": "5a9654f08635cd14621d5bc9ed3df850cfd5335f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462815, "uuid": "0bac1e0e-7b04-4189-9471-0c45b16d71d4", "comment": "Malware payload (Mirai)", "value": "284c00c56477854470a12934f8405942ddc9b54ac4c83c9a357d00b7b467ace7066e4accf741656be5b3d697b77b46f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462815, "uuid": "fe7b7ac1-c294-4104-a332-c8646e9bb665", "value": "T19E31238AA070D0418589DE00B5F789D47326F6B071B6E632ECD10FF694ABE64701DA7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462815, "uuid": "c8e91b90-50b1-4157-81d5-71a822f42d88", "value": "24:fDdR1iyBM/huB1b5J2wW6f8o7ygKbJ54rHJ:b1ILo7yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775462815, "uuid": "3e9e8d8b-7231-4739-ba3f-b55d8a8ff945", "value": 1862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775462815, "uuid": "79034f14-f5b7-4663-adbb-247b8d80358f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462815, "uuid": "a67b800e-278c-4e21-b623-6c2e38e134bb", "value": "minecraft.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cde2507-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502317, "uuid": "1e8e3d7d-97d0-421b-a0b9-ee092bf9857b", "comment": "Malware payload", "value": "2d34cc1271bcc81c1432fd70c1a18a9b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502317, "uuid": "09628992-a010-440b-93bb-9f420a9d9ca2", "comment": "Malware payload", "value": "5c9b14486dd65ea4113c77d0f9b1661b4e136e8d63b23ca6d9bbb27cb6723e05", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502317, "uuid": "f4aa7604-b0b4-4d87-b65c-c4e6c0ed52ce", "comment": "Malware payload", "value": "222fd83a0a26109dec4cc5567f075d4d4871dbe5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502317, "uuid": "0f0dab34-c108-4cb6-b77f-0f37dc49227e", "comment": "Malware payload", "value": "6aa5027b7799cbf5052b3bc464adda0b20b2a637f2c0115c5b0d3b080442efad121f37d31587adf3532f87042c2a255f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502317, "uuid": "562ce918-41a3-4b0f-9017-472035992795", "value": "T120B6BF227602D0B3D4E92071613CB7399D35DC1CAB2A80C37694BDDC6BB29D31AB7A5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502317, "uuid": "2366b1d1-15d5-44f3-85cf-365eaf4d937e", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502317, "uuid": "71a3258e-1f6a-4c9f-8dcb-b3ef732d3e51", "value": "196608:v/RC9A7YH0OxTtQaN20XN3kLRt7cDWN/VIiAMI3BRhMX:v/E+YH0OxTtQaN20XN3kLRt7cDWhVxAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502317, "uuid": "c3933ec1-c4f4-4ef7-a2d8-d94a64cc6555", "value": 10788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502317, "uuid": "2009035f-3bb1-40e5-8304-64a40d30fb88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502317, "uuid": "bc771e02-57f5-4c05-ba00-56f158352e76", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cac84f-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515833, "uuid": "1d8d2ab6-73c8-4130-a7c5-d2772df78a65", "comment": "Malware payload (Mirai)", "value": "181a9407b8f7ffe3db55468784dbaab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515833, "uuid": "6de8bd63-da09-4530-9e00-843d9c5eeb4a", "comment": "Malware payload (Mirai)", "value": "5d3939093d84f47997a0f4128573eb432bb1f4f6b32ad9bd2749068e5abda812", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515833, "uuid": "581c9e79-78ee-4215-a5ad-d80fa1cb3b36", "comment": "Malware payload (Mirai)", "value": "e515885451723628e8580296d34fe6183b599cbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515833, "uuid": "b6abd5e2-396b-4a8b-ac96-6e1e5ec5465e", "comment": "Malware payload (Mirai)", "value": "19d4240ab669a8f54286e0072b4677fdab3c0900a3db340749590d5f01a81d3893d8662a377c56d9502f7d70146ab89a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515833, "uuid": "7d8dac9e-e8f7-415f-ae6b-10c52b9704fe", "value": "T17C932A46BD41CB02C4C211B6FA6E554D33136BF8D3EF7212DD24AFA4278A4E70A7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515833, "uuid": "41a59d0e-031c-4b6b-962b-d4b8c16ee4c4", "value": "1536:aenv2zHjHYuTRISJlIpFYITNt9KFx2qi79uGsI7O6eiBlZxg1JoO1VUAJSWCsa7L:y9TWhDzKkJsaTJUIpB0ExKzAUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515833, "uuid": "e2f0f1b8-35a6-404e-b567-0b570b543479", "value": 95812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515833, "uuid": "0b1f4b91-e653-47a4-bed7-8be31445fb4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515833, "uuid": "c68d0388-d6ea-4e39-a938-4952a541a6c5", "value": "SecuriteInfo.com.ELF.Downloader-DN.85356391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69295c61-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "095556f2-6c6b-4312-a9f5-aadb4d2e6ace", "comment": "Malware payload (Mirai)", "value": "bd033ac4b58eef6e61413c35bcdf837f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "774da54d-5173-4fa5-ae05-5896c8036a1d", "comment": "Malware payload (Mirai)", "value": "5d4ac5e3230c47de9d496df95644b1b003a3d42597998ed740bdebe6abade7bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "7472e02d-8acd-4dac-a0cb-b4a628994daf", "comment": "Malware payload (Mirai)", "value": "b58913841a9c8f50bfcca197acba4250d41573b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "13d2c84f-36f6-40de-802e-6cf8ae196729", "comment": "Malware payload (Mirai)", "value": "2ea53a79cfa4dc4e6ea5608d636dc2aa1ea9bff29d55ffbea27cae6f466444b7dce7fa8344581983d940043fa99b8ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "c1d89651-1527-4fb7-834f-d1d54394b3a5", "value": "T11B733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "5817d344-d6d7-4574-ac5b-8a12d15d8785", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNA:OZWLnJpcO72RDRZNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442987, "uuid": "1094c83e-ea12-4ce8-93bb-5a24a4c0155c", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442987, "uuid": "fc4bac4f-e91d-41ef-98db-02d3f3aa0be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "e4e19c44-b115-4c3a-93a5-8f773857edcf", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bb7bc6-31dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1775495698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495698, "uuid": "73b1fc79-0544-461d-bc90-85bb1da2d31e", "comment": "Malware payload (Socks5Systemz)", "value": "4ff44db6b71ab9a6290bf0c6b9fa2786", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495698, "uuid": "155dfeee-37ab-447b-8b0e-3166e2da7be7", "comment": "Malware payload (Socks5Systemz)", "value": "5ebff6fad9b948a80ce887525be57000f54f176b6aff7478105e5e91051552c8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495698, "uuid": "624890ac-0315-4621-bc9c-47a74ff57953", "comment": "Malware payload (Socks5Systemz)", "value": "1fd112300ea11ffaf326320457b7b1be4178de95", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495698, "uuid": "4d84b956-1025-4859-aff0-10c329a36a12", "comment": "Malware payload (Socks5Systemz)", "value": "2120cc1e894444a123ec7d835d273717f7fd27a2e0085f4e01497483698512dfa18670e513da442dae7570957250a5f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495698, "uuid": "45f68a89-528d-4213-83d3-99177a0ac08a", "value": "T1A116331687E48933E4178F325895B8B60A056C362C79D406339C4BBD4E3B77DFA4B9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495698, "uuid": "183fe80b-3f61-488e-a16e-3f1d448c1585", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495698, "uuid": "1f29d146-8b05-4e80-9dee-f36eb8c475ef", "value": "98304:NPpPEOkiXvGQF/S5BtGIb/63R3HpjSnn7GheAE:rcObF9mOIe3RXwn7GhrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775495698, "uuid": "27bf5d93-f61a-49bf-aad0-47f72dfa70a2", "value": 4097711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775495698, "uuid": "f0c62710-b9cb-44db-a45b-0edd8e7ac0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495698, "uuid": "09d74b5c-1810-4cd7-bf3c-0ba2f21cbb32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea88dfd6-31de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775496891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496891, "uuid": "e8d85407-afc9-4f54-9493-afa4ac560d01", "comment": "Malware payload", "value": "5f24b217083129e0f9d33ef10eb5aa10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496891, "uuid": "eab91b1c-6e80-4f85-a978-07e937765397", "comment": "Malware payload", "value": "5f7d0b20a66939f20fb8443851810f80435373f0612b74be48998a30abaf3e94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496891, "uuid": "bac3d4ea-e6bc-465b-bf3b-536cd27e4e00", "comment": "Malware payload", "value": "bd001bae5173314a61a84959c4c7cff079410979", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496891, "uuid": "cebbf385-5f2c-4009-b686-1ce526f49753", "comment": "Malware payload", "value": "69ebda57be458017434d5c4ec9377c299862103e27da9b45b41a1c6aaab896c37b931c16e42e590d4b26f1adb7d1ac3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496891, "uuid": "755c9219-fea1-487c-a523-179855474e10", "value": "T13FF2732A7691CB39E085F2345EEB82B0A1B074F0AB32620FB791527739617D85739F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496891, "uuid": "30887776-124b-43c9-ba44-eeeb7ba03f81", "value": "384:GrY6n8DqabwxNUjIgmi1IDkt4UVRoT4xQuUx/hGJ7/qWSrAEGHT/8rKwt6Mne:GrSNC+sc6L2QM/8ftlne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496891, "uuid": "8c41ddfd-145a-4eec-a969-ef7a26bd0e33", "value": 34992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496891, "uuid": "cbb7bfd9-9c03-47eb-b1cf-858af81c32e1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496891, "uuid": "634a050f-6925-463d-b9d3-c98626244b74", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b00a40-31a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775472217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472217, "uuid": "cd3e0c62-ce80-40b9-9923-3d069a48681d", "comment": "Malware payload (Mirai)", "value": "dc7815a1338a8643665514638bf38c9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472217, "uuid": "abdee296-927c-4cea-816e-7725a9718976", "comment": "Malware payload (Mirai)", "value": "5fe862862d9c7e5ebd5764531a0337b459a60e745990f66712d69cecf3bc4c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472217, "uuid": "7cabcbed-34d5-4e83-be49-701a3f1c0624", "comment": "Malware payload (Mirai)", "value": "a9489bcbf4788e446cba795a563b69cd006effb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472217, "uuid": "42d07224-297c-40f9-9ee1-3a9a7832f9fd", "comment": "Malware payload (Mirai)", "value": "10459e513dcf9fac82d6a28bbaca0fc28ea8fc44386ba12cb48062e6f38f07c1ce5d915f281d5d1dffbe2b09a009d7ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472217, "uuid": "a51d3ea8-c88b-419c-95a2-9796bbd9fd07", "value": "T18EF32A46FB418E03C4D61775BA9F42493322A755E3DB73068D18BFB43F8AA9E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472217, "uuid": "bcf5e2ee-6f5e-46aa-99c3-846e73865560", "value": "3072:HZMFFkdzVC+myqnRRexHURlQKwxvVZFmT5NmM/9NuOFfmZwLYWPv:HGFFkTC+WRexHURGKw9QT5IM/9NuAmZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472217, "uuid": "cfacbafc-ed60-46af-9eec-86bfa266940a", "value": 157648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472217, "uuid": "f14da05d-5f57-4f01-b04b-eaba91518830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472217, "uuid": "d343034c-1dc9-42a8-9278-a5177385c756", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e75f3c4-31ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1775501675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501675, "uuid": "b641d124-5d1b-49d8-b8d4-4c26637bc2d9", "comment": "Malware payload (Efimer)", "value": "7c70b2f83616b054670dad3d3ba5079a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501675, "uuid": "d6ff58a1-dad0-4e20-a5a8-5234e74b09de", "comment": "Malware payload (Efimer)", "value": "60a3fcdd47bb397b82000ca72301564b2c9ae7208d1502f75020f93ef6042a23", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501675, "uuid": "3c6d5ba2-f02e-4492-b023-b8f23b6d6a2a", "comment": "Malware payload (Efimer)", "value": "fa3d10a10d7c5aecdb615a587a20f5d29be2b9d4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501675, "uuid": "134279ee-5cf5-432d-94fe-b2be3a53053e", "comment": "Malware payload (Efimer)", "value": "9f0dca62c434fdaaf900d9c608a1417dd4472784a0316e25696c5e2f2569af0ba2afd87fe3aa9524b83ad68426fd26f0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501675, "uuid": "8676e3da-46f7-4282-b430-957f797ad4a4", "value": "T19CD6331CA4D151EECBB390BC77F012B0B4B5B4785BB28D7B5AD4CAB15CAF154882D0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501675, "uuid": "8afae992-b65c-4720-9575-15896fc9444e", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501675, "uuid": "39ba74cb-0e58-4007-9fad-8fdd29dc72fd", "value": "393216:Qlgv9pe9dTi4RDN0XMCHWUjXacuI3/PGTAI:QKCdTiKZ0XMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501675, "uuid": "4fd82fe7-2dd8-4ecb-96b5-2625fa9f478a", "value": 12629593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501675, "uuid": "bcc6b3b8-cd8f-43bc-9616-4c8704d4ff11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501675, "uuid": "6c5ff636-86a2-4f7e-adbc-39e4cc5fb7ea", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312b091a-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470380, "uuid": "0003fd8a-f5c8-489f-b1bc-d31d43d89761", "comment": "Malware payload (Mirai)", "value": "5ae1b4dc381707f53f81881703b155bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470380, "uuid": "a30553de-40d1-4a10-b7c5-550dc98e0381", "comment": "Malware payload (Mirai)", "value": "60d1fa2e7c615f5835aca9442cb530c497259eb617a900501af691e6bad39981", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470380, "uuid": "067a21fe-7a80-4326-adf0-17f4db269e29", "comment": "Malware payload (Mirai)", "value": "efd6db48c47ba36baf5ff2816e110f738cd17b01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470380, "uuid": "4df69466-a687-4b82-ae26-7749a0177676", "comment": "Malware payload (Mirai)", "value": "595ca4a1c83a16605a5d829a9788a8aa63c1cd4d86c22ba28c7a4f583d355af4a6f33598bd37b92290cc0ae011305345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470380, "uuid": "39203aee-d29c-4944-91c2-4da2ebd26e3f", "value": "T1B3C2E16360BACE13C8F283776D3C15A621645434A34DDD2D33699BC937470D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470380, "uuid": "c53b4b6f-998e-4d41-b929-35582354e362", "value": "768:+5+Kcrb9VDJee2KTgdTHOBcK5ZCAySVbnF:xlrb9veKTg9QB5Vx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470380, "uuid": "6e3acfb3-621c-4029-b296-add35756381e", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470380, "uuid": "d3c41a2c-3826-420e-ac7f-476b93856de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470380, "uuid": "92c749f3-b1fd-4c5b-8b9b-8329004cb7eb", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aea9e3-31d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775490687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490687, "uuid": "5689df39-5757-4ac2-82ba-9053292b0c8f", "comment": "Malware payload", "value": "08ed1eae7503a818106edf3502e9c2ea", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490687, "uuid": "8b4cc507-f719-431c-9da6-ab7155d31708", "comment": "Malware payload", "value": "6304c4a0a313f12380ccb91c152b429ea220ff7d3427dfe16ba86c31cb777224", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490687, "uuid": "e0b0b9e0-c178-4d95-9176-b5f23adeab4a", "comment": "Malware payload", "value": "05ee7e7680177aa1d565d31c2f753668f5dccc2a", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490687, "uuid": "20b838f7-6e30-48d5-9173-04dc4b0dc6b8", "comment": "Malware payload", "value": "46856f9f83d0f3f8fb860cfa245448e8838a994971d872d98fa51bfcf9e129ee012fa2aae7668c4f19083a48fe84563f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490687, "uuid": "b5bc70b9-baaf-4549-8670-b3e255f78cfd", "value": "T117D3F388AD9E84654B9F6428051F5C17AFCDE113072ED8907ADEDF953F26BE130B98E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490687, "uuid": "2d03fd3f-c103-4447-b131-889c310b7ce6", "value": "768:BgquUpDBIbhWp/L8E7n1m38XkZgpd1VKb9HbU8vV6c6L6P606Ed+mPNO13L6vfxG:wUpgQcks+8oXVLK+ualj9vkvMVUFGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775490687, "uuid": "87e2b658-f99a-43ce-96f8-d7f59dfb01cd", "value": 140975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775490687, "uuid": "e39283e0-1b93-416d-9102-25a5d1f0171a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490687, "uuid": "091acffe-995c-4c4b-8b42-612051e4535b", "value": "Nova_Backup_Winter_15.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2eb87df-31ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775474947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474947, "uuid": "d138c149-5087-4fe9-859c-29dbc1964356", "comment": "Malware payload", "value": "03b406a4944423679b5a27a03c7b881c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474947, "uuid": "4318da92-7310-44b1-bd33-c1646af619ce", "comment": "Malware payload", "value": "6321164175fec40b89af43d0c3d3cfaf7be12ee07fcdf35bc514c707815436ae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474947, "uuid": "9f2cdc73-b86d-40b1-85db-6379f7c93e16", "comment": "Malware payload", "value": "51764f0804a3d3f9c2af7536d79f45e7a102d8cb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474947, "uuid": "4d889aed-9615-42cc-9132-5841d531d422", "comment": "Malware payload", "value": "80bf0094f9134cc28797eec049c21256465c26f27940276d899aa76e5a33a5b6a2cb98486a1698c68767fc47794d131b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474947, "uuid": "40444a97-03ae-4ecd-b796-b621bd4954a1", "value": "T1BA373324E7B811BBF5E7B2B69B55CD22D768BD943310D3CF1B84A2D90E1B0D00A5EA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474947, "uuid": "759a44dd-4184-4247-9c8e-28e2a2854923", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474947, "uuid": "455c88bf-a627-48d8-bfe9-20de539d231d", "value": "393216:QbtzNqQgXFk1Tz7HuPXBbMMTjv8/SGp37JsaNdKK9tkZkfIp8QMTjv8/ShemsIgX:QJYtFkJudobn7iy6CIpF4ZsI1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775474947, "uuid": "1ac02189-f56b-4841-846d-8524943ba88a", "value": 23788916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775474947, "uuid": "2e992ea2-4f48-4e87-8269-f685c66bafc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474947, "uuid": "07705641-177c-4bf7-95c2-58a953cfd601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073b97ff-3203-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775512401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512401, "uuid": "899e1910-9695-44f1-8f65-7fdd7f5ee837", "comment": "Malware payload (Mirai)", "value": "ea94171491afbf7042a33aa51f91c64e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512401, "uuid": "061ee846-ad8b-4373-af24-9c4cac26a178", "comment": "Malware payload (Mirai)", "value": "641af7e986abd51c8edf352ceb45cbca3e23eb19fb4e7e6ee87dffe9288e3cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512401, "uuid": "d5432783-a619-4264-b11b-30b3c7dc2ff7", "comment": "Malware payload (Mirai)", "value": "b9446789456711c3db5fc2e2f3d5994c3e23b4a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512401, "uuid": "6108160c-9811-4000-b052-06f3c49de329", "comment": "Malware payload (Mirai)", "value": "be4c9991effe940dc3f2ea50680e518b5f03693c3909f671feea2ca4b15d210a80957c31b757e1641efa78a8b173f485", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512401, "uuid": "cf3a0bf8-877b-4276-bb1f-61659d4c2a88", "value": "T10FE4E51A6E729F3CF37487314BB34B24D66D62DB13F1D585E2ACD1051E2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512401, "uuid": "2a648f6c-6bdf-46ef-ab6e-efb8134c0422", "value": "12288:xc+Z1YL77yKbMfNxoK6hmC0kuQXlAaBnv9X:xc+Z1ubMfToRhmC4RonN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512401, "uuid": "d9fac898-e8ef-471f-a5c7-112e2a2e02ec", "value": 704952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512401, "uuid": "91e4b60c-32f0-4eda-ab00-ef2d56d6881c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512401, "uuid": "42f065e2-a671-4b7a-bbcd-08f3850f8448", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2aacfd-31a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473701, "uuid": "626a0f39-bd84-4c13-aae6-b3704d2c6b4f", "comment": "Malware payload (Mirai)", "value": "07edcabdb6729e42a8e98189788ff122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473701, "uuid": "cae45a52-285a-4cf1-b090-eae98b59d897", "comment": "Malware payload (Mirai)", "value": "64a1e15aac8d795285e01b74b73f7e25c79041efb8159c029ea93fcdccc8456b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473701, "uuid": "34a8134f-52cb-409c-8225-72c1d56cf89c", "comment": "Malware payload (Mirai)", "value": "0d1475c88f7906f3492dfcf7109469bf27e0c812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473701, "uuid": "94afdec6-b220-42c7-ae89-c326b6ac869a", "comment": "Malware payload (Mirai)", "value": "a7c1457a69399e6173f90d75f0b8607bce95a8b4ab06506cf91e69d3bef55eb64c893d64660651ef7bf0da0339999c81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473701, "uuid": "e82c2462-c4c3-43b2-bccf-0e8f16aa724a", "value": "T1C8A3520D7E328F7CFAAD863493B74F259248379532D2C589D2ACE6112D6010E746FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473701, "uuid": "49e31eab-2610-4dfe-b0ac-a561377783c2", "value": "1536:jJQxUAaXuMn3v2NDaTmiI2B73KiwwWfz94Q1OKZeDrBXZSClwG7qg8naFvBX3TZU:CxUAarKiqfz6QoZSClwG7pqaFvBHTFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473701, "uuid": "118d31c0-e2d3-4693-b9d3-6249c505f43e", "value": 99060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473701, "uuid": "ccbb9f06-3c82-49e8-9835-ce0b0b3bef97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473701, "uuid": "e781d196-7741-4eb9-ba77-65edfc6cade4", "value": "mao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e5b7e3-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470409, "uuid": "fab288af-f19f-4af4-ba94-b213f4389529", "comment": "Malware payload (Mirai)", "value": "0c1e9bcec41564dfc0aa7ba4d557f0b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470409, "uuid": "9dc0f570-9037-488e-870c-f241f863802e", "comment": "Malware payload (Mirai)", "value": "64eb91dfa8da442d24b8f9a4bd0c60b454e174832d28397e88fb5d31417f8f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470409, "uuid": "7b121150-3cd6-48b9-a6b2-8b892f44a67b", "comment": "Malware payload (Mirai)", "value": "d9de0aa45b5d8138f1ff44ab58381c90979b71b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470409, "uuid": "5ebf9dc0-00a6-427d-b95a-046987d49a3e", "comment": "Malware payload (Mirai)", "value": "d7c00012b11facf8c2d73859029f91195bb2e7844649550890542709888e7f3ebdeeba7704fd6682bae0ef16062fb024", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470409, "uuid": "6073b252-8f47-47b1-a943-ed4a015be166", "value": "T1C3630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470409, "uuid": "956d9824-ce0e-4bd7-94c3-aa5c785f6b62", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470409, "uuid": "93ff06a3-1200-4a5b-bf33-5f8958f0635b", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470409, "uuid": "d850c49c-fc02-490c-845a-9d8bd26ac4f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470409, "uuid": "c683066d-cb9e-4591-91ef-8f06db7ea239", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a6f4a8-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463722, "uuid": "4c978a4f-7307-48b9-ba32-89d84b01cc20", "comment": "Malware payload (Mirai)", "value": "fd6ca4ece7e68288fbf5e2ca0d0e655c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463722, "uuid": "8face259-8c80-4523-8bb4-acd440220e91", "comment": "Malware payload (Mirai)", "value": "65b52e19817531f74d71d5350d13149553cbcd04e48138ae48aa8827ad556e68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463722, "uuid": "dad9cbe7-ea8a-4518-ba2f-eb52d6769693", "comment": "Malware payload (Mirai)", "value": "6e359783faaea2d0bbfefcfdcc742edd8ee5e216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463722, "uuid": "be2358c7-5003-4c1d-916a-acd15432f535", "comment": "Malware payload (Mirai)", "value": "1bd28c51de819febcb10af612f0c7e893a49f70eb34688cf32240f54359948e845542b3a87c9edfbb89938786469a271", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463722, "uuid": "ec68a751-c19d-4506-b539-c09432bcd8b9", "value": "T15CA328A3CC766F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463722, "uuid": "103a7205-d6b1-4833-8e32-19044593b0e6", "value": "1536:7HufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAa:SbU2RC4kPCtSzWu3/3L1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463722, "uuid": "2fc2a13b-8ced-40fb-a513-fc3ffa2953a2", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463722, "uuid": "9d135db6-6ca4-4264-a80d-e6b179fb7c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463722, "uuid": "e64a6d3b-d537-4fbb-a9a4-6ecf9802f317", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e72ef2-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470877, "uuid": "48e3525e-af1d-4834-a43e-ee9e95bd338e", "comment": "Malware payload (Mirai)", "value": "da80980c4bbdad7a3a1b78571a3987fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470877, "uuid": "563a9515-d8f1-44de-a00e-d0bc055115bb", "comment": "Malware payload (Mirai)", "value": "65ef4a2f0e6130088efa84c38993e6127a4373972561fe3eae65ad2962a77471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470877, "uuid": "671e0f0d-5933-400f-9d8f-e27df35ba2f3", "comment": "Malware payload (Mirai)", "value": "8bd7a798890545e554806925da3173b2a9894e80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470877, "uuid": "dcb02e02-aa01-42d9-acf0-f02c2bd20066", "comment": "Malware payload (Mirai)", "value": "2df3ce2b3b2a19da6c74daeeaecf3810ae090ce2b45d17ca3814582ef7056dccbc4abdb2cbe83afd9a86ba1182b6cdd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470877, "uuid": "6cff0e9c-660d-4f75-8a6f-1cadb694bf4f", "value": "T162634B01779C4A03C16659B4283F17D483FBED9122F8B6892D0F9B4A82B4E772559FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470877, "uuid": "bea6adec-f193-4f49-9afd-9a6adea8c53d", "value": "1536:mBV7Ohb+oLb0H7CK21g8JIQfQjnqzY+5Mjdaca95P+0ZA6WbFTV8:gV7Ohb+oLbmmKtQ4nVAT95WdF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470877, "uuid": "b8c27989-d709-4521-afc3-e76177ad36aa", "value": 71276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470877, "uuid": "1e65a682-6fc8-4af6-a5a8-e914f593bda2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470877, "uuid": "a238dfb6-191e-42a2-bfad-c130f55e8d8c", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34d9e4-3181-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775456603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775456603, "uuid": "2cd40653-59d4-4e8a-916f-8bb6337c1157", "comment": "Malware payload", "value": "2bb2b82efcd488a70a864bc505419ae1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775456603, "uuid": "c5c68b08-7683-4dc2-a721-42167c5c6647", "comment": "Malware payload", "value": "67a6f9ff075baa4f589d626e430ba052ffd2c736a62d4de9492f646c3d0f4625", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775456603, "uuid": "3158880b-f599-4d04-ad41-16ea51020c06", "comment": "Malware payload", "value": "f906aa96a0169d93a2396add3fbdf064bb556be0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775456603, "uuid": "14303862-127d-4765-abf9-06bce9d6af57", "comment": "Malware payload", "value": "7cb4414506bfaa3a6b4c508bfa566b5b8b15c6c00c645c037656eb7d0a1d0fb4607d5a3787a34229ede79c49cd5906e8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775456603, "uuid": "dabafc84-b082-4a29-a71a-a3f33e68549e", "value": "T183F0A74FB44BF03AD04419E8AB65FB6AAC70786B6263CE5C78417A50FFD65347862640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775456603, "uuid": "4ab0ffe2-af4b-4478-b909-9192079cc85c", "value": "6:hLgjJ5Ja/+YcLN7+Y3JMF/+Ye0IdyJ44LIXLoO4eGLw+v+YdF/vNnQz2JMIykwFy:lSjkOLZpqjW3bo/8pqF82Q/NiT+XHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775456603, "uuid": "db2381cf-9c56-4bc5-be0e-70102fba4540", "value": 508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775456603, "uuid": "9d6f9eb4-0500-48f8-8712-23b4ac318147", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775456603, "uuid": "d135cdce-518f-44a6-9a80-ccb4aed9d5db", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5731be8-318e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775462549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462549, "uuid": "9ef3c647-9cc0-4785-a758-cba37266dafe", "comment": "Malware payload", "value": "de10996d7714c52f0c8cc0ece7ecc810", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462549, "uuid": "5b00cb28-9181-4492-9647-68cc4e4a38de", "comment": "Malware payload", "value": "67f41be88bdff63e8320865979b0e0f4f6031422b40bbe2944924feb173d6945", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462549, "uuid": "c8460840-2d06-45c9-9fcd-98ba235663b5", "comment": "Malware payload", "value": "a9ec513968f31619967ab972d5a37af57f81b19f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462549, "uuid": "b1299931-0434-4173-aa05-edb5f188450a", "comment": "Malware payload", "value": "061d841f755dd26ad5f6bc14962e918c623a6cd1ac0486a271657c906fb111f589454dd104c83fba2a5e27deb3751307", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462549, "uuid": "2a223f57-e7b1-481d-827a-53023a9f44d5", "value": "T18226CF059CC2A0AFC8D99074C33BDD21A5E0B47958AA7B6DC90CA1A0EF58DD0D77DDE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462549, "uuid": "701f0e89-a1ea-4bf1-b593-7f1ee198181a", "value": "c79a9c9fb098119b25ab8aa3d7a13e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462549, "uuid": "1139149d-03e5-4758-b72d-ea9fd56b744f", "value": "49152:9U0WszTVIajD8a0JyGP0sfOSmxTcjRzlHjiyeq+YeFn0E9+m8T3xYM05qJOzRLNA:9+SD8iGoSmxYDB4OYM05qJKRRdM2n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775462549, "uuid": "fbadbc77-c160-4665-a285-f0ae7bf404d4", "value": 4575744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775462549, "uuid": "3980c025-afc9-4202-8c70-918018f8bab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462549, "uuid": "14cdef29-07cc-4cff-a88a-b90e40fc7825", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bc0773-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775486070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486070, "uuid": "eb2fd7d3-85c9-4a0a-909f-a0c61c267dd7", "comment": "Malware payload", "value": "31277700be334b9078a6b357bde37700", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486070, "uuid": "7f97e4c0-ffa1-4d83-ba99-490758587c6d", "comment": "Malware payload", "value": "68e0a98d9cda96550852f69a9548c39afa6a2ecc0e3053925399ec3ff29e6eb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486070, "uuid": "c0fc1f14-f9cb-435f-ae22-fb4928bd33de", "comment": "Malware payload", "value": "444a4ba341992bdd17c1f113772a3c42e27bbb11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486070, "uuid": "8ba4a26f-287c-4525-aa49-ecb52d7e551a", "comment": "Malware payload", "value": "b0fe5fb021dc99c898b1d6f41e575d01b0a20558310d73845ff1b7b2a4b49f2f455727d4e913eeb5c06d1c94ff1efe2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486070, "uuid": "c9fd8b36-05ca-4a64-83ca-b6e5cdbb94c9", "value": "T13A64DF11D3E12109F1F21EA4C3BA6E508477BFB24E0FD1DD06246DAC1AB6919C6B773A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486070, "uuid": "72e70124-58ba-44dd-be2c-14c63b9f6196", "value": "6144:BzH90o15PklCQJfm5xQPkLXkOkEVPIFq1ekQiTOGhxppNsM1:30o15PklnJuvQPk1kSSkTTOGRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775486070, "uuid": "15832eaa-cb24-4035-a0b7-001036d35b5a", "value": 323126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775486070, "uuid": "7cd7ec4b-6e08-453d-843f-33f121b17430", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486070, "uuid": "eca7cff5-93f0-4093-b92e-ae6fd9176087", "value": "Lz78mQQjOQ3bAOOO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4b211f-31bf-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775483549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775483549, "uuid": "c6cd8835-8800-4a72-bd81-d1d1e86f6a19", "comment": "Malware payload (CountLoader)", "value": "31793e4770d696f1eb0e2de62c7f4135", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775483549, "uuid": "514af265-c6b6-46ae-9cad-c33b8f1f0976", "comment": "Malware payload (CountLoader)", "value": "6b2e9e457b8468a60b8f84952da717ce9ec7776e20be2b3d4f2b5c4c815c749f", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775483549, "uuid": "3b406ab7-22ea-4d23-a872-3e8dbc3aeabd", "comment": "Malware payload (CountLoader)", "value": "0d740719559979b8886f2dd015c2128de4e9514a", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775483549, "uuid": "f1ea336e-0782-4117-bbff-2989d2d8f725", "comment": "Malware payload (CountLoader)", "value": "821ac37dd92a8292f8035c92d49aee6b81db960ca0f8c7619e7dd022262c857a01f7120fd39f1d8253c8641e109f55ff", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775483549, "uuid": "f413ebd4-7b01-4aec-89da-3caf4b153017", "value": "T14BD42A23ED52DE67E91D84701F5433C38AFCF693053125A999E6D22B58EDCB08E6F281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775483549, "uuid": "ac335803-c22d-4816-ae5a-0f1cfc423d3d", "value": "11bcbfd6370c1d9c6ba34d863b0f8743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775483549, "uuid": "15bc748e-6b00-450d-aa2e-33c1b0072dfc", "value": "3072:Kx+tK0SiuKonWVYqjxMGOcbbbpAqbk/UH:oKK6uWV9jxMGJAKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775483549, "uuid": "31f525a1-f01f-4b05-b9c2-34864c8e3340", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775483549, "uuid": "83678957-3732-4285-841b-3f974fa24326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775483549, "uuid": "f68d6f4a-1f1d-4765-9ec5-a8d76558f960", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655ee8f0-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "c6f9113c-c60a-4c9f-8f89-aeee127c3db3", "comment": "Malware payload (Mirai)", "value": "bbadf002e8bf635c8acaf3d8bfdef3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "b3b1b464-bbf6-472e-adfc-8f942b46367d", "comment": "Malware payload (Mirai)", "value": "6c29fdfcd213f1d7549ef7ed09e9a9b06c6442bb510f8993f6008dee8e9f251b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "3ca25c48-0131-4c67-a353-3e0e2f4f4204", "comment": "Malware payload (Mirai)", "value": "25296f88e20a3ea9b3aa9139a569cad00e623e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "97e92452-e45e-4ef9-b3ae-f4bd1eb4ad43", "comment": "Malware payload (Mirai)", "value": "3bf57e55ee964b041ec505ad214562aeb63044751acba3b18321e5b118fc4e282965c91afc486ace69f4daba22c801eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "f90f068d-3317-4957-a84d-66fdc20ea6d0", "value": "T1DC83285AF9814B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "38d66af1-8d36-4d14-9dd6-a17d4a438606", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYt/:BVE+2dmTEZCSHYMactW4Bi9gnS4V0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442980, "uuid": "c8f05ef6-673b-4d95-8c75-144b3ccc894d", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442980, "uuid": "5750ce78-5559-40c2-bf03-1354632b8558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "4e0e8b89-4848-4708-bde5-6d57047ce8ab", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fc9533-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463705, "uuid": "b9a68ef8-6bc7-4eb1-9cba-b8db77b0407f", "comment": "Malware payload (Mirai)", "value": "c60ce942bdd27408faa89c1335e98956", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463705, "uuid": "d18b35e9-2220-4ec5-93aa-9fb2230adc10", "comment": "Malware payload (Mirai)", "value": "6d12d7cd6dfa7324320518d4d97f20ba0743089b5f41a56e2cebbdc2a233ff97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463705, "uuid": "5642822f-7fd6-47c2-9481-77df50152664", "comment": "Malware payload (Mirai)", "value": "502526477575122bb3d55510b262f68ce69a2d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463705, "uuid": "738323d9-bc35-4c50-8585-f06d56a177bf", "comment": "Malware payload (Mirai)", "value": "82fe7134aac4c453044f350d4fdf055347e1fcd9aae269917faba846df7d3eec8f0414d08cbd587528858b9826032daa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463705, "uuid": "b6214341-87a3-4902-98b9-b8e59f7218f7", "value": "T1C9B33B89AEA51BEBC4AFCE30011F071715DE558F63E1B33A527CCC58389A3599AE3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463705, "uuid": "2f9af6f1-d9c5-4ba4-9511-0b2688a34ecd", "value": "1536:0k7lvVySD4d7Xz0NHnTRXkGJhSiEKUMqajPXGf2ENSKoIBOb4rk:0k7lv8SD4FsRXfSiSYjfVgkIBOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463705, "uuid": "3fdefcc4-2c8d-423c-abed-50546980813a", "value": 113092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463705, "uuid": "7ca510ea-d2bd-445b-9b6f-6c90ab7b0db4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463705, "uuid": "bf98f5ca-b7d5-4c35-942b-9a5f07ce95d2", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0e9c8f-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775499682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499682, "uuid": "d2d0c445-e868-47a5-88e8-66ab42a322aa", "comment": "Malware payload (Vidar)", "value": "d6ea62646f313236c18376e3d55f081f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499682, "uuid": "658a308b-97c0-4508-8313-1744cacaf398", "comment": "Malware payload (Vidar)", "value": "6d557467cdb0b20561acab3c95707230dded7798732430d9aff2b9c7f885ae0c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499682, "uuid": "da4a0414-c00c-45b3-ae30-147bc6478a19", "comment": "Malware payload (Vidar)", "value": "cf8d5b131522a539fdb16ab947df4ec99bff4764", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499682, "uuid": "2ff41af1-b364-4f7c-b29e-59d389b1e98c", "comment": "Malware payload (Vidar)", "value": "7725dad8d46afbbc47544058db3d8d33e2fc87721da4736e98957461545233a08bbfe025814c08662c1343d9f6d5d8c9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499682, "uuid": "db987faa-3d75-4223-99e4-0d7f5184cf29", "value": "T1C9958C4B7CD008BAD46AA33688B652927B72F8290B3333D72F54B6783F76AD05975710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499682, "uuid": "4b8232f3-bd77-4b38-9677-1374f6c6b7f1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499682, "uuid": "df720357-8446-4938-bbea-a66bc44a62b8", "value": "24576:Ihap6k9hCpPBgHsOO28wqx54l+jesDfg2dN9IcNqa0zMSl7C/BBZ4o2n6hUK20/m:Iha8k9hC34o2nSIRPQiidkXtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499682, "uuid": "edf16c20-46de-43c2-8465-3f73e7d41b26", "value": 1893504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499682, "uuid": "031fbcfb-f49b-4f0e-ac71-24b754b39613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499682, "uuid": "8b5f9781-d673-48fe-8e28-acf9a3d4e7f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76617bc1-31a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775472215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472215, "uuid": "a827e85f-7c83-47b8-bbae-09195f4c6ad9", "comment": "Malware payload (Mirai)", "value": "0406cc14ec98d75ade02275585dcdd05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472215, "uuid": "39b81c67-fb9b-44da-ac42-794a701abafa", "comment": "Malware payload (Mirai)", "value": "6dd0cd91a681d76ee1ab8e3dfc695cfb73db2c1590e2e5584ae0a99a16e795d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472215, "uuid": "f63a2b0a-6bf3-4f04-880e-fb3bbca10d2e", "comment": "Malware payload (Mirai)", "value": "594e06bdf2c30615f0bae9f4497475f970c010a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472215, "uuid": "c64bd63f-8837-4947-8652-ea967f80ffb5", "comment": "Malware payload (Mirai)", "value": "9062ac4a1dc2c0df729953a757053c965c873c2aa6e7762ce1b73ce9d4850d85d992af3db7dccfa51574b8da8555ba1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472215, "uuid": "41ffff07-d72d-4dca-a0b2-3b139486adcc", "value": "T175634A0177580A03C16659B42C3F23D583FBEED122F4BA896D0F9A4A81B4E772459FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472215, "uuid": "8a5b9db5-1026-4e95-aa0a-5d712c98dfc0", "value": "1536:WQQ82elcOc8Gdza3gJw/8Xx6JouijO2aZG5k63ZA6WbFTVL:5Qcj3gJ3s16OlG5t4Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472215, "uuid": "e761eb39-0a5a-49dc-a951-52ecb0fccb41", "value": 71708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472215, "uuid": "a1de96ab-9d8d-48a3-913a-8ebf4b891673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472215, "uuid": "48395426-926d-4f13-97c6-6e9f3ef3e740", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae2ea77-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470853, "uuid": "fd17417b-4de2-4f17-b3a5-7dc95370a027", "comment": "Malware payload (Mirai)", "value": "8aadda9593a3070380a8f7e7bd935471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470853, "uuid": "d832cbb1-7417-47b6-af23-72afbbb835c5", "comment": "Malware payload (Mirai)", "value": "6df7b1baf184b2f4f0d52bc5413b11dfb5b6949bd7f6a14864d767f4ce95aa30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470853, "uuid": "aa0b6258-643e-4b81-9843-a6d77dc963eb", "comment": "Malware payload (Mirai)", "value": "889cdef3e2fbf110286c71a16995df9bc52adeb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470853, "uuid": "ea33ee18-97b0-4163-be8b-e3c6d26db29e", "comment": "Malware payload (Mirai)", "value": "1024f4514497a820fc993082e502be228acca1c05f8527dc1304577a3fb1434c4f259940b8257b999bbeeb7ff5c5e343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470853, "uuid": "b6dd04e6-8d15-4876-b565-6907f8db6315", "value": "T184B2DF34B1A9A4F0CD316434F97EC987ABDA01FE90FD3721226750F85A568CD15A8AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470853, "uuid": "97c06d2d-885f-4409-9218-3106169542f8", "value": "384:osoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1JhymdGUop5R:ocaNSq5sOHpTqncvsdDePiAUgefoeDey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470853, "uuid": "ecd02865-f087-46b2-9fbd-f0dfb07bbfff", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470853, "uuid": "0621f770-d7a2-426c-a40e-b6f5e1c20452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470853, "uuid": "38519ebe-d0c1-414e-acd3-91a2d2f679f7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ae240e-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442927, "uuid": "2dc98f1e-8452-41ac-ab5c-e071d5c06c47", "comment": "Malware payload (Mirai)", "value": "2d06a7ce99399635ad8f827a04ccf485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442927, "uuid": "a8aa47ba-6ff1-42b0-9b48-cc737519a4fe", "comment": "Malware payload (Mirai)", "value": "6f0dcf73f902254c617c7af04320b0256f95fe659709c016450e74e81914f4d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442927, "uuid": "f5cc1540-59e6-4bd8-95ba-8c1e08c02007", "comment": "Malware payload (Mirai)", "value": "ecf11fbb02ed5fd29ecfa6faf8d10ce7224de877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442927, "uuid": "43b1d6da-efad-447d-98a7-9b9b9194e123", "comment": "Malware payload (Mirai)", "value": "8dd9a1212361eb02897c877732c8f2319598af4ac9e4ee3422bfb5abed08550632783ea3a3a265d7ffec42c49701868b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442927, "uuid": "534c5ca0-04c1-4f43-b346-00e76495ab17", "value": "T1B7733A57BA4080FEC499C03843BEBA36D87274FE1379729A13D8FE366D46E601E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442927, "uuid": "a1511f3d-8344-4b4b-b352-341ec2fdcf85", "value": "1536:BzIDxEwvZ8bouGctIb/+w4HnC+8l8AnzcUG:BUxEyZCXtIf4HT8l8AzcUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442927, "uuid": "61a77a54-4f9e-4a2d-970c-11cf87da4791", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442927, "uuid": "4200da6b-49e9-41c1-ad59-4542c8bed36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442927, "uuid": "271b1ac3-fe1e-466b-8637-9e1b3764316f", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd952c1-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496948, "uuid": "d2a4176e-0786-41d2-9063-ef67afa83faa", "comment": "Malware payload (Mirai)", "value": "e8c36b9396ab4c8d7b67a76e659a4ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496948, "uuid": "0d738d15-1498-4d5a-9b30-021f9b29d8fe", "comment": "Malware payload (Mirai)", "value": "6fdfd20f6e07568242331736a3666f2e9ecef2b3291767ebc35bd77c569bb831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496948, "uuid": "bd43376c-982a-4779-967d-ec6e91188bf9", "comment": "Malware payload (Mirai)", "value": "2ecb32c300699b36f024147d6a39d91efb484563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496948, "uuid": "0b578d6b-8c4a-4846-b511-4f092899a976", "comment": "Malware payload (Mirai)", "value": "da8ba3387c0f3e9041e5f41639a24deaf5f268574b5621e3b70c66feadd1b33ebc4375e754a7a0765ad68a7080f4ea99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496948, "uuid": "c35c4e6e-97a2-4ebd-a06f-5be61135ffda", "value": "T1F4A31846FD819F01D4D331BAFBAF414833536BB9E3FA71029924AF61238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496948, "uuid": "840ac10c-e05d-4d8b-9a17-b73dd46116d7", "value": "3072:Ov0p0T1ubTjxKtlaQL4AvpeuBRNJ1i857/:g0rSlaQL4Avpeun1iu7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496948, "uuid": "375860e0-0721-45cb-bf8a-966b0bcb53e2", "value": 105928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496948, "uuid": "da8594f5-bd5a-4ca9-bf6b-26782287bc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496948, "uuid": "01c08705-0a71-49a7-95cb-ad06119c95d7", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7973d9-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463667, "uuid": "07c19b34-8e8d-461d-b5e2-25e85b399d5d", "comment": "Malware payload (Gafgyt)", "value": "43afb5a6dbc6c1126ad133ed3ab51575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463667, "uuid": "fa53adff-232a-45d4-beae-f1d7698905ca", "comment": "Malware payload (Gafgyt)", "value": "70b58485e56d83cef2e2ed664391833eef49b367b870d1050bdb13099d125d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463667, "uuid": "c1b81248-d7df-4ef1-bdfb-65f40bb7461b", "comment": "Malware payload (Gafgyt)", "value": "8534024260cbf7788738adafd2f6786ca7ae078e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463667, "uuid": "5074f260-a509-42e2-aec6-79dd8ffb5dc0", "comment": "Malware payload (Gafgyt)", "value": "c3ddc439a36aef5557e74684e1708df21e598ad9b5b636868eb5004f47c52cd3de38ab83078d04a1a7da0515c36f8701", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463667, "uuid": "cf1826f3-a925-415c-a97b-c084869f7901", "value": "T198B2E01D92D22031DA723837787F4582DB664930E5B931F0B249896D38E64DF8FCD4C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463667, "uuid": "39571ce5-39a6-4e8e-9728-20ee1a96de68", "value": "384:z23UjbCuMFOR9WDDy8NteEWuzqn3LtYLA2Pl1wNXk5/tlmdGU57DH+41hKQ4+RNh:zQelMsbQy7ExqhMP/CXkTl3Up+qhKkNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463667, "uuid": "1b80f221-38e5-4e85-a759-ec9a3579e7c6", "value": 24508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463667, "uuid": "78d60089-4146-445c-a02d-8e0aa97c01d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463667, "uuid": "bff32b55-0e9f-437a-b494-44ef313fe079", "value": "cali.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c326ba90-315c-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775440990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440990, "uuid": "08b2b494-fc18-4545-b66d-fb753d567415", "comment": "Malware payload (Phorpiex)", "value": "f013bc38de730a1715f714279bdcadbe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440990, "uuid": "5fdb834c-e4a3-4fdd-8721-27fe5825d6f9", "comment": "Malware payload (Phorpiex)", "value": "716eeed4288a841e5be39da871136976c731d2aa67b3b9c0a4679b3e4834685b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440990, "uuid": "3a8bec23-7b55-407e-94f1-389bbe161841", "comment": "Malware payload (Phorpiex)", "value": "c5be0433cdc3be1c91971dcf8f72ae9c55445bf5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775440990, "uuid": "823d9ca4-f404-481d-9a14-70a35f0c7d3e", "comment": "Malware payload (Phorpiex)", "value": "302e027002b12b72de71bee9415d4ffee4df2659832cde93d2e200f24871e3ae843bd9b17c1264c290857017f497d08e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440990, "uuid": "a6e151d8-47b2-4c01-9903-d29c7e8e7b3d", "value": "T145823A0FB9434216D0D100B4A672867BD9B9A876378864EBF7D48AED0A686D1FC3314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440990, "uuid": "fbd59d52-1aaa-409c-a84a-6f695e1408b7", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440990, "uuid": "8ddce9d8-4ba1-4ce0-b586-2c24f07f3398", "value": "384:UI78VGwSRFqw/lsx0xu9NHRgdav8U9ce:VXhsx0U9Ea0Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775440990, "uuid": "d5f2c8a3-c616-4325-98f1-412b2811854f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775440990, "uuid": "fcdc4e11-9218-4f82-aec4-7bedc0357202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775440990, "uuid": "95f63676-92e5-45da-be26-6c3736c3e332", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1f12e3-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499633, "uuid": "24079a68-03e9-407b-8a88-0606c1b4c037", "comment": "Malware payload (Mirai)", "value": "9972486adcea3ee9f86f0e21ba75306f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499633, "uuid": "a5d9c1e1-5e9c-4ada-acdc-38984a36f386", "comment": "Malware payload (Mirai)", "value": "7195e9df95dafd381629a9ffc5ce8146d6134a680cb0011ace465df4ae54f5d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499633, "uuid": "f749b3dd-1e45-428f-a00b-785f20d438fa", "comment": "Malware payload (Mirai)", "value": "2471f73f039d4d049afb8de340407cac2d47486b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499633, "uuid": "f6480ca5-be21-4f6b-90d5-6e095f639f52", "comment": "Malware payload (Mirai)", "value": "4f1527749f0d144daa86d7154d36c45cb9570e8b0f479af0badd5dc9894d0482e4407d4b47fdbfe3e86cc59fc08494e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499633, "uuid": "d72d418d-e031-4d92-9453-cbcbc6fc761c", "value": "T1B663F881EE53CEFAD40F90B041F6B63F9A31F92E0435C5A6EB557EA5EA235C06207358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499633, "uuid": "6cf24901-1f61-4afe-aede-de611082aea2", "value": "1536:N4qDG2FLcIrF+z8JW3KM3ELiR8TXbYUqm:pG2FLzrFaaM3ELw8TXUUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499633, "uuid": "b0de2a79-7b7e-467d-944d-65cc29380a38", "value": 70384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499633, "uuid": "3aa7c277-3210-44c8-956f-557536aaea04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499633, "uuid": "0e20060b-128c-439a-a8f8-b7d8f3699d27", "value": "SecuriteInfo.com.ELF.Downloader-DN.42871476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd39da4-3196-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1775465600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465600, "uuid": "7bf75892-3509-4f49-942c-bf28ef423be3", "comment": "Malware payload (DarkCloud)", "value": "03de1ba3e8d9f38cfd59d746df680e73", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465600, "uuid": "3b116bb4-d599-4f2b-a2c1-dfb92ecdea7b", "comment": "Malware payload (DarkCloud)", "value": "71feecc58bf7d3a7a658c40fc67f448522108714de20bd8387ee09d785051489", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465600, "uuid": "20a420f3-3c77-43e9-af68-f198c54785bb", "comment": "Malware payload (DarkCloud)", "value": "0a9cacd07365e8da82532df9378bd6d9dc92cb5d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465600, "uuid": "c75ad8d1-0a7e-4e24-bad0-6b6d55c4c65a", "comment": "Malware payload (DarkCloud)", "value": "b6c4214e7498d55c41941cdc1e5e8620d5d611af5f5940497df9e5c1943e9b3eece3794f378d375973e4bef24706abec", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465600, "uuid": "b17935b1-4bca-40e8-a4dd-0ae3df191677", "value": "T10A5502452259DE02C8A35FF41D70E3750BF46D95A522D3138EFA3EEBBA39B01A904387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465600, "uuid": "7732b26d-7a71-4f4d-8afb-1ddb12036c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465600, "uuid": "6a57b529-644e-43c3-b205-b325fb592b07", "value": "24576:+8fd4ah4WRoGLXsxkKPvOF8snkjFaXFyEoybnTOUJQMxySFHKVikYSJJSHw:+8fdIWRZzULPvm8sn2chnTOkQ/9i9qUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775465600, "uuid": "01db5ac7-6b33-43ad-8ed7-43d3e8a449f0", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775465600, "uuid": "715a64b3-1c06-4bdc-ac3b-519bc7baa668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465600, "uuid": "5e7ea72a-c237-4858-88ca-2899b2b8395d", "value": "ziraat Bankasi Swift Mesaji,pdf.z.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b930f79-3210-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775517992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775517992, "uuid": "a4237414-cc2d-4e9a-b251-964bff1385b8", "comment": "Malware payload (Mirai)", "value": "e858cae6e194f2ecf86f515b5167440b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775517992, "uuid": "a1627fb1-8034-454a-88fe-50d559f58828", "comment": "Malware payload (Mirai)", "value": "724d455284005acacf6555e32a1e02658a583ca00b63d23a6a1df81f774208c9", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775517992, "uuid": "20e982f3-5956-47e9-89a5-b9881532f349", "comment": "Malware payload (Mirai)", "value": "ae518aa2dc973d88dcbdd19869dcf6a914329fbd", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775517992, "uuid": "9ac092c0-1b60-4098-95a5-bb9d89513e4d", "comment": "Malware payload (Mirai)", "value": "bf89b07e4da4dc0e150d59b853dfa7b78a37c79ec4972e9fe534c9e294c4491c33f41da11295b4c04c40475b58bd25e4", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775517992, "uuid": "639dd1e6-3a96-4433-ab95-3f2b815b8dec", "value": "T1EF8423DF776474AEE2B9EA3C24B53B80BBC646D2A8111538031B9537CE5616D3DCD80B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775517992, "uuid": "19934a19-52bb-43e8-81f4-3eb983fb7e32", "value": "12288:4oFhMZl7val9zar1ZPJU8y4FJ4/kxBpftBaN8Pne:4ovQl7vQ92rPPa8y4FJ4OBKAne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775517992, "uuid": "6aef5d80-7b20-4466-a57f-33ca4e1f2253", "value": 399252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775517992, "uuid": "2ddea20d-3675-4fd6-90bf-546f80472c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775517992, "uuid": "b31f8013-8223-4760-a816-b32d5a77ea4a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bdb816-31b0-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775477159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477159, "uuid": "96908df3-849c-43f3-ac42-8aecfab62140", "comment": "Malware payload (ACRStealer)", "value": "94e770203d2e38c46b5670ec74013e28", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477159, "uuid": "47598cd5-b769-42d2-8025-8952f7f2e463", "comment": "Malware payload (ACRStealer)", "value": "7305daa8982d5a438feaabb78ddef96f65059be5304a69c918d04ffea99d49d8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477159, "uuid": "a3770764-98ca-4003-9406-6df2b1622b8c", "comment": "Malware payload (ACRStealer)", "value": "469acf9f1d0109b806d00d1663915b9c3e572b93", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477159, "uuid": "e3e2cb8d-0aab-4138-ad49-32b46751eeeb", "comment": "Malware payload (ACRStealer)", "value": "829dc979048d60ef86e36152d564f4093fc4826183cfa6f9fdcb5815ba5ce43efb6f2e189648b80964979b3f99628a0f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477159, "uuid": "acb55739-649e-4278-8251-3ae804c04f47", "value": "T1BA6570B701013477FCA445BCA54F334D858DBAAC3E5E9BC729E4C7FBA502B0A8898657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477159, "uuid": "44578665-094a-4190-94fb-7f7c44e14626", "value": "ba4314db01695e6a84ee697fe663c4bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477159, "uuid": "14a92f35-c738-4ba7-8be6-d3c6a28e860f", "value": "12288:EoT8r6csbGFpS80RlUq1jUORk3x+7aqfe:EoT8rnaGGlUqdntaq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775477159, "uuid": "a7a1eb70-f428-4a9f-9374-b4cc9656a9a9", "value": 1469376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775477159, "uuid": "9426eaf2-b1b5-4763-abc8-16413f8f107f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477159, "uuid": "0525d1ce-b195-497e-9ead-409afb6572ca", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cc6c5e-31a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473400, "uuid": "f7c3dd62-494f-4a34-ac3f-b0dd61f9d15e", "comment": "Malware payload (Mirai)", "value": "f43fc69d3c34984dc4fc8d68fcf28646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473400, "uuid": "f6689ced-c259-44ac-a971-5e7877512d32", "comment": "Malware payload (Mirai)", "value": "730bfc0f4b716727ef48345cf4cdf51cabf8f96eca0c90d9b4acb2e4f9e71ffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473400, "uuid": "8ace4f6f-f8f9-423d-994b-073f5f7994ea", "comment": "Malware payload (Mirai)", "value": "2c9e0e9083c5a081627f237ec95406b4d1a3f56f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473400, "uuid": "1c8ed977-414b-48d6-8513-d149d12ba38e", "comment": "Malware payload (Mirai)", "value": "a3791cbaa98fbe982acb510d5ddbe48496f4baea154be340c85084437af36b59d31c863174b8f976d006a114232092ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473400, "uuid": "dbaff449-9381-4db1-8888-fa19b5d7b4eb", "value": "T1AC837DCAEB87C6F0DD4109F0113BFB3599329C312124DDABDBD4BE639DA2A42A05625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473400, "uuid": "09dbb9f2-a197-4601-9e5c-9e727970e95c", "value": "1536:1KoFfhazMU6ozOhs7kSYgAQUW31EJrGYdUru682KrL:1KuIYNoyhs7fiYKxNFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473400, "uuid": "622c736f-8a4d-413b-a8e9-bf28a29cabf7", "value": 87036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473400, "uuid": "6273d507-907d-433c-aee9-8f00c31093bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473400, "uuid": "3af6d9f0-be67-4fea-9768-3b3f67207894", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ccaadd-31ed-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775502949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502949, "uuid": "230548e7-69cc-49ad-a39d-d045e8b89c5c", "comment": "Malware payload (SalatStealer)", "value": "d6c7ca66c4fef2bf7c62261f58f2f6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502949, "uuid": "03a6b33c-336e-43bb-9031-d4fa73705307", "comment": "Malware payload (SalatStealer)", "value": "7376aaca33eab974ec527d44753d8016c1d305e2db935189a91a57b0ecbb3ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502949, "uuid": "18ffd676-9012-461c-b66e-4ed7dfec2f25", "comment": "Malware payload (SalatStealer)", "value": "7e6f8597028e4dc2ff63ed330f989fe9dbca3093", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502949, "uuid": "5471d1e7-7afa-406d-a5c5-e1ab9bdb9238", "comment": "Malware payload (SalatStealer)", "value": "24f41aa6d71384f3e7ed998f0bae6738de2b0fdb4aa02ffd3021727863ee4eb95e2859f740c1440c6e72851c85f8e3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502949, "uuid": "631ad3f1-dc2e-4784-88a3-1657af0b77e8", "value": "T196C65C11FACB54F6F9036831416BB37F23315D048B28DB9BEB183B6AF877691186A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502949, "uuid": "cdc36aa9-01d8-4e20-92cc-5abb79d5fbe9", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502949, "uuid": "16f4ed8c-085d-4727-bb73-384dce639dbc", "value": "49152:JfD9eJ/gbHRs7V2M99RrwpvCLqof9pLnwh1taTElkd0GZlcGJslhDuFr6QAlSEkz:Z9u/KM9jcBC31CZwPaL3Qlo47QEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502949, "uuid": "d186d52d-39a8-41e9-956e-593db0bc4b7c", "value": 12571136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502949, "uuid": "6a7f082e-b126-41ad-b8d1-3b5f0e795304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502949, "uuid": "e2ed8518-7b95-4c6c-926c-544d5d64ee8d", "value": "uptodate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884b637a-31f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775507893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507893, "uuid": "e61594f4-9d67-4bc5-a8b6-ab9e19cc8bd1", "comment": "Malware payload", "value": "b1f11118c92187cb5a0219554eb2a516", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507893, "uuid": "8a0ba849-2e1f-49b5-a34b-4b1a24e21350", "comment": "Malware payload", "value": "75a4b975e48c2469da55bb4bc5fd3c812593f34e676c95ed8eaca3f641bb359e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507893, "uuid": "99e72e2f-ea2d-4da2-b7b0-9396dc141fb9", "comment": "Malware payload", "value": "f326f0bf9c8ab5fdc04e0a05fbd55ab38ef37f3d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507893, "uuid": "e5097faa-e050-4833-86f2-c5bdb799a4a2", "comment": "Malware payload", "value": "1281668f52854b902141c5d01bfb37ee60e2afcb444a92120f5ee2993dc8d9acb1034569a7d00bdffb89a90e5b751722", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507893, "uuid": "23ab5571-c2a9-4364-bbd4-331315fccb92", "value": "T16407AE87E9A105E4D0EED175CA669252BE717C884F3063C72B90F7292F76BD0AEB5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507893, "uuid": "47997fe7-1487-49dc-9479-db9cf92eb958", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507893, "uuid": "066a25a2-3fe2-49db-9d8b-d72d40e7d5bb", "value": "196608:C51PxCs2Qh4qd6pUVjYUJB0HXZYt+GlcsqRJhbjQ19YbkwNn9DZs5ibKN6z:C51PxCRe4a6wYS7MGlA1QMb1nk5ibC6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507893, "uuid": "723cc631-abca-4b4b-bce3-5300a60f706c", "value": 18256384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507893, "uuid": "c77e2207-ba46-4ce2-82b9-dd32ca3f87e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507893, "uuid": "c7ef0f7b-6661-4e14-9265-7009d541de77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ad3246-31fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775508561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508561, "uuid": "8884d271-06a4-4a12-963f-483e1bd23f24", "comment": "Malware payload", "value": "310b6410eb1ed5f669abaef331e3e40f", "object_relation": "md5", "Tag": [ { "name": "APT-C-23", "colour": "#05F8E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508561, "uuid": "7656da2f-7de4-4200-ae08-2e070c8fefc5", "comment": "Malware payload", "value": "79456aa05c1c126605c942a33117899db3971c9aa78d684230cffe50d18b99ea", "object_relation": "sha256", "Tag": [ { "name": "APT-C-23", "colour": "#05F8E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508561, "uuid": "ef46be33-a527-4db2-9464-5bbc48e91f0a", "comment": "Malware payload", "value": "ad91e8944ec54b23df6a07636a07023f2c6dc5f2", "object_relation": "sha1", "Tag": [ { "name": "APT-C-23", "colour": "#05F8E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508561, "uuid": "bf912edf-42ae-4a1f-bc09-48f4670ae4eb", "comment": "Malware payload", "value": "a37ffdbff780fb5738a72aba2273289fff152ae633248ff866d6ec6cb2fa69f1f9f109b309b297e5061d91ca9713f50a", "object_relation": "sha3-384", "Tag": [ { "name": "APT-C-23", "colour": "#05F8E0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508561, "uuid": "25f60165-6ad2-4dc0-a05f-00ea4f87001a", "value": "T16D753383BA406FB8D16B1763C1E9B488BC1404FF875D95C31C92D21A9F1C672AEB8ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508561, "uuid": "786a665a-950f-4e85-89cc-265242952a5e", "value": "24576:01su4lrZHgIInp1WQUTxTIsziLvQP7ZsTCkHDoAqzEUP/A9icJBXHWiTJ373pTqP:O+ZHDyp1WQ2VzqYKTNiEUgicJBmsswZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775508561, "uuid": "3f5b9429-130a-49e1-8ef2-0f854726409b", "value": 1597458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775508561, "uuid": "0335addd-5756-45e4-85fa-d719567f7dd2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508561, "uuid": "41ee29dd-de54-4b48-964f-8c9e56605560", "value": "Home design plans Civil engineering map design docx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc86391-31da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775495175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495175, "uuid": "f3ea9b2f-9254-40b6-86e7-7029a6f06419", "comment": "Malware payload (Mirai)", "value": "06ca6e08148781c609e2ceb289f10541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495175, "uuid": "0717077e-fcde-4ada-996a-8a949c0cb781", "comment": "Malware payload (Mirai)", "value": "7a38c59499b7d1348b1561c779e925ce5b715db97f6e66b48cae24edd1599980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495175, "uuid": "683711e7-9c3b-4943-9521-4af2b54162b0", "comment": "Malware payload (Mirai)", "value": "622cb34ac7fdf8194f88047f909b8440fcf52cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775495175, "uuid": "bcb0d131-dcfe-41c4-a956-18f7661e4687", "comment": "Malware payload (Mirai)", "value": "2b0115d9dfdbc8ad2b4a2da6ac3d67f23492df0862a86e07535f9fd4eccc2c238e0c134871d08fca793ebd6d57e58ac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495175, "uuid": "c7e0d488-af3a-40c3-ab8e-27a044b80f30", "value": "T142832A82FD819E12D5D8137AFA1E118D33136369F2DEB253DE116F206B8A92F0E3B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495175, "uuid": "4c0cbc23-a9ef-43ae-9bb7-bd620673a51b", "value": "1536:MYnKegmj+yFcmphCyuOQHAeZFWMu/iw5SoZMWiDW92jh9OeZA6W0FTr:NRj+yiRyIZZFluqk92jh9O4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775495175, "uuid": "abceb4a7-07f3-4ad4-b422-e9c51e952687", "value": 83492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775495175, "uuid": "5d6acd5b-b802-43b8-bbce-2feb8443514e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775495175, "uuid": "6356e167-ed18-4d94-b7fa-106c857795ad", "value": "mao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92fdaca-31a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775470260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470260, "uuid": "f60ed54d-faa9-4ce5-a76b-ac4c952e21e3", "comment": "Malware payload", "value": "065b3bffbde91466dee61d6bc6b79b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470260, "uuid": "157f98b1-09da-40c5-99c8-a5d2bc458b32", "comment": "Malware payload", "value": "7c4dcfb61f7192b5168fe51bd03edd4d64728d2cf4a5fbb153ec67c9425a97ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470260, "uuid": "320784e2-2aed-4c8e-baf7-06d266c4082b", "comment": "Malware payload", "value": "1ba1a4c7dbf6ec02854fc084f4443624760a3b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470260, "uuid": "7a0fcb73-14d5-4616-87fe-56d3653a6ecc", "comment": "Malware payload", "value": "7a79e46ba9460de3e3f935f374c5d7e0adfcacb103d0c1694644d515865637ab4d3115fe97ced6aa55c6fe9a875b82b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470260, "uuid": "8e74014a-06e9-4d0e-84aa-4d715fd8ddf2", "value": "T1DEB5E03BF28BA53EE06A1A3A7A72E110543B7A2165164C1696ECF48CCF355701E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470260, "uuid": "d2d20d73-5549-410d-84f8-06afaa2e6e38", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470260, "uuid": "aac162f3-a89e-42ec-8719-11ab58f687f7", "value": "49152:RuI2h3HOOwTdyFyun/ggS76zvJO5WImt0XDR6KG4VqYqY:R5O2TdGX/gL7kBO5WIw0XDR6Pkth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470260, "uuid": "b1297644-b4fb-4397-a738-848fde35e4b8", "value": 2411490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470260, "uuid": "10cc916c-b901-418a-90ce-9c812c3433fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470260, "uuid": "a1c8121e-f504-42a7-9faa-796adf775998", "value": "065b3bffbde91466dee61d6bc6b79b86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e100c409-320b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775516202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516202, "uuid": "1ad33346-ed3f-4843-b0be-47a3dd3005ad", "comment": "Malware payload", "value": "b34dd856da75f9c63a53b80e432ea3cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516202, "uuid": "4c697c0e-cc51-4642-95a7-211ab21cd365", "comment": "Malware payload", "value": "7ca2747006018a70a11b6b7b5754e94c32de00b4ed7d63b8bf9ad1dd24a92b8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516202, "uuid": "d735b4d7-1779-4c0c-9db3-934c667df407", "comment": "Malware payload", "value": "49a4ceee53834d3aebce37707731c594a1ea8ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516202, "uuid": "98a05869-1db0-42f7-93cd-64f218461fd5", "comment": "Malware payload", "value": "9e5cf81b1b1846b7c131c047a77222016193d8dbef3d4ac5d739a2b24d64f466aa22030c2cb8d7f4db754b251566c08c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516202, "uuid": "8687dbc0-eb5b-4448-9567-8c8e25d712a9", "value": "T125261897B9D25982C4E43677A8BE81C433630EB98B8613575D09FE3C3ABE5D90E39314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516202, "uuid": "77b5ce4f-e131-4e67-bab3-27a47a437a5c", "value": "24576:DQPwS2MBwGwZ+UfZQfyq3NaEYOrsvvqipGe+LwoHnU7/EwaYUGsOgC1dyRdySlz4:DGe7azWuA4ZFyQT99PQTzCgDzl5EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516202, "uuid": "0855692e-b692-4883-9352-0857165cb67b", "value": 4587682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516202, "uuid": "d2ea9f40-6e66-44df-97b6-f34e18aea869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516202, "uuid": "375eb322-6154-4977-803c-cc673a8e5785", "value": "li7arm4n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e02846b-31fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775510050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510050, "uuid": "fd0467dc-bd3e-4542-9116-6ebf20fe4407", "comment": "Malware payload", "value": "0f110b77f01a856e883bcece5552083d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510050, "uuid": "97d10681-c137-4f3a-8436-1c264f514586", "comment": "Malware payload", "value": "7d103efeeb0facc0f30e25641fa123c1b225819e09fae8cd673c23643efe0470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510050, "uuid": "28cd3af4-118e-4946-a277-26d046957377", "comment": "Malware payload", "value": "df584a9ddc685e82d0a80dfd4f947617c27c8e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510050, "uuid": "b8485b52-75be-41e0-97cf-d9c3796396ce", "comment": "Malware payload", "value": "f114f7c762916c40ff93409d01e82b96e36ea5ae7c9c1295a04c9b2b8ace8a4a12a4c8d9ede814dc187e8fc88591e13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510050, "uuid": "4a12132b-1603-4245-a457-3cef17f7e91d", "value": "T10747338403D10556F99EB23D25E847A3E3F5B5101B30CA8F0FA89F6929B71DADD36B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510050, "uuid": "ea36e45e-53cc-46e0-9307-048dd13fca8c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510050, "uuid": "7d613022-1953-4a85-8bca-3964c6721605", "value": "786432:sznxv2JLex0HrxDC1yUg14tTrEgzSI0pu:andKHr41spgzP0pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510050, "uuid": "d4ca9066-62be-4eb4-b247-491614586e24", "value": 25769624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510050, "uuid": "982a2093-7e52-406a-92b6-1cae4b428967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510050, "uuid": "f9f73fbb-c064-49aa-8167-ebd199a45c17", "value": "platy_zamestnancu_ve_firme_2026.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dfb503-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499653, "uuid": "99bc36e5-dcab-42a1-88c4-71ffca3d1db5", "comment": "Malware payload (Mirai)", "value": "70b744b90196f634c16eed6bb90a0383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499653, "uuid": "d4adbfae-80d0-4597-bc20-6e20ad00c633", "comment": "Malware payload (Mirai)", "value": "7d6a39e42157939f6feeeaea34a2cc04564ebdc660372d76ca2f50161ef73a7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499653, "uuid": "8042a9a5-bb35-46f1-9817-4bb939c7b92e", "comment": "Malware payload (Mirai)", "value": "72cbd4ae432e1c869d5bd5b3fb40a48cfe8b9add", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499653, "uuid": "65af4d2f-c699-49d2-926a-a19bcc728631", "comment": "Malware payload (Mirai)", "value": "bc06c60f860a5d5d78b14f67ea12fe1b32d58ec234d54452d6f9ff39f941ae92bfc0fbd31f3e347fac463da28e7809c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499653, "uuid": "6d97d38e-772c-43a8-8780-f57069e44d38", "value": "T1B4A30746FD819F01D4D324FAFAAF41483313ABB9E3FA7101A9249F65238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499653, "uuid": "8dd4704d-27cd-4b3c-9d00-8a0c26e23896", "value": "3072:tRZCioZLTTDssvaIwYH6HMmZj14x7nSo/:jQwgaIwYH6HMmgx7So/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499653, "uuid": "64e227c6-28c9-4af4-824b-a36eb8bf8ce3", "value": 105872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499653, "uuid": "be9e0cc0-f5ee-45cb-80f7-9268f42fed81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499653, "uuid": "6b629158-e263-4eda-99ff-c63f9130b030", "value": "SecuriteInfo.com.ELF.Downloader-DN.52673865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164c63ac-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507272, "uuid": "b85759c4-4eba-4bea-b382-5c95f1e96ee0", "comment": "Malware payload (Mirai)", "value": "02bd542cd836ad88fd115b54c218727e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507272, "uuid": "82c552fd-8a79-443c-a963-92f97f2218f5", "comment": "Malware payload (Mirai)", "value": "7db2f8b77f09f3aa1c42916333b0807a36eb169c1736d2571da12d9d4206124f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507272, "uuid": "4c0d72c6-8244-4d3b-80e8-014c82aefb68", "comment": "Malware payload (Mirai)", "value": "1d30726afd256aac4eb3f7725464b38b29446f15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507272, "uuid": "7247cd6e-830c-4628-9f6f-da5a03f48a41", "comment": "Malware payload (Mirai)", "value": "dae4daa5edb29fc697c2075117ac4ad663bce86803d5da59b1bb83a859e8b92570d2aaa641c31df7db5a704582baa10d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507272, "uuid": "21ea9f47-7711-4c9c-a164-274ec7f4eca0", "value": "T1D4A3194AFD819F02D4D321BAFBAF414933136BB8D3FA710299249F65238A9970E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507272, "uuid": "cd95ecde-5eca-4f58-8df3-bcaf0b15e495", "value": "3072:rZT9Y03CKxytcaZwYH6CwmbKF85NnWy/:1VacaZwYH6Cwmd5NWy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507272, "uuid": "6f3051a5-1f59-4a1d-8453-852439f40eec", "value": 105888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507272, "uuid": "d9fa76c1-c8e0-45d9-95b2-f51cdfc0f8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507272, "uuid": "f4c7107f-c43e-40c8-9f06-83de86aab8be", "value": "SecuriteInfo.com.ELF.Downloader-DN.47975735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04084f57-3197-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1775466010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466010, "uuid": "8195f37e-b999-46e3-a10b-b645d0605c67", "comment": "Malware payload (XWorm)", "value": "b73f3f9ea1ea4e68493f9e1c4d891b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466010, "uuid": "04f220d2-2dc8-47c1-a8a9-e5e73ad81f0a", "comment": "Malware payload (XWorm)", "value": "7df90390f5084407f21616f21c644ea9d354efb5d0b254a7f528ab8064457e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466010, "uuid": "c7fa92c6-88c2-40e5-8537-0fddb4e870e7", "comment": "Malware payload (XWorm)", "value": "661edd65b825290f52dd11e056522dbb7768121a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775466010, "uuid": "1d96952e-6a89-4895-93d0-f0656677ffb4", "comment": "Malware payload (XWorm)", "value": "2bd7b13527ae838eaec94b95908cda3dbcf95e9cfa8697596c6a04e71f6aab84bb6e637ca115f7e162317291dd846a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466010, "uuid": "b3d12d14-4103-4f54-9f35-51242aadd9b0", "value": "T17615E0842255DF02D9A31BF05DB0E37457F5AD95A423C3178EEABDDBBA39B016908383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466010, "uuid": "180f3ff0-5237-44cd-8416-304fd866fa8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466010, "uuid": "afec7d6d-f208-45fe-9402-0059783d124b", "value": "24576:BSJJSHwGy0b7KDePdN5Jh6m0RqUZFh+o6SMQssqR:BqUwGhbZN5Jh6dqYz+o6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775466010, "uuid": "d245b896-6ecb-4928-bda4-6b665a971a02", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775466010, "uuid": "11b7c67d-58c4-43ac-adec-d5982488f5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775466010, "uuid": "fb4876ae-000c-4c12-a845-eb39e1a1d7c1", "value": "z1PAYMENT_28_MARC_26.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b5c204-31ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502572, "uuid": "700ef7fb-7722-4ae3-8d40-e6c17e6d8c4e", "comment": "Malware payload", "value": "2197f41146180b59672fd9fdd7b1fe71", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CNBackdoor", "colour": "#33020C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502572, "uuid": "c68dfb7f-2ae9-4634-b235-fbeddcb418a9", "comment": "Malware payload", "value": "7df95acc34c5d89eaae39b047fe51d50ae7abea93188e591146d7a11143413e9", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CNBackdoor", "colour": "#33020C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502572, "uuid": "7406dd1e-2685-45f4-9183-8bbbec6c3046", "comment": "Malware payload", "value": "f455f170790eea58ef2782013c2da97dc3e29215", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CNBackdoor", "colour": "#33020C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502572, "uuid": "6ade00e8-ffdb-41bf-aaba-142190d87087", "comment": "Malware payload", "value": "a99af80d9524d36d1fd74144cb5cb8f24fa4a8dfbb5384170d75ab559620215bf704b170d7afa7af54123b00f3110b94", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CNBackdoor", "colour": "#33020C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502572, "uuid": "90ce64b2-c044-4f6f-962e-bb455631fb13", "value": "T17FD45B0FB55A4E20C1845737C9DB941067F49846B6E3EB5B394A23DA8C073BBDE4E287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502572, "uuid": "e0cf190a-b3a9-4889-aa9e-b9700044ad00", "value": "6144:UrNYBLsIdxFTDTwwO1mr81Ifm9IqITvMmx9x9RYnE7xf+yINFVaUVEAre+pXU9AT:SwXgi5OSVBinGxR6fax+UOnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502572, "uuid": "761509b2-26f8-4449-bea2-833df85284e8", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502572, "uuid": "c89c5380-f4d9-4fce-97e7-4aa158c41e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502572, "uuid": "7a0c46bb-cc25-411a-8204-96ff4e7c95be", "value": "CNB0604sprd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614db3a6-320b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775515988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515988, "uuid": "fb3ffb61-31bc-45de-b906-1e294fbf4710", "comment": "Malware payload", "value": "7a5e60a06f2c71432d014989b2999194", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515988, "uuid": "b97ca4a6-d128-4d16-ae4e-b0949c85a8ef", "comment": "Malware payload", "value": "7e22f167b3de9408bb01b0504266deff8ab1d31a1a7db45fd6cc55948165a556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515988, "uuid": "dc87aaa2-9121-4474-8d33-8b9e1811e9b1", "comment": "Malware payload", "value": "0a3eee540374297d3c4f75f809ded8e6dfa77195", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515988, "uuid": "bb65922b-169b-494e-aa69-c5347e4c6ee9", "comment": "Malware payload", "value": "3105a2d66de479a1763115c21ee76804b891eb53fa190b0c306f74e4672562b3284073e6487e4865fdbbc1fe603e34da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515988, "uuid": "136dbbc8-f1af-4c9c-a9c7-6cb18ce77718", "value": "T18CB44955F8809F61C6C029B6F64D86AC73174B79C3EB72068A255B343BE786B0F3B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515988, "uuid": "220fbcc5-a8b1-4b46-9c28-c653caae562f", "value": "12288:rxc8R81vX/Ic0nolumivq/tiRkWOgpg+Rd/:28R81vvK21ivotiRHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515988, "uuid": "b26b8345-3a22-46cb-9010-bc7b48ba2e2f", "value": 532634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515988, "uuid": "8b73adbe-2097-4d99-aa05-e9bbdd6534f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515988, "uuid": "89b1d6f4-fbb0-443f-bff9-cdcd884e3ece", "value": "rstarm7n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c62b7b1-31ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775487955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487955, "uuid": "965f520a-bb3e-4e7e-9c36-932ba896d73f", "comment": "Malware payload", "value": "080c4fc03e5fedb90ff82f8d6117ce84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487955, "uuid": "e9d34a8d-cc97-45ab-a2cb-1d060d72957f", "comment": "Malware payload", "value": "7fff1bf124cb684297ee823cf91fff62e8f94ada32e24b20b412bbedc52a92ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487955, "uuid": "8fa64716-bd6b-4b19-9d8a-128d40236e84", "comment": "Malware payload", "value": "4ec3a8bd266b557ec6c7cb02d2eb69e7d9ffde55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487955, "uuid": "d697c98f-78cd-486c-8e65-144f3a411aea", "comment": "Malware payload", "value": "254585d011b336ca503340b6d2259781ae312cf257c8e5f43b2155dc026c39dee43740da3f31158be12727fde72cfdca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487955, "uuid": "66b53546-a640-4fb1-ba05-eba5a2096267", "value": "T190E36C5773A530F9E0B78235C9620A46EB72B83517609BEF03A443752F237D19E3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487955, "uuid": "38fb2795-64c5-43d6-9bed-f954ddf8af5f", "value": "10d9b9b9f9dff793617daefa08dda158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487955, "uuid": "ebd3ee51-afd1-4930-be8d-b0b5c9522912", "value": "1536:OsAQWT5v1E0V7iUa4oPG+9CGtvHqx3OlGdTHVS5ik3fqsacUB9Ne3adisWddl9df:OD9VEfG3Oy1eFfqsacUDem0Vc7/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775487955, "uuid": "e546703c-162f-40e6-a7ce-ec5d31daf594", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775487955, "uuid": "64f974e2-5817-47f1-84db-782614824ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487955, "uuid": "055834f5-27b2-4c2f-8fd8-47003defee2f", "value": "rickroll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1837a99c-3190-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775463037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463037, "uuid": "a096f9e9-fcdd-4ed5-8f19-d17d75bd2da4", "comment": "Malware payload", "value": "84f601b48479dcb5311082f91e34f2c3", "object_relation": "md5", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463037, "uuid": "b88628de-ea21-47fa-be1a-0aa34a4329dd", "comment": "Malware payload", "value": "80e504a1574df1a53507addaca147846a1ceb082725039ea20ef7206db8d1c00", "object_relation": "sha256", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463037, "uuid": "3553f6d2-107c-4844-9988-5cac7e91954b", "comment": "Malware payload", "value": "4f26192c63b3cee8df3237abc9569460c864161c", "object_relation": "sha1", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463037, "uuid": "994c0197-01f8-4198-b26c-9bb5488327e1", "comment": "Malware payload", "value": "196eeca1cc0caa19b553ff0795bd95917296d314fcd0aee1e125c088d94a585d91f925c7844d0344252c0bf8f73261ad", "object_relation": "sha3-384", "Tag": [ { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463037, "uuid": "57d46976-61b9-412a-84ab-0ba0ef5cc193", "value": "T1AEA733CDCD6887E712B41D5E937C99B6FD01833EE51D0A63E1288508EEDA4FAC312DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463037, "uuid": "15c9a17a-4d55-43e4-abfb-7ab2e82ba76f", "value": "786432:s07aVZe1sU/j4EV32/7iY4+AVxRGD7n57ITaCESDBBdpekq6ZZ5gAz/QxETbisrE:sSaVZe174EVmDpqVxofmTpdHdR/3gAUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463037, "uuid": "4f9efc45-ed4e-4513-9a75-a5573a5907f4", "value": 47532127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463037, "uuid": "5e0d9220-0dc0-49ef-bf53-73ac99a3032e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463037, "uuid": "7e918ceb-8114-4662-b27c-0342c3cf8c89", "value": "application-c041242e-fe9f-4fae-950b-7d39b9999dbe.apk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1569b03-315e-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1775441927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441927, "uuid": "f4288935-6652-47a9-8bcd-5fa8ae936fb8", "comment": "Malware payload (Phorpiex)", "value": "845175747282358f208acab3faf8a6ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441927, "uuid": "25ff2ba7-cb3c-4f71-8dca-a72a049b5281", "comment": "Malware payload (Phorpiex)", "value": "81049439863f9d4166385718d23ad2e0a82ded1a4ffd351a33b6cc741d3760ae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441927, "uuid": "0884b53e-9537-4088-b6cb-ab83de914bbc", "comment": "Malware payload (Phorpiex)", "value": "0595236ab18746146b36ec881d003259f3e245ab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441927, "uuid": "44a0c621-3d78-4286-8755-7a45be2e2217", "comment": "Malware payload (Phorpiex)", "value": "d050eb425d00c26e28242a7ee0560b7a1ae72e85f39db86fcec9c4f8deb7a6f752fcdf7ff9a6de8192607b2edb5e4934", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441927, "uuid": "7faab36d-8dcc-47d0-ac61-9a525cf4e743", "value": "T139823A0FB9424216D0D100B4A672867BC9B9A8B637C864EBF7D44AED1A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441927, "uuid": "24c77fb3-2c4f-440b-bc4a-1693df3f7e64", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441927, "uuid": "1b240fb7-705d-4067-bf4e-d7497cf4ff27", "value": "384:wI78VGwSRFqwDlsx0xu9NHRgdav8U9cu:RX9sx0U9Ea0UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775441927, "uuid": "bc903000-2969-4068-88a9-fcb7aef8205c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775441927, "uuid": "3d17a3d0-8449-451b-b133-15b389ad552d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441927, "uuid": "09d4ec4a-8343-45d4-9b4e-8e5bbc2043ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d801e1b-31a5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775472253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472253, "uuid": "1a8a239e-2eb5-4370-93c4-a15a7f36dd33", "comment": "Malware payload (SalatStealer)", "value": "542e6968129e8a8e47df13ec9b2ab97e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472253, "uuid": "0319c2a9-1f11-487b-92d2-6129a7172679", "comment": "Malware payload (SalatStealer)", "value": "816e2e8a6d69973fbeeba2bf296150f1041179b159f88f9d228717b2a05b6417", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472253, "uuid": "09292f94-3718-4bdf-b234-81a9a44fc8ba", "comment": "Malware payload (SalatStealer)", "value": "94ea555b3683afe9b1ef1434c2d09f26254753a4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472253, "uuid": "e6052e1d-50cb-4592-959e-bdff5681b1b8", "comment": "Malware payload (SalatStealer)", "value": "d976f7144194435742c1304c5b1bf01caaca5408fe44349562a478c079d15b5e1d53b248f73aaba2f7b57046c18bc50f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472253, "uuid": "efe3433f-47de-4cd2-8533-dcb1d58d0c64", "value": "T11F26331327F270EDD62717344C430103A7227930221AAFAF4B99EF657E5B7A4AE76352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472253, "uuid": "6bf85d95-0387-4a55-84a0-2f5578a795f5", "value": "bfee7c7e234d73184f6b414fec537224", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472253, "uuid": "16f8be1f-d6be-4777-8ee4-0dc8d0904cfc", "value": "98304:7eGQ4qnAnBZ96ZLNM3HOlOwnIW97C3uNMma/x4lESH9dPaQatEw/0+yd5AM:7exn+BZ9cLNM3HQOgIh3uNICWK3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472253, "uuid": "13bc86bb-2f4f-4ba2-b54f-8fe1780006cb", "value": 4786176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472253, "uuid": "6fe938ed-91ec-4836-a08b-b2c2195f9c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472253, "uuid": "2bb3a2c1-fa01-4acc-a3be-1d908aba1bd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f9db40-319e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775469318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469318, "uuid": "f20ddc19-ad2f-4dad-a0f1-054b777edf6b", "comment": "Malware payload (NetSupport)", "value": "29a247f5d040a8f71716c181c70bfa46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469318, "uuid": "b82f5dfa-6c7b-4c79-b560-bdc850aab9b6", "comment": "Malware payload (NetSupport)", "value": "8222775ca74ca2bfc222e6c22e10b7945be56506cd8f5baf5237fe0c57ffbf7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469318, "uuid": "50805d2c-9e33-4d72-afea-ded5dcbd0a27", "comment": "Malware payload (NetSupport)", "value": "9d4e773daa0daba7b278de9ff3f7ba51511a786b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469318, "uuid": "97dbd7d6-b2ea-4ed5-a332-da906026e7d9", "comment": "Malware payload (NetSupport)", "value": "42a3e22941ff4babe82febb84195e7c138844f61b981c3259cbb4273a06db9fb1c0496a0acde939a2318c7960f1ba0a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469318, "uuid": "89de909a-ee27-4e52-ad05-17a6ecf6e7c3", "value": "T148565A8F329BB671C55CA5377C8A555A3441CBB6339647780CFC4BB808BF69A8B0861F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469318, "uuid": "fe8a708f-64bf-473e-a3db-0982d03dbe03", "value": "31f01382ba761e6e741d4f20d6d399eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469318, "uuid": "44a910bc-129c-400c-a4cd-b8dc8abe56a6", "value": "98304:5YuHiEuPNUYEi1xoo33w3NPvNTIVtC8dsHJFdKm:OiiEuNUs1eo33GtyGHJDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775469318, "uuid": "3664457b-54c3-44fa-b40d-de68c5fb5c89", "value": 5909011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775469318, "uuid": "67531ce2-cca7-4a08-a875-e28a217dde56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469318, "uuid": "f69ca043-51d4-4dc6-9d59-4a2ae692de35", "value": "29a247f5d040a8f71716c181c70bfa46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e65c8a-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "ec6371d8-b6e6-4372-a776-9cacb23a077c", "comment": "Malware payload (Mirai)", "value": "57958bc98ce263a65e3e5d713e0cadd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "9d7fc817-88b4-4a2a-a740-68d8e26069cc", "comment": "Malware payload (Mirai)", "value": "82f962a3a94097cadcae9feb3cc8e1722c316371bfa5f5a53568ed47e4acd816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "3a7c8202-869a-4edb-bd6c-061cd9772133", "comment": "Malware payload (Mirai)", "value": "8789fa48b85c638891db3583a7d4d108c50a80e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463699, "uuid": "07f58205-54fa-40db-9c1f-23de93d5da3a", "comment": "Malware payload (Mirai)", "value": "568118e062cdbc9f60a0d7451a700481c8b83d255f82ef6dd9d4969a9b116e27a0c80071c03a1372569ce689273d4f33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "c9c31485-01ab-4f65-9c90-62d808a3c76e", "value": "T10BB3194777218F61C7A9D53046F74B667BEE22C626D29446E36CDE203A6034C682FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "f576ba5c-a8e4-4532-99d1-9eb09d7d51b6", "value": "3072:zq3B66IuBvBhe5Ithy+CEwT/TIfZMIBDjz:mx6HGvHGl/cKWvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463699, "uuid": "3245c4a1-ae0b-48ac-a8fa-0300c8842583", "value": 113092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463699, "uuid": "f5ca600d-a694-4a79-8049-0c4ec98ad40f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463699, "uuid": "0f1973a6-3527-480e-8b6c-2cfefd74706b", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d036129-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463663, "uuid": "efff81b5-84ca-4f27-83c9-4a3024036f00", "comment": "Malware payload (Gafgyt)", "value": "33788f24e214fbf43bebe823fd88870c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463663, "uuid": "f331ce19-7e92-4ba7-a9a7-32447920be9c", "comment": "Malware payload (Gafgyt)", "value": "834410da03692bcb79c6259b2bc5091cda7fe48c8f524d02f0a6ba93c4bedf06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463663, "uuid": "f095b586-04ba-4cb7-9147-7925450b71bd", "comment": "Malware payload (Gafgyt)", "value": "6b981a9a87914b8b40bbca76c6b7d5cd1bb78b9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463663, "uuid": "8fa19fec-5d2c-4ac9-90a1-ff6217bbad99", "comment": "Malware payload (Gafgyt)", "value": "b86919cb90c9238ede3981e5974554e64c587b1127e4cc7b7dfa5047a4b314e050256e406927d7b5d71169bef0ab7ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463663, "uuid": "5b6c0316-5719-4011-ab17-f4f0159717a8", "value": "T12973D62B27631E73C0C9157101E30331ABB9DE1538BA579BE9D17EA82F3AAC434167D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463663, "uuid": "304c9807-64fc-4061-bcae-6b22b766049c", "value": "768:oq1c/sICRCItCkRaPI3H4tuKIOr6wPsGnO+N5PE1a+isKyFHoI8S27pACb74E3lI:c/uheIcuKIkNfryFIIr27pACb74E3v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463663, "uuid": "1cbeb056-e6f5-4c40-b865-3d4879f159d0", "value": 73783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463663, "uuid": "1ca9a8cd-8671-47cc-b075-01b0f73de78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463663, "uuid": "67671ea0-7289-4a01-a236-7e878a8bbafd", "value": "cali.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d83f69b-31fc-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775509646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509646, "uuid": "bf647c57-4428-474d-a205-6fa2b7c18145", "comment": "Malware payload (RustyStealer)", "value": "26c34f859b2df19b310d0b2a00e728d2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509646, "uuid": "164d18db-1906-4c68-ad76-3931490baf0b", "comment": "Malware payload (RustyStealer)", "value": "8411aa9e0b428b6e0b7a15cab78a0be4b75fd0b1708bb3592fbaa20e4b03d632", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509646, "uuid": "263c47cd-2da7-4305-89df-e9605cdc96b1", "comment": "Malware payload (RustyStealer)", "value": "b5841fa1e18864291d316832b31abe078e93db60", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509646, "uuid": "494a2923-cffd-45aa-a303-954d33da911e", "comment": "Malware payload (RustyStealer)", "value": "8550e96fb31e18e23a5d68b0c573bfbcda3582830f544fb23eb0e3c270b0897ae6a0b5b4ae72c9bdd4a79970592d9a20", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509646, "uuid": "015df6a9-be5a-46a7-ad38-c8fa19e10a89", "value": "T12D351223769095FCE48EC038D2014AB39E3638D90B312CFF1295953D2D69BE66E3DB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509646, "uuid": "f1124c5d-2c5c-4a35-8649-49d94627481e", "value": "70fa489c6cf677398f8d7945e9b9a181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509646, "uuid": "a3456952-bc64-463a-ad74-83adf910bd08", "value": "12288:hxyukscjTy2QAX09Rz+nmVWj9hxpqn0CvVaCawbX0xPFsJm7pSgEbBHzUWpvP1dk:hxHUi2PX0qYvgaossxExpvfEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775509646, "uuid": "ab860e35-3a68-4f65-9c2a-895093049232", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775509646, "uuid": "e6cb56e1-55f4-4c07-a00f-ae32230da0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509646, "uuid": "f84735f7-6868-4910-8a86-5e93ca4ae33d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290d1068-317f-11f1-a769-42010a9c0008", "comment": "Malware payload (Coper)", "timestamp": 1775455764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455764, "uuid": "3d7e8b5b-5099-4dd3-9d54-f35b05ddaee9", "comment": "Malware payload (Coper)", "value": "513a87f6f31293ef9cc0990dffdd7d0d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455764, "uuid": "63a6ef6f-5055-480a-897f-4f30e5c4241e", "comment": "Malware payload (Coper)", "value": "841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455764, "uuid": "23e3eff5-8ce3-4c4e-8983-36fb893ced0e", "comment": "Malware payload (Coper)", "value": "25471bfe242a46b434f9ee1e725340cc2375997a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455764, "uuid": "d122a06b-3a0c-4814-88fa-1bd6e30d441e", "comment": "Malware payload (Coper)", "value": "ba843058f8b7728fcd4b867b329c0493c0d88b83bb658419659d5dec422058cbbce606b672db00aaf04c12a70bb4a609", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455764, "uuid": "c396dbda-6cdd-4eb0-a815-a842c9633201", "value": "T1F10423835D90786CC6A90D310BC90BB2F6DA2C4D65AAFB462444B5F8AFF38E41F40D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455764, "uuid": "c52a4ad1-bc54-47b2-8ffd-92b4dcb66461", "value": "3072:k5lhQe0qu5d8kbdS65S/ecC2HQiINsYNr/FwLmbRULI6JzHPRM:k5l25iZWDIPIZBRchG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775455764, "uuid": "ec4d8cca-12b8-4b6c-ab95-848abdee60b7", "value": 189275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775455764, "uuid": "0f6d786b-605f-41db-b729-80c0b93870f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455764, "uuid": "bc5a6795-6f6b-493e-a2eb-f48ee6fb64c6", "value": "841e432a41b9625040704fd636d4fc3814a6d4193fa315cd78cfed9aa3991c04.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656b1309-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "aa1e1b0c-bb04-4bd7-aaae-b9093c04ae63", "comment": "Malware payload (Mirai)", "value": "b5f82d7996818f33a826469db4bc85a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "b0ce7ae9-f57a-4565-a1de-85ec9fc2de59", "comment": "Malware payload (Mirai)", "value": "843080aeb6c2f416a2c6d9fd9f26ef9b4fa2e0e4e4ef5fd3e6e95ea3d75fd68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "97b88854-1b6b-43c8-88d3-a07996435e93", "comment": "Malware payload (Mirai)", "value": "f4890f59618bc53bd69a4874c0d515010c1dc931", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442980, "uuid": "71c39a0f-36c0-459e-9580-e1a3e12ed7eb", "comment": "Malware payload (Mirai)", "value": "25362fe045ac5df0b2d3fea2e811d880991e140421992dbd098fd974e6b503904b3a0c2bde5889c58659225645a6b007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "5ebbf95d-330a-45db-b63b-d2212a2d7ea0", "value": "T1CB735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "cd8a45a4-5698-4fa9-863f-74f49c062ca9", "value": "1536:jP+SbCGR18pspTH1GDQ2tXXUN95s0xwlWptCMR8/pW:zf4yV4pENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442980, "uuid": "4551f879-282b-4de7-a3ad-139dd18ae358", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442980, "uuid": "4e88c415-6c09-4e98-af42-63deab166292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442980, "uuid": "6e426cca-27cf-4121-977d-8f92f27c4206", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeb4230-319d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775468899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468899, "uuid": "4a817166-ff1c-4d8d-a6e9-c17cb06162a5", "comment": "Malware payload (PureHVNC)", "value": "cf97ae19f6c1c4574ce6355a9f05322e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468899, "uuid": "0e3a3a99-8f13-4d7a-abed-ecc3476976df", "comment": "Malware payload (PureHVNC)", "value": "845917761e0c0cb41205a2db73d9959c89fb01af440cc44f7c3ba44ff25ee470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468899, "uuid": "1f983d27-b4c8-4e60-8c08-86cce9238b14", "comment": "Malware payload (PureHVNC)", "value": "8cd59ba62cffcd0a06be8c621f308e336f74105c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468899, "uuid": "41407493-47e7-43e9-a236-804b0ff737f1", "comment": "Malware payload (PureHVNC)", "value": "899324ca7d184aac0cc1083f9ca9521ee998acb6e6adc982b52d3b00b0c8619df3956570f6f4668e717f75a733c8a40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468899, "uuid": "7bd359c2-551c-42a4-ab9c-765d01b7f9f0", "value": "T10A8423EEA66C7A3AF35AEB32C8EB149809DDC582CD30D66EB48D975A740730590D0D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468899, "uuid": "95ea55a5-582f-4221-8f58-53fd30e62916", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468899, "uuid": "b86d230f-7480-4b57-b90d-e5184adb40f3", "value": "6144:HWiNAHNFi2pVwtrhMBn4+VqRKOebZGThDgkdS3MWsZA2KzzEK9dgHoRsg:HwpVAFMB+Rb6GdMPvsZaXdgIRsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775468899, "uuid": "d9323f01-3409-457f-9ced-5e5c0100857b", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775468899, "uuid": "9b02d00f-295b-45ca-a9c5-eba8e84bf153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468899, "uuid": "8f70a314-6770-463d-9fd0-a62dde536b2c", "value": "cf97ae19f6c1c4574ce6355a9f05322e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e2328b-31f1-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775505040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775505040, "uuid": "42b36cbb-3ad5-4fef-8f2f-3ca7a66c90a0", "comment": "Malware payload (DCRat)", "value": "bc1e49bcba9492e3b0e039149541e5c9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775505040, "uuid": "4317ce32-30e7-4220-a72c-3e20cb6d85e1", "comment": "Malware payload (DCRat)", "value": "84ae2d417293f0b4719b09b0fc7d090cf5c3349c6f61a2a82fe49698d8f7f88b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775505040, "uuid": "4f8da94a-29be-4551-80d2-6fbe882607db", "comment": "Malware payload (DCRat)", "value": "f1a34cdc9a5d38fc858ef5a8502bc79a413edc75", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775505040, "uuid": "607406ff-bedd-4357-84ff-0fb3c0e3c737", "comment": "Malware payload (DCRat)", "value": "c252d804f27e64668839e673d90df5f8d7482225cd61c81233e3abb3a77cc1efda6825728c73bc3b9ec1afe0bbabb3b9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775505040, "uuid": "301c535d-f5cc-4003-87d8-c7f447d6831a", "value": "T1B92518017E44CA21F1095633C2EF894887B8995166E6E32B7DBB376E19523E73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775505040, "uuid": "7cab1a8c-8c19-404e-a125-6c563ab39e29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775505040, "uuid": "581b9409-d724-4262-a8fc-13322cc0e6ae", "value": "12288:mvuvwwhNcZyl06eHIxY91mNZbzZQ3K7zHtxawLoFEyoEnH23H60:aeFhNVl06eHIxLVvNxawMGkH23l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775505040, "uuid": "2770bd46-81ea-4729-8fb0-739dadc8bc6a", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775505040, "uuid": "cb357cb2-18a1-4d9f-a13f-e49da884662e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775505040, "uuid": "5aa2b836-4077-423d-96f4-52dcbe43b8c2", "value": "084ae2d417293f0b4719b09b0fc7d090cf5c3349c6f61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b710495e-3200-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1775511407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775511407, "uuid": "a5361988-2211-425d-8579-67b1023931ff", "comment": "Malware payload (EternalRocks)", "value": "e82278e376be25249cdcdf54237d676a", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775511407, "uuid": "12fff404-585c-493c-b1e9-c9be4dc9ecaa", "comment": "Malware payload (EternalRocks)", "value": "84b6ce21535041f998e7c21a0d426e8ffab18b7575313cc1b070b3f44db1225f", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775511407, "uuid": "7bb360d5-efe8-4018-b0f1-4eba191696d3", "comment": "Malware payload (EternalRocks)", "value": "c719c8f333e7dc3157afd9fb76050aaccb0f6830", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775511407, "uuid": "8ab205d4-98bb-4150-b6a6-865bf4e3a607", "comment": "Malware payload (EternalRocks)", "value": "3e724ccfab3a225edbe549f9529fd5c280c7ebd2aae28b08342b3606f974360eadc031910b7dd4c81c9fdb56fcd288ff", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775511407, "uuid": "fda513d6-858c-4fef-a255-fe8b33572a34", "value": "T1998533D83A608B61E4987972F725FF42C711DF653A038A1BF8A3315C0E75AC1951BA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775511407, "uuid": "4061e79d-97fb-4a7e-ad9d-4639101298fc", "value": "49152:6wMvknf4J8ctcroHKwzoDmDg2kB6xbhqyHMxHZ:Xwyd0qtJyKyHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775511407, "uuid": "ed599c6c-4282-4c1c-b7c2-f3d0f1d8cbf4", "value": 1708032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775511407, "uuid": "6cc80d5e-e36b-4ad2-992d-e54985622e03", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775511407, "uuid": "a76a0ae0-ce48-4517-acaa-674f9b04c65e", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a53df2-319a-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1775467700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467700, "uuid": "7997d961-0465-4e23-b7a1-a5bf2dee0e13", "comment": "Malware payload (VioletWorm)", "value": "1759675620537ad9d2f477ce78704a48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467700, "uuid": "581c0a4c-4d74-4fe7-a703-7dc1a15e01ad", "comment": "Malware payload (VioletWorm)", "value": "84e03eb7665a140b8769ba72fd95fa497190682e61eef78d6f6ebcacca3867ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467700, "uuid": "b5562eee-11b4-4136-b3be-64e2d0155d49", "comment": "Malware payload (VioletWorm)", "value": "7716a3eecb203ff9bc9022d166f073c0eed367b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467700, "uuid": "87ece601-3787-4b7d-afe9-793a12ce9d2b", "comment": "Malware payload (VioletWorm)", "value": "3235350d29c24fcfc81b7ca9b17f7fe4d2963335a5c7bdb46430bfd7c82748c3df8ff76c4fa088e032765660adeb3806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467700, "uuid": "043e06cd-298d-4562-958c-f8c010e92520", "value": "T19C53B9943673CC32D17EAE76E6C3624F9DB15173AC05D5860CD666E23F02E86C90A8F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467700, "uuid": "d1f9d53d-e12a-4666-9ddc-c306bf6cafdb", "value": "768:gQJdeAd+qFj618aTpCZzSdpUtS1N9Orc9bjyiQpxXdrMQ6rwS+:gwdLsqF61TTpCZmdpUtuj9beimdwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467700, "uuid": "a67b0673-4054-4355-93d0-e2691f869292", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467700, "uuid": "20fcbe1f-fab9-4bb6-ba3f-b2593a5111db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467700, "uuid": "c8fdc64a-b79a-487f-a3a0-10a4dcf43929", "value": "SecuriteInfo.com.Trojan.MulDrop36.47555.10197.5353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2868af02-31f5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775506443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506443, "uuid": "9210d94b-d66e-4d77-ac3a-8757b37657ab", "comment": "Malware payload (ConnectWise)", "value": "e99057081c623be00bdcf732c49e3631", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506443, "uuid": "a2096eed-2971-4903-9060-286308e178e0", "comment": "Malware payload (ConnectWise)", "value": "8533c69884eedbcb068d86c96cb10596422066866386ccf7582feac777478ba1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506443, "uuid": "a5f72665-d59d-4708-be8d-d0fb6c91de38", "comment": "Malware payload (ConnectWise)", "value": "ff2cd03648ea70cf1bec225a80caf18f8c852242", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506443, "uuid": "fc57233a-01f4-4a7d-8a60-3afd8fff27bb", "comment": "Malware payload (ConnectWise)", "value": "977921bac5f2135efa257e8ea9f87572289d1ea329c143faf4202bc7dd41ba565dc6a8432ce5b96763d7c9f20673cd10", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506443, "uuid": "35590060-598a-49ab-9fd2-0c2bfb9ae21a", "value": "T168F6231563F8A109F1F32F3AED3A45E198777C268D22D16F1658364D1AB0EC19AB2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506443, "uuid": "20e608e1-152f-4dc7-98d3-232b751ddfe1", "value": "393216:fmkEdQ03NldmmkEdkmkEdHmkEdomkEdDmkEdWmkEd:9E2cxaECE3EeETEIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775506443, "uuid": "d30a320d-2c3a-4ddb-b963-2c9b0f7c3554", "value": 15851520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775506443, "uuid": "b79a4c89-7a67-4157-92ed-de3d8cf70026", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506443, "uuid": "b07a06a7-13fe-47b2-aa43-4d99aebc76f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bfabad-31df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775497307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497307, "uuid": "b9d6b9e6-449d-4e3c-b985-01a638526f10", "comment": "Malware payload", "value": "9816c26dffb1de17ccb27b64cf9d6da4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497307, "uuid": "18f2b5ca-ca82-4ab9-ae65-0d390ae18c9e", "comment": "Malware payload", "value": "870b4b5601dea77873c2f1b376c13f5d0c90d5f207d7d97fa02a7bc73d77f531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497307, "uuid": "027dc4c5-538c-471a-817f-220b918b2b6f", "comment": "Malware payload", "value": "015616132503ef431e0603ff76debe733fc6df7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497307, "uuid": "e92ac668-1e2c-4d24-b64c-d03e868c7682", "comment": "Malware payload", "value": "f76a707536e9c9e76ed7e0a7435632897453717365fed37f974e2e5538578d30875620c03e972c8fa5cf228a62dab692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497307, "uuid": "a3645b37-7b50-443d-afac-4f8c16cfaf23", "value": "T1D4056C223721DF65D355D67005F3C7509AE620A20FE2508AB26CC3287E6166D6E6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497307, "uuid": "b5558a74-98e6-4b01-b055-08cbf399d624", "value": "24576:CjXxa5MX4/kG5MKGPgLXwSPxONYw9vPujui:CG04/UKfwSPcNYw9vPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775497307, "uuid": "7ac96673-7598-45f1-a7f0-1301adb958be", "value": 836148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775497307, "uuid": "f284de89-9afd-4db2-b02f-0d5230a53cb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497307, "uuid": "2c34a113-f1e6-4cc6-bc31-747ea95c91f1", "value": "clientmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec4edc5-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470886, "uuid": "232669fd-2ca6-40a1-b124-068afd93e291", "comment": "Malware payload (Mirai)", "value": "f18bce0c0daf0a0c32bd216c29cb9105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470886, "uuid": "e966fff0-9c6e-4e17-8523-cdf147764a65", "comment": "Malware payload (Mirai)", "value": "87a20e9209e87b2ae939d37d5d5ef981d7b22442a7e3f525cd4690593cca4a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470886, "uuid": "3192e020-e0b8-457e-acdf-0b52e1034195", "comment": "Malware payload (Mirai)", "value": "b3df96f5cdacf51f22c6cfea1f10c8f2562b5f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470886, "uuid": "7f36ca8b-ad1c-4ef6-91f8-745b86a5f1fb", "comment": "Malware payload (Mirai)", "value": "52f9829297b1c2c0e159078172dd8e2d6b17cc715b4d19b0f6ab24a0f07ccb0c94601758336f2c662e331c51a2f95d09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470886, "uuid": "20d368e2-c72a-4571-ae73-53d68f6db398", "value": "T17B53F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470886, "uuid": "d5d1741c-5408-46d8-8202-f34c08e080be", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pX+:dn3QxJpRISDMKf5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470886, "uuid": "102bbb0f-e209-490c-b517-06e6e0c2a4e2", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470886, "uuid": "50714c02-34dc-4a3e-9e83-9bce5670934b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470886, "uuid": "6411c67a-740f-46ea-a49a-1861d4f558f2", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17c8140-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502432, "uuid": "2a4ce401-669a-4a3b-8286-3a16213e88a3", "comment": "Malware payload", "value": "7534ddbc7f2c3d14e90f1a4aa9c887dc", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502432, "uuid": "8e8ce71a-c7de-403f-b127-ca5465bd13cf", "comment": "Malware payload", "value": "89e2b8859531eb8af52122454d23370cc27fd4dadb0dbc5d530ede1af2f5868f", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502432, "uuid": "bbe81c70-a9cb-4d29-9cdd-0d21a3a198b2", "comment": "Malware payload", "value": "2fb0c4eb93b7da10011e52b20af28ae1d7367413", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502432, "uuid": "fec5c698-99ae-4546-bff7-c1aac0adcb53", "comment": "Malware payload", "value": "75171ab794587a74972712169aee42d1395e8cb32ff3030f596bb79b288fb3c9b652aa60b8a8799b20c298b86d768a55", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502432, "uuid": "21f4deef-8fc4-426c-973c-92b33a24a17b", "value": "T1A0D3FFC8C99E88A4CB1F6528060F9C5A8E9DE327161ED9D0BEDDAF443F116B035BE5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502432, "uuid": "7cd26f1e-3fae-493b-8dba-3ef84db79059", "value": "768:0GRQKAbDOn4GzN2Z9Pbud+ywo2IUtRsbQHeUuwm6f646M6n6XiB5MiJ6MQlU8mT/:tQTHGzN2Z9Pbpocs5hVJQp43jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502432, "uuid": "20b3cf0b-f4f2-4dc1-ac91-9c0323abad44", "value": 137059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502432, "uuid": "cbc088b5-f3fa-4e76-a97d-c9646252733d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502432, "uuid": "90c02684-df24-4733-b458-dc2511d61d30", "value": "External_Delta_Notes_576.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefe3aa4-31ec-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775502911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502911, "uuid": "3a165502-1099-436b-8cd1-b2fa73673896", "comment": "Malware payload (SalatStealer)", "value": "5c0859cbe12b7ac656d0453025433c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502911, "uuid": "8f351384-4d90-4faf-b884-35e772373e3d", "comment": "Malware payload (SalatStealer)", "value": "8a132e7dd4876c87b5c425db32291bd54a2f3a477c78ceb4d29f297867a150fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502911, "uuid": "4bcbf651-b145-43ce-9840-d84821ccb250", "comment": "Malware payload (SalatStealer)", "value": "f9c34aba72b75d1d9d496e944e9d7208f69a89c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502911, "uuid": "88714cdc-d675-4c0e-8fab-b2bfb617a531", "comment": "Malware payload (SalatStealer)", "value": "d93623a3e3bddca0dee51bfd10e6a96cf0ab35d8425ea865963bb33c9cd52ee5c16fe7a3ec8239f6b88044dddbdca3ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502911, "uuid": "23d9852a-ad8e-421d-8f8f-db682adf766f", "value": "T12AF53391C2941139DCA29F7D479466C2E0948612A6EBF12CE7FA896DC17E71BCF7E008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502911, "uuid": "b98c5aff-f454-4c9b-a4a3-6d7740efd628", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502911, "uuid": "91f68ea3-5a7a-4514-8823-9e9a359fde60", "value": "98304:OioUrQDO5aTY04Dsn++2BKusholZnwPQNU7zM0Jdn+oONt0D9kmH:Oi/Q65aTY0lT2MuEobqnVOoDmmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502911, "uuid": "fb828738-9bc3-43f7-905f-633700470113", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502911, "uuid": "8fe4b990-91bd-4ea2-8690-bc7059e03f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502911, "uuid": "6f3820c7-04a3-403e-8cfd-2a2e17ab9101", "value": "uptodate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481be5a4-31a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471278, "uuid": "f34710e8-0ed1-40bd-98f1-ecceb0dafe7e", "comment": "Malware payload (Mirai)", "value": "4f60ce7b579bd69bb0eb96f6be78cb3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471278, "uuid": "0b97ffe7-c1dd-40f2-a551-86a103962a91", "comment": "Malware payload (Mirai)", "value": "8a710e0eac0685bbe1f9f95d63c1406d0de530d44170c115dce6af02380d4102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471278, "uuid": "304d6776-190a-487b-a365-c048b8aee2d3", "comment": "Malware payload (Mirai)", "value": "e4f49fb5310f29056872ffaec05aea98dbee810f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471278, "uuid": "015460da-ff95-4915-9695-6e0527d4065e", "comment": "Malware payload (Mirai)", "value": "5aae0bcc480a0ff7afaf71e515362e5b7d830572e85168a96fa846c75e62fadbf0e6312b48d0c60d9f79eac773e5d0b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471278, "uuid": "5448fbf9-95c8-4fbc-8d38-0fe3329085e8", "value": "T1EE538D75D12DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471278, "uuid": "b3b6a49d-8984-4b58-9c38-59f003d89f9b", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471278, "uuid": "9103908b-c05d-4c76-9942-fdce61e4a47d", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471278, "uuid": "6c3ef32a-6b36-4807-8be6-bd054c432831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471278, "uuid": "74101f9f-f446-4809-9d2d-53ceddbe5385", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37387e19-3205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513340, "uuid": "9c6bbaec-1013-4428-abdf-f818c2479948", "comment": "Malware payload", "value": "f195e582dd2883a9b0d3cea30870f73d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513340, "uuid": "a166b584-6e2a-407e-b597-f1eb0832b3ab", "comment": "Malware payload", "value": "8a77f2d674601582dc10ac9233953952063c504155196227f312919d65b6eb88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513340, "uuid": "b0f54788-864e-40a5-8ae3-09c3db52e75a", "comment": "Malware payload", "value": "2f401f9a5934e706b3c8fb38c72698ff4a604422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513340, "uuid": "12495864-3bdf-4ee9-80ce-06e052fb73c6", "comment": "Malware payload", "value": "d71b9e39210d6a9f6883a204c9256501ac054aba3d57bf38c4424b9d6f78001dede34c448dbc5cf7c018a2087ec189b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513340, "uuid": "71dba8b4-3792-4b8c-82c8-baa88ecfda4f", "value": "T1DB44A49B79924886C8E83A7BBC6DC1C432571BB9A3DE60544E06CD392BFF9DD0A34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513340, "uuid": "ac06bc0e-4ba0-4d6c-98db-7c9a8bc7dd62", "value": "6144:hGYIw6GOBWrA6suKfvjHeqetfGX8C0TssIUqPsy:hx69BCA6sVfvbeqeTC0TPIUqP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513340, "uuid": "7552a840-453b-485d-8a4c-bcf0766cdf30", "value": 271992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513340, "uuid": "ad50d3f7-5756-4ade-8c20-0f90e3129500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513340, "uuid": "dfd56293-4aa7-41ba-95bd-cf840c061cd8", "value": "gofuckerv2armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795cee40-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463630, "uuid": "cd958f65-aba2-4c9a-b152-a6ebac89c06f", "comment": "Malware payload (Mirai)", "value": "1cbc1df92c543a197f2fb8b6cc7893e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463630, "uuid": "5bf36b75-5ddf-4d61-a8c8-8f7fc569add5", "comment": "Malware payload (Mirai)", "value": "8ad69988d52a0d48237113d0cf3ac5b7eab92af3d98f59a761e3c8732f02abd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463630, "uuid": "1e326a01-a6d0-4556-9402-7aee4f2b1d81", "comment": "Malware payload (Mirai)", "value": "7f2b53ae2542fb944612e19e583a32cc2e65dc62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463630, "uuid": "c145c691-0644-43cc-bba5-93ca4e66e9f7", "comment": "Malware payload (Mirai)", "value": "e108424cdeb708350b775a9a47b614738998c9b364df1e6c17bd5fc50c05e1f5de600af55322051075cd9d1081b0f5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463630, "uuid": "0efb03b8-ceab-4546-9bc6-68b4df15473d", "value": "T144333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A02B11B618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463630, "uuid": "11370dcd-ed30-4296-9464-3937e6cec7d0", "value": "768:vwheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98SN+s:vwOt37pOzwLMU431ANA0BLBCGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463630, "uuid": "410956f4-ca6d-44a0-8d55-91b1f0e5d6eb", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463630, "uuid": "e68a59ff-1a72-40ab-9425-2f7c4dd484f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463630, "uuid": "cc8254e1-d900-4a57-8d5a-a559a6464d06", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366a315e-3190-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775463088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463088, "uuid": "c22ac968-309a-49c0-be1e-51b3f6966df2", "comment": "Malware payload", "value": "7deab83bbd37a4e430b50a4149fdb167", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463088, "uuid": "9cb364ec-2440-4356-a727-7c5f0a45cb08", "comment": "Malware payload", "value": "8afd6079e7fe77d4d2527d52738afe38fac6b6aae4e6da9628fd4b88924b5d0d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463088, "uuid": "8394171f-6909-438c-bbf1-d4e084740811", "comment": "Malware payload", "value": "e811be9da8182dc7b92051a49762dcfd2144b626", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463088, "uuid": "80a745f8-c248-4474-b431-056dc2587708", "comment": "Malware payload", "value": "afc5fe83ef00917b0da971f998e77ba47cd1f56a73038f7c8ec1cce1b69c4cf1eaf5970ccd473bb27769e4e3d7e493d4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "test1", "colour": "#2A4CB4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463088, "uuid": "aa8f4a21-4b52-4bec-bf61-001b27b46e82", "value": "T18018CF46F34988AAECD660B8C50B56B1AA307C485362A0DF7E06E7847D772E52F7D3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463088, "uuid": "793514b4-5c38-4cae-ba4a-6879a36ba09b", "value": "1572864:p7+JOMi7C9ZsOA6TeAkN4tKs0IaCR5sb5dN1uaLjB:1+JOWn9eutKs0IaCR5sb5oYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463088, "uuid": "f732ae86-6005-41ab-a634-1d0714778000", "value": 92450251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463088, "uuid": "1c26de44-3cc9-409b-aab1-04b23a4861d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463088, "uuid": "8ee6cb8c-f1b6-49f5-8c0d-68bb6344507f", "value": "application-c041242e-fe9f-4fae-950b-7d39b9999dbe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9b8058-320b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775515978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515978, "uuid": "f6b11c46-73f1-4ef8-8324-00b8be2978ca", "comment": "Malware payload", "value": "8867c6e2ad3161804fc84087ae13a647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515978, "uuid": "75ed2cd2-d805-4221-8d51-658055da0635", "comment": "Malware payload", "value": "8cf6864f239d046d0ca58069f0bc546d94c785e10129817aeb3be706116f906f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515978, "uuid": "af474eb7-d082-485a-9603-330997ec2b37", "comment": "Malware payload", "value": "65712d2250773300d5037f24a738451a2eef7779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515978, "uuid": "918b3e1d-1f38-4d65-8d43-c43e29836864", "comment": "Malware payload", "value": "aa9554fea609cbbfd8491b54c953844d9577873078998a4a754582642d3d86f8705dd6d3f11e76fd607015fe8539ef8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515978, "uuid": "761a2a17-812e-4b3e-b0a3-16697a2c33d8", "value": "T183045BC5A6C3C0F5EA9300F0198F9BEB0935D2378402E6FBD68C2566B5B1B92261777D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515978, "uuid": "af076d2e-3428-4e8f-9d91-8aa02b9376df", "value": "3072:cj29x3UlOTYUeL1HXH0c/LrvFbpu5XqWGh+hv4hRs19LmgJsacR6kzVKmzQ1cUXN:LT32aY/Ua3h+hv4hRs1NmjacR6kzUkkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515978, "uuid": "53768e17-ac3e-4153-a220-9a67f2ea71a0", "value": 176426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515978, "uuid": "f564389c-b1d0-4ae4-8874-116894a643d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515978, "uuid": "bfb35ac3-a20a-4c13-8919-c637780bdbf3", "value": "rsti586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe34c313-31d6-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493488, "uuid": "b4027200-7be6-4209-ac25-a843b8ffe3c2", "comment": "Malware payload (GlassWorm)", "value": "c9c3625f16d0cae7832608c6ba4088de", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493488, "uuid": "6135b5f4-3b58-4a7b-9ebd-7fc113ba2470", "comment": "Malware payload (GlassWorm)", "value": "8e2c3244d3bf412d5be85525d65226aa24fc430b1908864805d2f2e00be28fda", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493488, "uuid": "acc19d55-9048-4492-9de8-d01f09ca160c", "comment": "Malware payload (GlassWorm)", "value": "ac95f0eace02fb354199aa1922a5938447b75cfb", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493488, "uuid": "1a074f35-3604-4661-a3b6-4b18359a218a", "comment": "Malware payload (GlassWorm)", "value": "2a4a2116439582eadc1a0b866f22d80e254a30bde4dbd7bba63f4c16af3ece643fcfc068cfed54f1e3affcdd75e27a5a", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86", "colour": "#9A8E4A", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493488, "uuid": "25e8eb4b-758a-4e0d-a360-524bbc00d02a", "value": "T1CD756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493488, "uuid": "21406cab-f083-4078-b6e9-b2726098e618", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493488, "uuid": "91a6e73f-a894-47e8-9c22-8b065baa49b6", "value": "24576:Ods9Esxlce6k91UOld2LMxmeDozCMZyFF4QEymOCUwPPvAP:OdaEglcAHNaYczY4yL2PPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493488, "uuid": "a91e8bad-98d9-4ae4-bb74-7badd0fab85a", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493488, "uuid": "04537abb-8348-4819-8e76-d014f1693c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493488, "uuid": "9b472e06-3d7d-4fdc-87dc-98a9608d131b", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6680151e-3196-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775465745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465745, "uuid": "cea56658-62ba-47e8-ae13-08ece5483474", "comment": "Malware payload (ACRStealer)", "value": "19d3d48a0b5bb754c40779cc43815f0e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465745, "uuid": "a67e2535-7906-439c-9d4e-7952c63f0fa9", "comment": "Malware payload (ACRStealer)", "value": "91b803dbfab06c7d82ffba8f522a1f61434e3fb052f27a789bac9072378d71b2", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465745, "uuid": "5d3c4406-cfe6-4fc4-8889-c6a74319d2dd", "comment": "Malware payload (ACRStealer)", "value": "00b9d3c369770f902f1f1ce45770c5ccbc98b3d9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775465745, "uuid": "7bb1b5aa-4331-42a9-b5fe-387280f07767", "comment": "Malware payload (ACRStealer)", "value": "91731ac2e38bc0c6f0948250fe80edd74c3976f59630e118bdf39879c1704ac0e1febb1dc833632425bdc0523b6f8a3f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465745, "uuid": "8cbc6620-3e89-4a5c-bb97-213d7bfece41", "value": "T1BA165B07ECB98CE9C099A67584336146BE64BC401B3173D72AE1B7682F737F0A879B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465745, "uuid": "f5fc65d3-5735-4913-ba76-3903ec8d0b63", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465745, "uuid": "ea9a7a7b-2ade-4d44-8449-c61d3e2f5a05", "value": "49152:GgDny6FD/z2+umdEKhyoQ0NkkPKrTxd2Qaj7QchBcU5E9:Gg1qhwiidE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775465745, "uuid": "8b5f3e0c-3fb2-4e02-adf9-3682a582c0a5", "value": 4041216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775465745, "uuid": "9d8b3ca8-cc42-4251-acd8-2a033d309c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775465745, "uuid": "54982304-52f0-4e40-bb94-9d1132cc97ea", "value": "SecuriteInfo.com.Win64.MalwareX-gen.44593227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a534f7fb-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473152, "uuid": "38e7ba50-e002-484e-b32a-b4975aeaecd9", "comment": "Malware payload (Mirai)", "value": "6755641b2090bb6af61b49347e199cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473152, "uuid": "22e7f124-f1c9-4ea3-8dcb-03f36413ed82", "comment": "Malware payload (Mirai)", "value": "91f72f6712a92fc697ef07a6bebc25ef9b8dcb386b8cb50e7a82e23db7248d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473152, "uuid": "0a4249d9-cc04-4d70-92ea-f3c1a662f691", "comment": "Malware payload (Mirai)", "value": "8b3c4fbd082e759ffd7d54cf78ee961900a642fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473152, "uuid": "00ca021f-ed36-43d1-8c0f-00ce58969d48", "comment": "Malware payload (Mirai)", "value": "3c69e6474b9970edffcfd7b74adaf9301b9128a79c47621d18bc42d0a0e9765352ce78eecacb7a7db90e7c276c6945e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473152, "uuid": "1d150a74-5f89-4cb0-9f6d-97fad3742189", "value": "T14393D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473152, "uuid": "aafe20a7-1e3c-4172-b38d-8c5841a50b81", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqBKK:NFjXYyCEx0oKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473152, "uuid": "cd7ee5c3-bf29-4d3d-8cbd-f8aee236fb1f", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473152, "uuid": "ed156972-d93f-4f76-9a18-504800bf1851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473152, "uuid": "1c6b2db3-940d-4b26-8c3f-07064766c449", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7b5952-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463685, "uuid": "78d07e68-c90a-4430-9da1-ecb0397c47dc", "comment": "Malware payload (Mirai)", "value": "9b618e494cf9c0b69371acd184ced542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463685, "uuid": "411bb7db-d4f2-4149-a697-f3ea5266d555", "comment": "Malware payload (Mirai)", "value": "92cf682b91d2443bcd4677bcb5550fa829280c72fecd21a7753a900168e37ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463685, "uuid": "618c37ef-a6bb-4b82-ac62-51663c1df498", "comment": "Malware payload (Mirai)", "value": "d5b4155cb84d44bdaadb99d66272baefb4cbd8bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463685, "uuid": "43ea55c8-3cfb-4538-98d0-038b10d5d545", "comment": "Malware payload (Mirai)", "value": "067842a9623fbe952e5cdc90e0be78948038e14008c4ff00913c6a03e47ced902a326d6f1ac9e42336fac693318b072a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463685, "uuid": "789b1091-30ea-4540-9d37-b6ac4cefc53d", "value": "T193735CD4B20A3FBFD1D72D3D81456B06AF1C9FE4AA43501150F9BA071AF32922E26DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463685, "uuid": "3eff0634-4ab6-4e3f-83fb-fef37a6b13a4", "value": "1536:34zUZDiYVcYNejSQ474EfvPvDGurUYZ+SrvzRNxCaxpeYEQrNV:IyV9USvXnyGUJSrvPxBxpeYEo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463685, "uuid": "1ecdcde6-fb22-40cc-9fae-5f3a3d6b7f44", "value": 75560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463685, "uuid": "6506f87d-1bf6-4630-9bda-8e8407623723", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463685, "uuid": "461a993e-26a7-4897-a262-b2088e2ac8ef", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b7ff83-31b0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1775476809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476809, "uuid": "0d2e16af-3a50-4832-af09-a706da618fdf", "comment": "Malware payload (DarkCloud)", "value": "bbc0312304f531239e3c79d28489a625", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476809, "uuid": "dac31621-424c-4745-bc63-bfa0e5506f23", "comment": "Malware payload (DarkCloud)", "value": "92d9614ae5a083e24cacc58fc67c2130f4dbb397317715c010badc595955f71d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476809, "uuid": "bcedc10c-74b3-4da5-867e-19e64d5564a3", "comment": "Malware payload (DarkCloud)", "value": "2c74646c85d2cb4fe06ecd9959ecf237e7f33d2d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476809, "uuid": "1ff875aa-8b8a-4041-9a39-8078a76d01f9", "comment": "Malware payload (DarkCloud)", "value": "9e1eeb9df41a6f6ff97cf5200eb46386307b4344b8dcd9d2541f381bf1f319176e3a38100f80e3fd88b716a0539c7dee", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476809, "uuid": "91f56582-aadf-49dc-912f-5315064af179", "value": "T1DF75F1407380EA56CDE60FB11E35EA304FB5BCE9E015D2626AE93DDF79F9B621504283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476809, "uuid": "4792c206-ee99-4e71-a88c-ff0c9048f67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476809, "uuid": "4bebc290-33a1-4a8d-8b1f-97df408b2450", "value": "49152:1qUw6dMDrbbhZameoLcBNjAqnpVEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMj:1rw6dUz5uhnPBcMMMMMMMMMMMMMMMMMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775476809, "uuid": "78da6bea-1b05-42a9-b1bc-9be299dead4d", "value": 1610248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775476809, "uuid": "ceaca1dc-9b6e-4f95-9e25-dee94965b0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476809, "uuid": "888efd3f-a39a-4b26-b01b-ecf6ab111f92", "value": "z4rZ3FsSYMVyLvZJA.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4163bca-319d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775468882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468882, "uuid": "26f3586f-974f-4038-b0b6-b10748c7bfa0", "comment": "Malware payload", "value": "d04ec24fedf6f99528d1bb0f78cb230c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468882, "uuid": "cd7bb981-9ad5-4f3d-85f3-69ac5f4d2864", "comment": "Malware payload", "value": "94b348d22e72efa570e0ce9319001619cfa6b6dc358c7d6bb728e0a52be6ede1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468882, "uuid": "e29d4b8a-2aa4-43af-a942-3493a6848188", "comment": "Malware payload", "value": "f47c3f32d998ccc538edf67b9b4acd31806bcc8c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775468882, "uuid": "b2b93768-34b0-491e-a129-92f6a43c6869", "comment": "Malware payload", "value": "d519a60cdb408548b08c86166c33d72ea77c31ff7d914f7f8a36c406427be025e423621b69d8962e2bcb6a8102be1745", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468882, "uuid": "a2af3065-f7e7-4269-a736-0611304f6408", "value": "T1F9449F8552C6A5DBF7DCABF3ED943CAC033779B4B8B79045A5E28B1096173D0928DC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468882, "uuid": "9701ce6c-cb36-45a5-9d46-d17cb3fa05be", "value": "eef9792b8e6ffad06966ced4acbf6014", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468882, "uuid": "76f189aa-c686-4fe2-844c-8d1d8e4fe837", "value": "6144:FChrkypXwfL5VNNollSybo5Tr8cxqB/DmLi:F6wy+L5VKSUGTjoVSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775468882, "uuid": "3b93d607-2023-4158-9cb4-3bfc6713a18d", "value": 263096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775468882, "uuid": "52db255c-a94c-4a6c-a71e-e00ee25d87f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775468882, "uuid": "8fe5bb6b-33c4-4a8a-be18-0338358114f4", "value": "d04ec24fedf6f99528d1bb0f78cb230c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f9a57c-3188-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775459589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459589, "uuid": "084d05fe-a117-4d09-a64a-e02ed36917cb", "comment": "Malware payload (PureHVNC)", "value": "00c1a338c50698f3c4e9a0221253c886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459589, "uuid": "0bfab449-12dc-4edd-a211-5ff4d07d27c9", "comment": "Malware payload (PureHVNC)", "value": "958a1baba7679f4e3e775cae79d5d86f5acd04bc08c419b09ac5a3808a3b888f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459589, "uuid": "be734b46-58c4-4ada-aa48-158ea855a352", "comment": "Malware payload (PureHVNC)", "value": "4bd87d507301308a34cab0847281211ab686239f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459589, "uuid": "6776ae16-26f0-4305-bae1-e8e476a1b5b3", "comment": "Malware payload (PureHVNC)", "value": "347eb92ace4dac8511dd2f40aa4a673552252c01bac8f51597417d220523f9a72c8eaacee69de8e4f63225c2b85ecb6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459589, "uuid": "2bd5406e-f77d-40d6-93b7-08a9ca924bc4", "value": "T176E4BE6B76534E12C2845333C1D76A0093E49AC675A7F30E75C913A7190A3FADE4BAB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459589, "uuid": "59e40ce3-c8f5-4b80-b244-ef00f7a690d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459589, "uuid": "708b12b3-da99-4261-822b-82b86a5cbeaf", "value": "12288:Azsbu+bNSUBZEJ1P2topJobMF+NYDMEe6c:AWu+5d85coIM5MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459589, "uuid": "c25e67f3-1efe-429c-9183-3451fec49a1e", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459589, "uuid": "42933076-a35d-4ac3-8757-c604a9a89cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459589, "uuid": "322d5778-7127-4ad2-b14c-92c2a8f4959a", "value": "00c1a338c50698f3c4e9a0221253c886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d08b1fe-320b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775515981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515981, "uuid": "15a838cf-2fa5-4450-bd25-124e987ae9ad", "comment": "Malware payload", "value": "fd23a92734ca8255ba9c7ff023e547cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515981, "uuid": "ddc248ce-54db-4209-97fc-41efe6118f34", "comment": "Malware payload", "value": "959bab62649d6186ecb1906368820fba1d4d50e59efcc161e0e0f9cfcc2a14be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515981, "uuid": "f6bf39ea-9d20-4fb5-af63-e6c7c31cb63b", "comment": "Malware payload", "value": "b92161cdb305f38eccfe2fba65aa2e6fe2c277ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515981, "uuid": "7bf5d6e6-9155-49a0-a0c3-f9965f437287", "comment": "Malware payload", "value": "6b57c4aa549eff0c7fd61987d94a6fe07ae1f552f97e9142c324b4e63fdb32a000da0ba170b2c2fb293f8b247d334806", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515981, "uuid": "46de82b0-21d7-47d2-ba1f-31338cfaec30", "value": "T179054C02FF805FEBC49FCD31496EC34711EDE4834AD1662A71FC4B8CBA9965A4AD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515981, "uuid": "25ccf45c-caff-4d2a-b513-f88599513080", "value": "12288:Qc9aSWWDIxqEneZJKjKdFbKCxCAj/iIScOe7v2ZH1ruNc3rFrnlV90bVVvbNb8jo:oy4+78jfIDk5fRvXV30kLFKvxJju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515981, "uuid": "7c745784-0d34-40c2-806b-ef1c57f76a17", "value": 836052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515981, "uuid": "9d81c9c7-7e17-40b2-b46e-724969dc582f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515981, "uuid": "ef2fc9ef-00e5-4655-9de2-d5d093e55846", "value": "clientmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a076ada-320d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775516862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516862, "uuid": "70e7917e-f51c-4b0c-968f-03c7fec1ad34", "comment": "Malware payload (Mirai)", "value": "6d02fb24a3f93d8f7e104b1257710b47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516862, "uuid": "dc0cb119-adb9-4237-bde6-9a4c945bf615", "comment": "Malware payload (Mirai)", "value": "95b1e7250ba202d02ea7ff2c8e2ddb53375680d5e131bb8d0f88aee788580ea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516862, "uuid": "f413d29d-097b-4e6e-b1be-db7316cf180d", "comment": "Malware payload (Mirai)", "value": "3d07e782ce08b6a9b66f3e7add97646840c69cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516862, "uuid": "819fcd69-ad8b-449f-9d00-efd5b110b23e", "comment": "Malware payload (Mirai)", "value": "c05dcefc8bc9b3eced301169c5086ff858b1a5b9e1669261caaadeaed281ce39bf1757e72af05f2aa45e5675422eb8e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516862, "uuid": "69e15dbc-c95e-4e90-b9b1-a03dfbcf7918", "value": "T168A32A86B9418B02C5C211B6FE6F554D33136BF8D3EF72129D24AFA423874E70A7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516862, "uuid": "1d4e465c-0143-4be1-af4a-da65a5d650a6", "value": "1536:SZnU7xmcgipuTL655/fl71UVmdPJ2+KWuAGlI8Q6eimKuyB08Rz0KgPhgLno+sbN:1J4TO/OAaub9KaprRe7Ri2BiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516862, "uuid": "849250c4-f8db-4ebc-a3c9-a503fb896b22", "value": 99012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516862, "uuid": "7c584440-3bc4-45d6-bec1-1ffe398a7139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516862, "uuid": "ee61211f-0757-4c43-ba9e-e404ce006570", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834b6c29-320a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515615, "uuid": "bdd1e5e6-d4d5-4da9-b9f6-b04b4c743c15", "comment": "Malware payload (Mirai)", "value": "8cf13289e1c4f917bf9e09f33430f6ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515615, "uuid": "21c91011-0b64-4d7b-92ee-4e8bac70dd68", "comment": "Malware payload (Mirai)", "value": "95c5ef798d621b7276f1dbe0472be6fbcde157ec6f64e9c8a8763fe4c203b145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515615, "uuid": "089f9106-0349-4a3a-9b0f-9eed1b12c80d", "comment": "Malware payload (Mirai)", "value": "5ab5543101528b10f13b71a58174106542ce7bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515615, "uuid": "f4e37753-aa23-47e3-be52-877c8c5297a3", "comment": "Malware payload (Mirai)", "value": "bab2c6fb3476e9600cbe9931e3c2105f462419c89322933e127f856a03cd140de52c7242e1ad88fb6dc18c9b091a38ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515615, "uuid": "ea601eab-0040-4a1e-8b57-07c84a5c801e", "value": "T1F64423D8DE83B49DCA1DFB21353F928B71FA191AC618FA18610F10D93AF76F525842C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515615, "uuid": "55d44280-eb2a-436b-ac54-726575e66bb3", "value": "6144:lFDVFEW/3LN6ruLJYgIHDcKksbOqzuv6+tHHWlFn1z42K1F8MX:l/RKAYgiSvn6n0FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515615, "uuid": "f2313b88-9aee-4608-b904-7fdb00a917c3", "value": 276124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515615, "uuid": "9d092687-0fc3-46bb-985d-01d3e91e3f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515615, "uuid": "15d022e8-31cb-4e80-b1fe-740a1d0b9d58", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7140c7-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496953, "uuid": "bd33d984-b154-4ff6-a4da-6bc2d35533ed", "comment": "Malware payload (Mirai)", "value": "75759a5f58eee35f1272914c8676e5f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496953, "uuid": "246629fc-492f-4cf7-801c-2a0c734e7eb1", "comment": "Malware payload (Mirai)", "value": "962f133199e03302d19d153972f3ae54bf4086ef1ee583847b6b301830059b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496953, "uuid": "83664aca-a560-40d4-8df2-8b9a9207fb74", "comment": "Malware payload (Mirai)", "value": "d4300dc5641a22e8a652776a70ea8d36397437d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496953, "uuid": "babe09d3-0e07-40dc-9406-2201e72b0678", "comment": "Malware payload (Mirai)", "value": "d481bc76e225bc695c3818acaa04d1485547c48d71d6d5990744938b4110eca8246649cd6d782f6a4d0df6e7cb4d696b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496953, "uuid": "ccfd92a3-379a-4be6-b7f1-29ea6b33729b", "value": "T17F246C077F554EAFC29E82B21AE767308713F03A0767E7CF675869A41E0A6C43F49609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496953, "uuid": "aee50c7f-6058-44ad-a0b7-63550356f86b", "value": "6144:fdgWWMpzRfb7hSe6TLhDf7wIoLl9XGphHVLWZEfAOE:fvWSzt/ge6Txf7toLlFGphHVLWZEfAOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496953, "uuid": "7637e54d-d2f0-480d-9cf2-28035ead280e", "value": 219695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496953, "uuid": "30a4055c-5f2f-4778-a230-c1f1dc333e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496953, "uuid": "6b40568e-1d6c-4383-8f3d-9744d4355d42", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3206431c-3175-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775451484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775451484, "uuid": "0974ecde-ea83-4b6b-8b4a-fe1b708b10e4", "comment": "Malware payload (CountLoader)", "value": "dcec0e8a243664d310f99b847c75b864", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775451484, "uuid": "1e6ab308-eb91-4ede-8a69-4e6fbba101ba", "comment": "Malware payload (CountLoader)", "value": "968a2eea5410179d80bc792a42b180ac97f0c34323ce6f43c435bfaa72b31dba", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775451484, "uuid": "4fcb9403-4afb-43ff-923a-f2ab5bd669ab", "comment": "Malware payload (CountLoader)", "value": "81888139c12062a2d20e8feddab58afe77985745", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775451484, "uuid": "835b09b6-2ead-4ead-83f4-e2b573601ee8", "comment": "Malware payload (CountLoader)", "value": "05ec834eeda2af477fff79aec3f803191c9817b1e455c21d823d1de2a2fba85f4d98a905b1a46c2c14469e3a0dd6da35", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775451484, "uuid": "808af9f7-78ac-417e-90e4-f99260ab1805", "value": "T197E3539D589F80DC13F3646946DB1C63EBA4422B830CC29E77EEDEE16F168E064DD198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775451484, "uuid": "680a0d70-d568-4091-92c5-31e560a28083", "value": "1536:PcIIITMERCbUa1Ia1ja18a1wFt5Lj2PsXtzeKUQ/FHHeojh5iCY9P6:EIIIGbUa1Ia1ja18a1et9tPhiCY9P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775451484, "uuid": "b34b002b-f376-4fb4-8afd-63fd3f84695c", "value": 144427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775451484, "uuid": "691806a7-1f44-405b-ad86-3dada4fac670", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775451484, "uuid": "5f9003b7-9386-42ff-b691-d813c87da29d", "value": "Session_Raw_v2.0.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1578488-319a-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1775467696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467696, "uuid": "c0123163-696e-4d7e-8140-a66e0a7320f8", "comment": "Malware payload (VioletWorm)", "value": "d8943f8b04a7d27810691f542c341fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467696, "uuid": "31d4c586-301b-43e3-ba02-071570b12d0a", "comment": "Malware payload (VioletWorm)", "value": "970dd62d5d6e8996defbfda6eacef182820b91aeddcce0845a2f727b421ac9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467696, "uuid": "ea8f5a8e-e7e6-43e4-be8c-8cf360026104", "comment": "Malware payload (VioletWorm)", "value": "51c866ba2970a726600235e3c996e19101ae2578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467696, "uuid": "e2007dc5-39a4-42db-b919-8643fa197d20", "comment": "Malware payload (VioletWorm)", "value": "2e08e14617351b9e7fe14ca46771570c5634f6001b77f32ec9547af334f866ab1cf97095b72081e0140522d656b77580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467696, "uuid": "5a2043ec-d4a7-4366-9332-4e885dbb939b", "value": "T1D053B5C532778872D27FAE7AE6C7624B6DB54073A901D5460CD277D36A02F82C90ACF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467696, "uuid": "84c95776-97d9-4dcf-96d1-d7ffc58b4245", "value": "768:qhQXs5Bx2EOwnynarOopWUEy8i3D9bSSEASoQom1aCu5rsd:I+sR2ELnyn0pWYXT9bSSEAm1ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467696, "uuid": "b1b02839-59b3-47c6-8f02-84ad6f87f815", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467696, "uuid": "0cb4518d-1d87-41ae-b074-0eda62e76b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467696, "uuid": "e088ad62-8b1a-47bc-824f-a498c1fc0341", "value": "SecuriteInfo.com.Win64.MalwareX-gen.57635443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89877393-31ad-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775475683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475683, "uuid": "3285818e-7b44-451a-8252-0ec6971db8aa", "comment": "Malware payload (RustyStealer)", "value": "289c000a9b9adc086f887eb4311867f2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475683, "uuid": "289c7d5d-00e6-45bc-a302-fafb43535d95", "comment": "Malware payload (RustyStealer)", "value": "9957bf9bc95be77c84f83546d37ec3bd81877872f2e18e54adc014c541da3c6a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475683, "uuid": "b25c4c0c-998c-4d89-9fb6-9c97225a06cc", "comment": "Malware payload (RustyStealer)", "value": "b9d1e6d2f08fd94b8d3ca779eebf491188fc386e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475683, "uuid": "efe8cb42-28d0-4a47-b4a6-a11795d8a224", "comment": "Malware payload (RustyStealer)", "value": "2f93e053c9a92704e4e7e888eae5bf6e7aacab7c1110cfdad09f810f095706aab521baf077e4e59f47e7508e73a341c4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475683, "uuid": "32bb77df-5f6a-41ed-b935-41ddb66f3490", "value": "T14644B01676859DFAE505C079C3058673AB7778CA0B22F5EF229412383E1BAE51F3DA1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475683, "uuid": "fe8837e3-3bba-4fcb-aa39-d035ec779b0f", "value": "0c042f3b53d54eff2d68cc1904410775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475683, "uuid": "aa8eebc4-de38-49d5-b8f8-9f7acb1157bd", "value": "6144:GD6sSFCvbr62Fg/67fywlyX/+Vtp2mzphD:Itv6BA4XmVtp28n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475683, "uuid": "a59d0839-c679-4841-8b07-8b433bd15a0a", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475683, "uuid": "8378462d-58f4-4532-8da4-546066138f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475683, "uuid": "5f338482-daff-486b-8f40-736726d5309b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06818ce8-31d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775493931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493931, "uuid": "8caf23f4-cdbb-4dac-a8a8-5517e63050a0", "comment": "Malware payload", "value": "63dba2eee1d7f86532782ecdc6b263f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493931, "uuid": "2e731044-26be-40a2-b329-e3d61f46de30", "comment": "Malware payload", "value": "9970768b6d8b8e09af45971faf2ad85a626744acd87c1c771f55a6b5b124e048", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493931, "uuid": "8b2ea323-0abc-4a26-81bf-d52556208f48", "comment": "Malware payload", "value": "c79bce6c26b619ab3b815cbad7a7bbd8c73eb614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493931, "uuid": "b10877e3-bbbb-48b0-ab4b-35e56a0973b4", "comment": "Malware payload", "value": "cb41f1e465a9d2ba659e87cf2a3257965642ceda12dcce12409c0204ac3e468504416a1192ee55d6a70e07ef8e169b4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493931, "uuid": "3ec87364-8916-475e-ad2a-1db1529e24d9", "value": "T1B5054C02FF905FEBC49FCD31496EC30711EDE4834AD1662A71FC4B8CBA9965A4AD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493931, "uuid": "3c9dcb3c-07df-4a4b-9d07-b3da69c71ea4", "value": "12288:gPJRyqYUWxYSbLICfYbyV0zC9xi576W2L6i512DPs2U3tzESurKZaH7cY27W+PyI:YHFNgw17fubnEvmgNaawQVS0vPuju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493931, "uuid": "b63140eb-a502-456c-9c6d-65f96db37ef0", "value": 836148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493931, "uuid": "4231e515-4655-4bba-8d8a-c150dac4db32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493931, "uuid": "e86f6c92-e9ad-4baa-9c74-4dac21cd2d83", "value": "clientmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d539292e-318a-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1775460777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460777, "uuid": "76ff12da-9715-4e8a-a45f-0771a05f0cf0", "comment": "Malware payload (WallStealer)", "value": "b245b189aa9eaa927dadbb6a746913f8", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460777, "uuid": "6662a86a-7699-4f39-a1f4-d1648ecf01ed", "comment": "Malware payload (WallStealer)", "value": "9a101d57d231d3512bc45277157a7cb58788cbce7a035a5919e224c5d82e74a4", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460777, "uuid": "af31be3d-d114-4756-b72a-5b332385b55f", "comment": "Malware payload (WallStealer)", "value": "b5be6327a2cc25054e34727598298875fde66a82", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460777, "uuid": "be7c9183-4b01-48cb-940f-3b2e011951ec", "comment": "Malware payload (WallStealer)", "value": "e7c16163936e5dd13ffc46cad3d6ab11800b819afb95ffaf1d201a261e4e0aa942dc983c4f6ed6fe3622bac074594342", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460777, "uuid": "8802d446-1777-449a-859f-151f4ee5a39f", "value": "T10D46F102E6961ADED477C0B8C5102A67F5FE78340B28AA776BD80BA42B53B3057FC745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460777, "uuid": "8d82b06a-8e25-4c89-89b3-c7b195539038", "value": "2cd7138dc016c7173c6e27bc2bb50895", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460777, "uuid": "f60b2825-09df-41f5-89b7-01eb2d9fdd37", "value": "98304:9uPThJNG4VXQ808lDSgvbpZBteSEJ/OcaeyhmXF5k:gPThLZQJ8lDt1deFH/yhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775460777, "uuid": "c3be8618-c7a1-483b-8c5c-94525a166874", "value": 5435400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775460777, "uuid": "c8e88de2-aedf-4af9-b412-129dcb3d8d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460777, "uuid": "36efea58-3dac-4f15-87ce-b0788b802fec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d906200-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463690, "uuid": "d9b4d8e2-97b8-4ca8-9e29-1d51ccb63d0d", "comment": "Malware payload (Gafgyt)", "value": "4572c92e3474bba29325669406a7b006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463690, "uuid": "92052d85-f06c-43f5-a5c7-928e0ee06b17", "comment": "Malware payload (Gafgyt)", "value": "9aab0662f38035543a56c12d12d75903550f9d89422b30f35861af37a3d7736a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463690, "uuid": "0826d28f-1d18-4312-8104-93b44fb4e252", "comment": "Malware payload (Gafgyt)", "value": "cb8823ec7447567eb5490f261a7f50a3d1d29b60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463690, "uuid": "8e3d7193-4b9d-4fc9-8a9b-c94156abf7a1", "comment": "Malware payload (Gafgyt)", "value": "f111f9e059cea097b69a628c66295863e7a7f08ec7aca2565f4275d07a3ce816f96e9231d3476e7510e19e36b2dd2e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463690, "uuid": "525c3460-383e-4dd8-9ebd-b3af38a14c66", "value": "T101331841A281E6B3E48306F501DFDA590232FD3E5B279E67F35C3DB88A355C0622779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463690, "uuid": "063ecb79-3ea4-455b-b826-75277774512f", "value": "1536:HGjtjXoP0N4O9cT2NiwTEVQ11f9A7pd3CP:mjK8NE24w7TS9d3CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463690, "uuid": "d7ed9f31-078b-44a2-a7da-4ff450adc11b", "value": 51412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463690, "uuid": "98a7fc30-4d0d-4c8c-bf89-1cea4c1e5372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463690, "uuid": "390c13ee-b857-48c7-bf08-479d1f58ecf3", "value": "cali.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e3a4db-31fe-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1775510305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510305, "uuid": "6edd1146-5673-405a-8838-cce5eb196e87", "comment": "Malware payload (SyncroRMM)", "value": "35466288a476acd17161609204bfcbdf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510305, "uuid": "d5dfe9ff-05a5-4fde-9c8e-f3dcaad7337d", "comment": "Malware payload (SyncroRMM)", "value": "9c0bec8ff0e960ec82451572b42a798314e0a8bdb32fdf8ee4f9f2dea62d0cec", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510305, "uuid": "11ec3e71-0012-45f0-bb9b-241ae93554c2", "comment": "Malware payload (SyncroRMM)", "value": "b0e2f0b5c544c128448dffd27a6a2dbdb480afc1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510305, "uuid": "dda685d8-9f9b-43f1-87e4-47dc82233fa2", "comment": "Malware payload (SyncroRMM)", "value": "0cddc5066286a01cf91a0af19f1f4fe32ca58dad7621297e17b20a72a38ddc3af2f97c6ecc535bf6e30aacc1dfc3ed8e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510305, "uuid": "98650876-c93c-4b22-a891-8398355dc6f9", "value": "T1D4663385F4C05A3EF19ECD750CBAB628041B62135B205ADBF34B0955EE20FE249FE6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510305, "uuid": "85a49afa-55ce-419b-a642-31abc8d2b875", "value": "196608:tEx4kBtzkqeUc0WF8RBS5F6xYmQHRi0Q7zO1wKfLR9I7rwa:tEqkB44BS5sxiRi521lfLRex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510305, "uuid": "fffb7e11-19b4-4a22-be98-9e73ec3dd56b", "value": 6682112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510305, "uuid": "10cb78a8-9630-4040-a454-25a8a431db96", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510305, "uuid": "501e0ca1-7169-4511-824f-62daa160ffd0", "value": "SyncroInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4d19d2-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501435, "uuid": "89a85386-3f06-467f-82b3-5585980fe672", "comment": "Malware payload", "value": "a80aafdbe37da585348e964e9b0265fc", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501435, "uuid": "5525c59b-c150-46c1-9738-46ba478e31ab", "comment": "Malware payload", "value": "9c941b343d4406dd24f030679d7fa5b1096bfe9e277e98f7cfc2d74eb2eb7f61", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501435, "uuid": "8d82b31c-c170-4c9d-904a-9bd074102fc9", "comment": "Malware payload", "value": "e3473c76dcf8330e2305ddbd34a2435be5b0e467", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501435, "uuid": "b405ff21-a657-4c60-ad51-2f00e8578e72", "comment": "Malware payload", "value": "51c558cfca8e57b2edb1943754d7cd86e41f5071a6f546b434f0bdd9277e589d2eaac1db4d49489feda484f863b5797d", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501435, "uuid": "cd874361-3c41-41f0-9256-06238d488492", "value": "T1DC17338B6664A469CE772FB3923945F35038CF3DE3694C1738EFF4A61DA2D64A411E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501435, "uuid": "d0450dcd-4319-41b8-acfb-9f304dc929d3", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501435, "uuid": "edde9774-0acf-4cc5-a362-9c01905a44f4", "value": "393216:uFE/p+tT+DBG6hCowKcyh3gv1FHsZ+hIlUgQPpU15Xz6KjpoY7lDdEb:uaQ+DBGRpKSvs4Iwezjd//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501435, "uuid": "ca57b62b-6a32-4e70-9cbc-56e55b2b1074", "value": 19760128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501435, "uuid": "f4954abc-8b10-482c-a944-3e51274378d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501435, "uuid": "3a90344c-9c67-4f72-98cc-d42fa502947f", "value": "Installer_v4012_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e894471e-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496887, "uuid": "54c05fee-907f-4fb6-b4f1-599cf164c20e", "comment": "Malware payload (Mirai)", "value": "952ce182485b1247e4012ad5a473343e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496887, "uuid": "3fd4f40d-2111-4564-aa54-1f02ce694019", "comment": "Malware payload (Mirai)", "value": "9e06114730f04aeefdb94b94d0fef7b3a9b1d40e010ad22d2ca1335610c26279", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496887, "uuid": "068b48d0-2bd3-41af-b5e6-a6afb401fcb3", "comment": "Malware payload (Mirai)", "value": "7450b7ef382751f08aeb423eaf937cd3b564d7a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496887, "uuid": "9fe90353-3f7e-4bfe-ab78-84207106751e", "comment": "Malware payload (Mirai)", "value": "8726a8d62dd2960cc650fd7f1e09185227fe4ecda5354c956cdf778871c69046decd0813ada4d89157bf290c4f63fbb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496887, "uuid": "42c05250-1811-4981-ae3c-6970de350c7d", "value": "T119A30802AF611FABC86FDDB306E60A06348C7D5732B527757974ED28B61A1C70AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496887, "uuid": "3fefa1e3-c8f3-4426-97c0-4c77d076e749", "value": "1536:x2Lw+IgE8Wrv2MULvlm4ZAo6W+UGfxD/yLN1/rnZS9bHf0anctXc3WEC/K:xew+7Vvl5ADa1znssXyC/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496887, "uuid": "2fcbd308-4cf7-4560-ac2e-7837e196c5aa", "value": 100168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496887, "uuid": "49837f30-4e2c-45e6-9bf5-00b44089dc37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496887, "uuid": "f921f6ea-340a-4d31-962a-ac43020d7c87", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55476a32-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502224, "uuid": "9b059891-893f-440e-b9e8-84b0a81184e5", "comment": "Malware payload", "value": "1ae79088b3ff0af4bf95d65911491ca6", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502224, "uuid": "560c4dcc-6d1b-43ee-93a2-8bbb434f04e8", "comment": "Malware payload", "value": "9f5f647d3adc8ebb87691d91c79d6f32399bcedba3b79a8570b384807edcfc72", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502224, "uuid": "7afa3746-a1f1-484f-9067-26b137791ed0", "comment": "Malware payload", "value": "2f8e729e19abe879b1e8d90f3e7eeae4f73ce949", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502224, "uuid": "a6af4109-2f79-4154-993b-7c61f29a082e", "comment": "Malware payload", "value": "22be3a689b5ded5a1a2f5a2220ddbbf9a186468e1225ba655127e660c00d16f7c2d156fd9c79e0a43988791292ab6f91", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ai-latitudeprevalent-cfd", "colour": "#67BAC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502224, "uuid": "e87ff6ce-542e-48ff-bb2d-6a539ef979a9", "value": "T1D0F6BF21F505C132E8F611F397B96F6556ACED34272692C3A2D83C995E31AD32B3930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502224, "uuid": "e44f2640-62d7-4ec4-8dc7-df89a8f03805", "value": "b2a93297c823b89942d5a78509c4f6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502224, "uuid": "92a0515a-3555-4132-bd83-62b10f93eaa8", "value": "393216:k/EyoFwI/UOdyRLjqkmbBDrta60HYUnuedxO0g//NuPyEMO32ovqo:kMyUXdyRLjqNbBDrta60HYUpO0Q/NuPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502224, "uuid": "71cd3128-d1ed-417a-a927-746b4ac708fe", "value": 16006344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502224, "uuid": "b620becc-87d5-409f-a093-a7d50af14fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502224, "uuid": "cfd51d43-8e46-4135-96b8-fa977b293833", "value": "python36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb99506-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463694, "uuid": "51c0ce1b-5d7f-4419-a34b-965768230e35", "comment": "Malware payload (Mirai)", "value": "c71bc0cf947be9c1920cb04dd66ad05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463694, "uuid": "a85bb16d-3a96-4074-a7f1-60219c3fd58c", "comment": "Malware payload (Mirai)", "value": "a03d4a24bb8c2384cc89bd6a6ae6c9f6d6ef9d4d53ca1f42ebb66bb5c5347da0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463694, "uuid": "5b3606ab-20e8-4522-8c18-20a17224a01a", "comment": "Malware payload (Mirai)", "value": "6e0233b4c72bbc5304d9a0c2cbba955a821ea161", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463694, "uuid": "dc8cfe1f-70fa-4514-9fc9-9aa37dbc83b9", "comment": "Malware payload (Mirai)", "value": "bbda0e83138c3dd9798facd2eb3acec7db0875a98ca6e908ad9813c73c7e4923584802e0ec72cab20278017c742eb0a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463694, "uuid": "49700d26-d2bd-487b-b58d-b75b902d1fe7", "value": "T105D3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463694, "uuid": "eb1a514c-a8f1-4de6-9602-46e964d4b869", "value": "3072:YNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQ3J:xHy5ct8/cyiWuVosLDGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463694, "uuid": "f38feb41-5a60-433d-86cf-723a91b27036", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463694, "uuid": "c5bada64-14f0-47be-9abd-150ddf847099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463694, "uuid": "7d4300a8-6063-4055-b999-670ae51e20a7", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded7048-31e0-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775497755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497755, "uuid": "2e35fd60-f075-4a93-b9e0-0f440547f6c1", "comment": "Malware payload (RustyStealer)", "value": "1fa6526b6e8ec8cba021e0986129b59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497755, "uuid": "d19262e5-4e14-47e7-84eb-fc5642d7393e", "comment": "Malware payload (RustyStealer)", "value": "a0bd82e4c4e6b7a263d3ef4eb2c0264ea2376383ff88d813bc7b927987a55830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497755, "uuid": "862e30ca-914a-4b38-a9a5-09dcff5d3d76", "comment": "Malware payload (RustyStealer)", "value": "4b869d84cc4ecea04aa97121b268f71ac199a950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497755, "uuid": "758f26d4-b872-4492-b591-cbfd28f23ef1", "comment": "Malware payload (RustyStealer)", "value": "70d6bdf65fa57284e48e35c2ec52df770758bef1da7f564e403e1c327198e4582220966d0dcb4694809707640fabda22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497755, "uuid": "168fe706-b7a7-4214-a926-6a8f5c719b59", "value": "T1AD567D03F39291EDC02AC0759355A333FA72BC89433576FB6B944A313E56FD06A29B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497755, "uuid": "69f309b6-2723-486f-a26c-8aa97027cf3a", "value": "a5a024fc3f11acfe721776107f7eaa8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497755, "uuid": "cfc68363-5cb6-4b72-826f-1cb4bc835e1c", "value": "49152:ElF9jzZrr/JLeNdCP5Y6nAF4oTQR+qowM9jIQ4E98EVEqXEd2gV+wfdFt4nt/+w7:URdTPK6AeoVHi/D+o9wH9TSwFbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775497755, "uuid": "c789013c-7d56-4738-b219-7aa93ff5bb5d", "value": 6443008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775497755, "uuid": "f18185d6-041a-42da-8104-5986eb3023fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497755, "uuid": "57ce5309-22dc-4c29-984f-dedcc928be34", "value": "app1_v1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3df00d7-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496906, "uuid": "465aceac-fbba-49fa-b9ad-743e553e16ac", "comment": "Malware payload (Mirai)", "value": "cd6a971670fb7d04e1ba5a3937cc4e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496906, "uuid": "74b82b53-d297-478e-924b-fbd2982200a2", "comment": "Malware payload (Mirai)", "value": "a332ab508d4b0e6298ef510e649ffdfa9a4944424a486ec6a41a2b805da5ba2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496906, "uuid": "ce329413-5d8b-462e-8531-b6b41ab81f69", "comment": "Malware payload (Mirai)", "value": "c0b6cf7a717ca43a8bbd63e5bf819fadf6c06b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496906, "uuid": "18dcbf32-b484-4c1e-ba25-4cd724e38e11", "comment": "Malware payload (Mirai)", "value": "186ed69a89f19d52d05e9930046bc5112bb1ea26e7285ff57530b8737dcfbb8c33be663295c45de45a7ff38940b5d9d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496906, "uuid": "ddce44fe-1391-488d-92c8-7defe1fbb25d", "value": "T145733C07BE82CEAEC557C2F41BF766319922BC3E0973B2DDA7D4BD922A45DC02918714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496906, "uuid": "d4540969-ccc8-4eed-bb8c-3deeec9b884d", "value": "1536:/ldgg7WM3ZK8Rfb7hKHc7D5oKBBAnTLMUjra0Kgd3Gf:tdgWWMpzRfb7hKHE53wTLhra7g1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496906, "uuid": "580b3d62-3800-4b62-b444-afe97e5aafdb", "value": 75448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496906, "uuid": "64185cac-a6f8-4d2a-8225-361183537534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496906, "uuid": "69ef4703-b630-4ff7-8842-ed5dd84ce181", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77003c82-31d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775490684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490684, "uuid": "e1166360-8b4e-4f1b-843a-f8385f020f12", "comment": "Malware payload (Mirai)", "value": "93783dcec355d0bb4726a10da2a308b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490684, "uuid": "457f9a5d-3bf9-4913-b2ee-9f6ff6ebd11f", "comment": "Malware payload (Mirai)", "value": "a375bfdfbd08db887a7f4e1a529d08ae0dd9c33186060ef35dfe7e7ed8ba4d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490684, "uuid": "46b8e016-8e57-49c5-ae34-f3459b3a21b8", "comment": "Malware payload (Mirai)", "value": "d1f160f4d39cacaece9ce8e4534806e2d772ddca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775490684, "uuid": "4f6cd406-1ae9-4ca1-85fb-f7c521732c2f", "comment": "Malware payload (Mirai)", "value": "98d3e2a0308586ce32e4d5f278a3d63edfd95729b73b3a868cda313a3d615fb8313c07d3f456d78d8459f9416142fdf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490684, "uuid": "1ad5ef00-fb11-4f73-a75a-087fd68c40ea", "value": "T166A3A509BF604EF7ECABDC374AAA1B4514DD652724A83F75B930E818B54B24F25C38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490684, "uuid": "4127fb34-b23e-4bc5-ac42-800db8ba72c0", "value": "1536:CfWqhitQLeRiy3uaWmIjWK9z6lWUtAZ3WJAu0EZA6WEFl7Z:CfGCaMy3ulYA3GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775490684, "uuid": "c3a1b881-4f40-403d-8a0c-c06ab1986cdf", "value": 101652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775490684, "uuid": "a9675a38-c155-422a-81ab-950617da9226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775490684, "uuid": "7e03df38-36bc-4b9a-aa0c-c54f3fb9373a", "value": "mao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9649fcab-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463678, "uuid": "1129ca9b-3776-4a08-9b7a-a50198e7a453", "comment": "Malware payload (Mirai)", "value": "29d39877afb9384a795b108965a6e4ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463678, "uuid": "f7df8044-fe1f-4406-be01-d9a8d177e5e3", "comment": "Malware payload (Mirai)", "value": "a39e914e48074dda05766f928d028c405bb624c60794eb8a8d44a906b93cb34d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463678, "uuid": "bf952b78-023f-4ce6-bcd6-25d323febd44", "comment": "Malware payload (Mirai)", "value": "ba45a5b9b899124482df6b5ca0a0699d83af2e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463678, "uuid": "5f3bcd08-f32e-4a18-bcdb-5cc2e2949427", "comment": "Malware payload (Mirai)", "value": "2d630cc0b0b547102af25654d468ab9f6a8fa20c2f8342995bd441a1017a74319f6f35602bca86cd74d00b4730eb4b74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463678, "uuid": "34941fe3-5706-4b96-b5a4-ba53b6b97e5a", "value": "T1DB930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463678, "uuid": "538178cb-736f-41f0-a324-89c2a4b9444a", "value": "1536:wqnZh8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yqn:J8NUv5nTacgzafVAwe4BNRIbT2gX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463678, "uuid": "1997c392-bb2c-4318-98eb-6c9880b6dca2", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463678, "uuid": "e36cad4b-30e8-4814-a35b-1ee05eaa90d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463678, "uuid": "74f54989-c1b0-451c-8774-47539b5a42ad", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3fb297-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "1adb4458-e848-4732-b7e3-1e79afb3a78d", "comment": "Malware payload (Mirai)", "value": "4fcf04349463cb52dd964acaa0765b23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "7dca2b6e-bd57-4d52-a422-5aa7847eb05f", "comment": "Malware payload (Mirai)", "value": "a4ffbec6d0a5080a029ccbe7f2f38639d9f241fa4a92489beb560302bbd09818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "68417e48-1829-4cbd-aed8-d99743f6328a", "comment": "Malware payload (Mirai)", "value": "ff09083551d6ec32b3fc61bd99fd6fff65ca61ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463640, "uuid": "25d7a05e-8d1e-44f1-a7b5-beff5b332ab1", "comment": "Malware payload (Mirai)", "value": "4a6ed69d9e57b02f457b49ee7a888b91e63d27370015fcfb86059402f1a2a60834f78276ccb8669cae3f1100c23e43c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "8280f5be-d9c8-45a4-b3cb-4d3e0cf663ef", "value": "T192837D69EE0E6E42C2C7D279AD1A4FA230337CF45354C2725E00617DD4FAE9988F2967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "d671a9ce-144a-4e03-873c-223278f38348", "value": "1536:7aW2U73jqB/dVFPLa7EOAeAmSBiS4ZSwOl/g5lOmQXWPed8DFn9wiiY69usLThQx:7aDUSPMSBip7HQXW3Znvr6UwSW9kKrv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463640, "uuid": "36173282-3260-45bc-822a-1d7a4ce7dcac", "value": 83512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463640, "uuid": "87d089d2-592c-456b-97ed-84f02a0c5feb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463640, "uuid": "c34a38ff-4b79-42c1-84fa-997617ec7fe3", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47be1157-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "6ae00585-b9f4-4808-b1ff-a6537cf02f51", "comment": "Malware payload (Mirai)", "value": "e96864c1d03428462c0abc624fb948f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "8a6fd2d5-fc5e-4abb-b9fa-320fd1880d3b", "comment": "Malware payload (Mirai)", "value": "a5a144b78fae359cc326e57f6aed098f0b6a7a03858f28bf51d0ae9d0c3da5d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "9bb792de-48af-4f82-a523-b24b3694cac0", "comment": "Malware payload (Mirai)", "value": "0335f007b1b69c2a121c5893f35b9d13588a24aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "94467d18-bb91-43b0-b91d-18fc60a40d12", "comment": "Malware payload (Mirai)", "value": "d37eba9b5eba171ec1511944288e4a6a84b14da3b607134cfc159790731b1881a615381824948485651acaedcc65d9cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "8ece6d1d-60a1-4c86-9acd-2c4e5123c9a5", "value": "T13BF2F1BA224048CEE41CC1FFD66447A0A49557B184039EDAB4A5EFF1DCEDA4C22437E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "f2109070-b482-4a80-a090-786094256314", "value": "768:tNYKyukZoTMKemNr8WWUgpySRbFgvldA9IYK7boMVr+JgGlzDpbuR1Jv:nYdWlemtGU+Rng9O99KnTrqVJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442931, "uuid": "d801155f-fc40-461d-a67d-bdae7ecec124", "value": 37076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442931, "uuid": "6f0eb2b0-903d-4c67-850b-068b54cd1399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "b38c63c2-273c-416d-bc1b-fc2b7d4eef99", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae50880a-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463718, "uuid": "8f045d41-17e2-4dc7-a512-f7e1e9041b1b", "comment": "Malware payload (Mirai)", "value": "13b26ac2d3084ffabaa757a3a6962341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463718, "uuid": "8520940a-b41b-4c9a-9541-dcb27fc5cc9f", "comment": "Malware payload (Mirai)", "value": "a6c961a79c8adf1b8942ca55d87def8c8728062324ffac1226e3ae9e28a6d06b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463718, "uuid": "2c292f7e-13a6-4526-ac65-b7e1ba128ead", "comment": "Malware payload (Mirai)", "value": "d5afd51e2deb4dc9faf5d4241f6b98e3cf374a9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463718, "uuid": "26cd9c28-7cd1-40d1-96cf-bcf5b58d2bef", "comment": "Malware payload (Mirai)", "value": "f88fb16ad311604a3e5fd35814d431570e2e991066a61d50e4478694dd667667ecc411567669e174aee90ca8ffe11c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463718, "uuid": "a85ad626-6784-470b-ab64-a45dd939eed4", "value": "T1DBB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463718, "uuid": "9abded4e-23da-4563-a473-99c5bcac2e60", "value": "1536:v7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxO:DzPqF41OUBljSIxecUtCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463718, "uuid": "0bcb900c-2e69-4293-8f6a-d3211df2a291", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463718, "uuid": "32143b0c-2de4-4708-9e4f-5619d5fa6387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463718, "uuid": "ecacded8-c6f2-4137-b1de-3788cb39a8ec", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2d59fc-31c4-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775485753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485753, "uuid": "1d0c9472-28c5-40a6-92d0-c809d1fc55b5", "comment": "Malware payload (a310Logger)", "value": "c2f03d425a0e5acb5e62b75de4053700", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485753, "uuid": "4d32be5e-ee6f-48fc-a35f-cec289313e27", "comment": "Malware payload (a310Logger)", "value": "a6de1fa5a3c764710cff85c32fe148f9d3f0e0df679ee75611991d6d18655fdc", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485753, "uuid": "8a579769-275c-4037-a1a8-d491f03007e8", "comment": "Malware payload (a310Logger)", "value": "070510a58d917154cfc560d35ce10e154d171856", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485753, "uuid": "bf515ebc-6ac4-4860-9d89-c3d7563321ac", "comment": "Malware payload (a310Logger)", "value": "1d0d4da11ff26d9fd0c2866e2a57de66bd66df88a8781662d3e588d35269e203063154b9532fc1c12861552dec227ded", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485753, "uuid": "11717b35-6d54-4018-a6ac-90971bb50e07", "value": "T17FB5021189C42FB9CFEC5B1D40FE160EA3E04A8A5056758AFB33BE47AFEB644511B18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485753, "uuid": "e8a03492-f5fc-4a42-980a-db6703fae487", "value": "24576:L0KNC+lVIhHK+PcuRvOC6Ca5fVqErq+u2y/i+HY4Zebfe62IQjrn1dylE8tq5l0W:3MxKdAQpslBjJd6Ex2cWOq7eNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775485753, "uuid": "a672f6b3-71c5-49fb-bc8a-8e4634ee947e", "value": 2477079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775485753, "uuid": "0d0f0a0f-0a73-47fd-9533-9e8ab51dac76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485753, "uuid": "ef99988a-f064-43f6-a536-d5a1582ee42e", "value": "Credit Note A12345-045_20260403_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01947a9a-317f-11f1-a769-42010a9c0008", "comment": "Malware payload (GodFather)", "timestamp": 1775455698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455698, "uuid": "15abf1a9-0f1e-41df-8d30-c3a40652fddc", "comment": "Malware payload (GodFather)", "value": "1e48b10964391aa1676f4a0738db672c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455698, "uuid": "a9945e06-eb9d-4997-b7bb-b7269c218b64", "comment": "Malware payload (GodFather)", "value": "a6ed100ae42e4fdabfd1b4c992762152bc4a11cc8e521b647b444c75bb7a9782", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455698, "uuid": "badffc3f-ae0b-4a4b-97ca-b1a3c08ae1b4", "comment": "Malware payload (GodFather)", "value": "5dbc46c83644ace95fb54cdab6594e64f14a27bd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775455698, "uuid": "f73c544a-4edc-4b0a-bb2f-eb9ecec39510", "comment": "Malware payload (GodFather)", "value": "6e56bbed57feea39eda16dc4f366c0d73517911f011160fbee3fc63b1b0fa73739abae817458b305835fa20da5b4a658", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455698, "uuid": "de0ecf2a-8269-444b-b5b1-9bcda0babad3", "value": "T124160142F395A85BECF3C3361775862A51028C56C793E683795D72BC2FBBAC04E45AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455698, "uuid": "57a28aa5-2d95-47e9-8da2-8d478b509d39", "value": "98304:0RCZAo3kiQcEK8AEFlF/ens65XX4E1V5zEMH9Gf:EkJ8DFl4sg1nE4Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775455698, "uuid": "f41322d6-94dd-4ee3-8806-b92972201b26", "value": 4134252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775455698, "uuid": "53b29643-a0be-41a6-a610-5b3eddf8ca7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775455698, "uuid": "a34a9a85-e31d-4cdc-a117-d514cf68ff69", "value": "a6ed100ae42e4fdabfd1b4c992762152bc4a11cc8e521b647b444c75bb7a9782.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6be9ae-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501590, "uuid": "e3e50f65-2bcf-487a-99d6-dcff5c6436a2", "comment": "Malware payload", "value": "25a5cb029ece192edc0268e5a11a1f2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501590, "uuid": "0a50483c-f58e-4ea0-ad6c-ac67327e7ec9", "comment": "Malware payload", "value": "a7014bcfb7388701a089666bcf8a208e62d6c18938c6bb64c9bcaa5307c27390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501590, "uuid": "6b65e70e-0510-49e5-b1d3-dd6950073fd4", "comment": "Malware payload", "value": "4acab4b9e8265445c1f1f7e47b211c49b15c5247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501590, "uuid": "c9e38564-6eb4-4fe4-be37-d6ea1b722746", "comment": "Malware payload", "value": "05ecf342fe2af151a837ece269711356388272979ed7c120966b47d81b703c8eb6b8e8a0f66b6766310065fee042e10b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501590, "uuid": "0916de88-aa39-470b-b5cd-24cff699f2bc", "value": "T1EA33F945BD829906C6D84377FA1E42CD331173D8E2ED3227DD153F52BBCAA1B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501590, "uuid": "80964fa0-5e27-4b2d-9d49-89eb77cf69a8", "value": "1536:gcYZ7LMohtjgj4oa/RbYrdV8iCqwbZnH:hYZ7RhiEHRbU+qwbZnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501590, "uuid": "ec282d0a-4f9a-429e-8538-85c7a1687b78", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501590, "uuid": "c03915ef-5ad1-4307-8610-5f82a8453b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501590, "uuid": "2cc095f1-e90d-4570-8319-002b345a3ff8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def01a74-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775516199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516199, "uuid": "d2a0c4c3-44c4-4db7-b307-18925fbdde7f", "comment": "Malware payload (Mirai)", "value": "8ef8e9625b63ccf8d9294017c74d5ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516199, "uuid": "895c7c75-8c27-4645-a2dc-9362a0f010f8", "comment": "Malware payload (Mirai)", "value": "a7315ee772f24ab74c6b66ace6b019c41c59e5d31bf1fcb0cd7c0b236ba399ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516199, "uuid": "d768b915-1b2a-4e0f-94ab-134d0e77838c", "comment": "Malware payload (Mirai)", "value": "710d040c8d20499d26e0d833a4d7612936dc7782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516199, "uuid": "4ae1728e-c904-4123-b954-805896aaf59d", "comment": "Malware payload (Mirai)", "value": "402810a3ae12c6987535c223250614ddea9b32899fe1145958431b258829ea62ca05f10146db735378ee7055f8fca51b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516199, "uuid": "abb61549-8d85-497f-8812-5c3e47b46f0f", "value": "T124B32946FD819B02D4D320BAFFAF414933136BB8E3FA7112DD249F65238A9970A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516199, "uuid": "e90ac71d-6b42-4fa8-b95e-dc35245d500b", "value": "3072:NnT3OCX+Apq+cHaYOVXJltJ8okBuCbBu7puO:XuJxHa9VXJlcokBut7puO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516199, "uuid": "be285d29-2f14-41aa-88fd-565263d8fc9a", "value": 111472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516199, "uuid": "ea7b6044-a9e6-4cb5-baef-55b94b9d0900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516199, "uuid": "84146407-6d27-4cae-be44-62554f835e6e", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf61ceb-31a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471984, "uuid": "8693d79b-bc5b-4d8e-9cf8-128c8b9dd9ff", "comment": "Malware payload (Mirai)", "value": "bb316f4b4dd69a9d32faf0a5cfb47f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471984, "uuid": "f6aeab0c-94ba-4aa6-97a4-dd3c29fc2e3e", "comment": "Malware payload (Mirai)", "value": "a8e78b25da2bfcb1437fd740e8fa05f6d151dfeaa58615e03c51ad590702c5e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471984, "uuid": "f0587efe-b212-43c7-9d37-daa9ebd125e6", "comment": "Malware payload (Mirai)", "value": "e2ce4d8ee2d9f95ca5fb1b7b02e65acfb38514ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471984, "uuid": "ab9a4dde-a660-4d0c-9afb-f786c4147fb4", "comment": "Malware payload (Mirai)", "value": "a10a5fdbabf0a700607c9006694b3b32a505d5d4118a4956917fc2006158d5ad6842a3aad94e1a6e2a2228e9bb5169c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471984, "uuid": "ca315434-bc42-4231-ba35-05b6140a3aa3", "value": "T1D4732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471984, "uuid": "31b7ae18-76de-42a5-bfde-bd3abbb05da2", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wf:927jqCt8v3GI/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471984, "uuid": "91519485-9470-4c40-a879-003359a1c46f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471984, "uuid": "aad6418e-ced6-413b-82f7-c5dba3099cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471984, "uuid": "651d7037-e7db-41f9-8f76-08c18db9af10", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25daa20-3166-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775445311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445311, "uuid": "47059dd0-1b46-4065-822d-cab82a801bcf", "comment": "Malware payload (DCRat)", "value": "1929dbef32ebaa79db76c1666df08da4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445311, "uuid": "e4594763-3bfc-4918-a2bc-d3dce6d02ef1", "comment": "Malware payload (DCRat)", "value": "a91b412c73aa9f061a850ccf8c7f0484a90d9b85ba123c5ba1227d98b0e414d7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445311, "uuid": "a54bcf24-7f0c-4cb2-9515-9adad6432190", "comment": "Malware payload (DCRat)", "value": "6f61ac3e16dca14232fba7a9b911f111d9690b5d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445311, "uuid": "4a80ddcf-5481-4fa7-bf99-09f2a3045762", "comment": "Malware payload (DCRat)", "value": "007276544956c402a10bb37be699350589ea776baf850093c3e198e0e017b141c56a0eff909dd759c0b229ed6f858c23", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445311, "uuid": "08e15978-c968-4909-838e-aa7866604cd6", "value": "T178E5D0027F44DA51F0091633C2EF454847B4AC11AAA6E72B7DBA376E64123A77C4DACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445311, "uuid": "46f052fb-dd45-433f-bf81-431001c0acbf", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445311, "uuid": "7f47aafc-73e8-4602-8a13-2c70c50f21bd", "value": "49152:UbA30JAjmFlVKlKDn9Awhh6GFHYV8YBfnHKPQjSt1jyP1Sc+cJ:UbtAqCI9YEHY5BfqPljvcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775445311, "uuid": "9682c52f-0ecf-4d92-b019-2058b5acb5ab", "value": 3061978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775445311, "uuid": "2120b312-15b7-4770-9e1e-57d60d8c8833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445311, "uuid": "94f278b3-a14a-4145-a6ed-8f005846fb65", "value": "1929dbef32ebaa79db76c1666df08da4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b20960-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442961, "uuid": "a27a9183-d985-465b-b78a-0a57b96b0b6c", "comment": "Malware payload (Mirai)", "value": "f0f59e83dfa8c8c958c7734ddc8b5e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442961, "uuid": "7ff2af07-04e7-4f21-ba29-2d04f7f159fe", "comment": "Malware payload (Mirai)", "value": "a92812dad629fb082859d63c44fb08eaa1193801371caf4c44ecbe935259798b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442961, "uuid": "e2f02d13-ce4b-4f83-8c4b-a2029089aaa9", "comment": "Malware payload (Mirai)", "value": "ae63703e60f4b0dec812065cb348894b58a3eba8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442961, "uuid": "76fecdb2-81ee-4fc0-9793-40f54dd2dc18", "comment": "Malware payload (Mirai)", "value": "f66fe8c080193bd8e9623aa71ef93e054921b7e64d3aea2978dcf0919c870d092fad3f828d985d1cd5773d9d5229984a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442961, "uuid": "5cf469a0-1f68-44cf-9f7c-45b6411ca390", "value": "T1A792C0310127BCF2C7512832E63F86029E1A13FEC5F6317B235459B8DA9554F1EB558E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442961, "uuid": "1f897e79-0195-4880-be39-5e4b35decc23", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8vrxhymdGUop5htU:QCyEPgoKRwZGx04nIns0t2y9s3UozLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442961, "uuid": "f5d90e2d-f3a6-4a2d-ada7-7f9bdeb69df3", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442961, "uuid": "b53f2c4f-7beb-4683-820d-ce8ae20a3912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442961, "uuid": "5b8f061e-07ea-445c-8372-a19900151c65", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f011c5bd-319a-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1775467694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467694, "uuid": "26939b4c-c1bc-4ebc-842c-3c6cde56d5db", "comment": "Malware payload (VioletWorm)", "value": "6f7e59caac24659e23967807586dbce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467694, "uuid": "51d13212-5dce-4ccf-be66-ee5d06dc18ee", "comment": "Malware payload (VioletWorm)", "value": "a961ce0314f78900f26aec189234ac71e497487b35c1a4a604bf384e911f3e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467694, "uuid": "d2058ad5-42fe-422f-b11b-acabc5402d19", "comment": "Malware payload (VioletWorm)", "value": "bc9717606f87e0f1cf35f214b92ca0e1fbdacd06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467694, "uuid": "3e1bd058-71ad-444f-8904-f8d73fc8728c", "comment": "Malware payload (VioletWorm)", "value": "6092e7d753af84b548fdbcf1d1682fd506987d7b0b46fb2dea600e78a6956e8b742a0582b77f2f215c559e73f256bcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467694, "uuid": "d6f7503e-11de-4d2e-b3ac-368a6e1d5c6a", "value": "T1A953B6C536778872D27FAE7AE6C7624B6DB54073A901D5850CD277D32A02F82C90ACF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467694, "uuid": "702055a5-7844-4119-bad5-3ddf97cdf7f8", "value": "768:yhQXs5Bx2EOwnynaPRqQYE9fxD9bx22kyxmmzKFPrsk:Q+sR2ELnynoBx9f99bx2269jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467694, "uuid": "767ac84a-5a8f-4182-8960-532f94b5276e", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467694, "uuid": "7784202e-8fee-4021-8796-ec9e344e08f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467694, "uuid": "f1dc51a5-4a53-4b06-9e25-566bb4629709", "value": "SecuriteInfo.com.Win64.MalwareX-gen.13972525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d443010-31ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775489862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489862, "uuid": "e51bd387-4e4a-4efd-b68c-9afd267ef4fc", "comment": "Malware payload", "value": "4f2b61d17119bb2549d9f9a715ad62a5", "object_relation": "md5", "Tag": [ { "name": "195-177-94-64", "colour": "#000372", "exportable": true, "hide_tag": false }, { "name": "crossc2", "colour": "#0901BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489862, "uuid": "5e7d455f-231d-4acb-9173-39ae9f49c563", "comment": "Malware payload", "value": "aa0dee7ef692920b74705fdf1f0117c5633dc8f5da7f68b5221039cdc56b9348", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-64", "colour": "#000372", "exportable": true, "hide_tag": false }, { "name": "crossc2", "colour": "#0901BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489862, "uuid": "8d8dfa3e-1875-4cc5-b6a9-41d92b11ce25", "comment": "Malware payload", "value": "39d5f8784bc55e042de64b0bfae37116fd061d72", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-64", "colour": "#000372", "exportable": true, "hide_tag": false }, { "name": "crossc2", "colour": "#0901BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775489862, "uuid": "d6807146-917f-4f65-bec0-8ec9c7140e8e", "comment": "Malware payload", "value": "3a595ac54496ff1ca16a5f34bcf724ecf7ddcfb49fce92ec85a56e22a41354c868e1189e0d76466225e1b9921cf4a5d1", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-64", "colour": "#000372", "exportable": true, "hide_tag": false }, { "name": "crossc2", "colour": "#0901BA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489862, "uuid": "a993a3b2-3d87-49bd-b58b-cd825b670ead", "value": "T1086523D600901AA39115283BA46A7FF13F212D6B2B3238582D96FEC7CFB90E54D597DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489862, "uuid": "a4aec2e0-cedd-4818-9e34-1aaba9ae4060", "value": "24576:nAHgTVEYTG8g9dnGU3XNqW+E8C73G+xY3/My4c763Gheij87uptkuLpIXEfsxK:n2E5g9hbXUjHQ3G33Uy4+zj87rcpIXEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775489862, "uuid": "c44d1b8f-743e-4c8c-bd3e-ddf92571ff1b", "value": 1425368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775489862, "uuid": "a2d57251-7ae4-4a8b-8e62-102d29a532ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775489862, "uuid": "bdde68d3-c764-4924-b455-477433e2a3e5", "value": "x.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bec341-319b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775467833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467833, "uuid": "bbba4da5-0d64-49ed-9d89-2b9792709c57", "comment": "Malware payload", "value": "15ae8ba7ca71bbb44b33b3ca6c8ef743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467833, "uuid": "df0b1094-6509-4866-8b67-dae4f7e962b3", "comment": "Malware payload", "value": "aa7f220c8c12a65abb8fffd8261a8ad4092c5ffd87fe6853e0510d63b39db5a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467833, "uuid": "89b3294c-d729-4a67-adb8-b3e8d3dc3eca", "comment": "Malware payload", "value": "15cad047dd49786901c6b3110472fc8c92a2b239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467833, "uuid": "24c536f0-82b0-4652-962f-2908402069e8", "comment": "Malware payload", "value": "b888656ed86ba50a909b8b4d3fe31bbcdac2f3b273928b1446798e5cabf8856405953eabab1d2505c901163d6edc9630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467833, "uuid": "8d444fa5-544d-4819-8fb0-15ad08a52c60", "value": "T1E537DF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467833, "uuid": "10b0452a-7806-4593-ac4e-af1a0237865a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQh:cqYUQuVDt0TZEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467833, "uuid": "b807e1fb-aae9-4d9f-970a-0e0456dfb118", "value": 24477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467833, "uuid": "64500548-2d41-45de-a280-5ef7c892e60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467833, "uuid": "fc770653-67cc-4738-9644-db6a2a762214", "value": "aa7f220c8c12a65abb8fffd8261a8ad4092c5ffd87fe6853e0510d63b39db5a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b354133-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "2b57691f-f180-4a92-a3e2-117a35fd62ea", "comment": "Malware payload (Mirai)", "value": "1e2a55803ef443dfc3d7964d692b4c1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "9ff1dc5c-26a6-4b82-8763-254c1e645c44", "comment": "Malware payload (Mirai)", "value": "ab55d67aea381760a8ed39559695cec3e0a8d80ab12fc15fd02df0a01880e09c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "173ec337-5694-4a4d-bf84-e56fae799a29", "comment": "Malware payload (Mirai)", "value": "fb154d3eb4fd541d6e9bfe79a750df235f3e13f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442990, "uuid": "aecb2dc1-43c5-450a-a4a2-7b5a2fab9083", "comment": "Malware payload (Mirai)", "value": "a66041a66f1e7c9d41c8ade5f9bd1ef3455459f8fbf456fa5e44c516f952a2ae6f3133309364ed3083dbd32666ddce69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "8ede8ba2-73ae-4a9f-a367-a7b1bb8c8207", "value": "T12B83199AF800DDBDF80FDAB74463490EB931E3910A931A377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "cf7edac7-6d93-43fe-8372-690cc4ae04e3", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7IZn:4G5hLsd9lJP4npeqp+psrbIZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442990, "uuid": "3344f41d-edb7-45fc-a253-6a5c9625c4ec", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442990, "uuid": "45e40017-eb94-4661-9d3a-1ba33d130ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442990, "uuid": "9cfb9ed4-9d8f-46ea-aea0-b5f16295a22e", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62683d36-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515990, "uuid": "b5852359-9ddb-4692-9cec-5a31af371caf", "comment": "Malware payload (Mirai)", "value": "eeae7afaf24843fa0e48c5332a269271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515990, "uuid": "88f22387-ef5b-4c3a-8a12-57eb0b028a4f", "comment": "Malware payload (Mirai)", "value": "abce2c6a24cb0afc68e676f0fcdead5c8edaa85e3b2cf90fe13f3decda64eb2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515990, "uuid": "e719ec64-2e38-47a2-8252-28da1daaeae3", "comment": "Malware payload (Mirai)", "value": "4645dd65a99bf2733a8c160bc48876b7866741cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515990, "uuid": "46d151af-e843-40de-bf30-37264a4850a6", "comment": "Malware payload (Mirai)", "value": "8498906f852d8feaf0c62520b098791ea240ed0da5807530a956216c670d2ad78269a3788e28cdcc11f8d77ffcd4dfd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515990, "uuid": "ca55a34c-94a0-492a-8ac6-da637690d2e1", "value": "T1D8A3E602EF614FABC86FDE7346F90A11388C6D5B36B927657934ED18B6161C70AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515990, "uuid": "328fe69b-0ead-4ce5-9cc6-c75c20055e84", "value": "1536:PtzESV6m4zJUQPsmbcchBjQvS/Q73mmvC5CRE3sj2inglZSIrfiMKAooeirT:VzL6VerlWS6inyph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515990, "uuid": "dd6285f3-9d7e-457c-8e24-20edfc79031b", "value": 104372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515990, "uuid": "ff57c0ca-c843-4aea-8efc-cd59034ed6d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515990, "uuid": "da378854-07e9-4096-8dab-5527612cf7f8", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08879228-31d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775493935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493935, "uuid": "5f900ec3-9f4f-4e7c-bdcc-83536d55c8d9", "comment": "Malware payload (Mirai)", "value": "8fa71e7cbbca3635d0ae8782313f6b0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493935, "uuid": "0479c3a6-78aa-4a43-a6a1-08cd5ee3891a", "comment": "Malware payload (Mirai)", "value": "ad5e36190c66d0fc285095b326e9adb090656700913118f67f79e5866beee23c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493935, "uuid": "40077cd5-1eb8-4cfe-bac6-7d2e322809d4", "comment": "Malware payload (Mirai)", "value": "3b0db8bdc8bf5757e938278e13952adc69098460", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493935, "uuid": "ef6dabce-3043-4ea4-a470-c1efcaeb246b", "comment": "Malware payload (Mirai)", "value": "93e4af4401e30340aaf5dd862d6351aa5832707d0b3c193ef19e3f8c156bd040eac2e3a95eb8fb8b90d22347817c5a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493935, "uuid": "eb157ab9-72ee-4fe2-abea-c10b3b4ff9c5", "value": "T197F43B56F8809F62C5D1257AF65F82B8731347B8C3DB720699189B383BD782B4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493935, "uuid": "76cabf92-5474-473d-85ad-dad7e3210bb0", "value": "12288:xAB2tjz5SSBJzUjX7Ff59LnyxZpvigpWWtQ/2ENZ9tSywFiO:xRtjz57Cx5lny7pdS/9ttwFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493935, "uuid": "7c951c9f-eef6-4d21-a280-60598a1ecb3a", "value": 729300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493935, "uuid": "b75a9b94-9631-4bdd-af64-1f3c00bf08ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493935, "uuid": "933b24f8-50ea-4a1f-878e-89628b7ef60d", "value": "clientarmv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b340267e-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463727, "uuid": "c977d8ab-1495-40c3-af5e-63f8ca537a61", "comment": "Malware payload (Gafgyt)", "value": "965b60d87a2c0fd6a4f4c1afda8bdfe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463727, "uuid": "f94fd181-cf55-4d4e-8558-6c721ad40b3b", "comment": "Malware payload (Gafgyt)", "value": "ae39d9bb90596bad86c57dfd18a5fb1923be8f052cec069632e568cf50e79114", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463727, "uuid": "812757e2-adc1-4fd6-8e86-b165148f3197", "comment": "Malware payload (Gafgyt)", "value": "53f2dbd590414c146b9b6bd1e0263605469ac513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463727, "uuid": "2566cfbc-9ad3-4302-9829-904abec89dc5", "comment": "Malware payload (Gafgyt)", "value": "71f2fd930b96d730cda6026ffc433f260fc3be30574760d279bcd1bbf373513a87f29621760dc052458b50a6a72b7909", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463727, "uuid": "7149f047-4a92-4eba-af48-0756fc78870a", "value": "T1AFB2D02C92921431DBB2383BB83F4292EB764930E5B972F0B209495E35E60DF4F8D4D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463727, "uuid": "b503183e-81b2-445b-b817-cfba3ef5ca83", "value": "384:jo23UjbCuMFOR9WDDy8NteEWuzqn3LtYLA2Pl1wNXk5/tXmdGU57DHz41hKQ4+Rz:0QelMsbQy7ExqhMP/CXkTX3UpzqhKkNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463727, "uuid": "cf16d7a6-9ec4-4cd9-8a9a-90223be9fccb", "value": 24508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463727, "uuid": "09644813-2e08-46c1-b648-491a16f44f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463727, "uuid": "9d180b39-179a-458b-9931-e93ad63b3254", "value": "cali.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6271c7c5-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501387, "uuid": "62c0ede9-fd53-4899-b904-685e93962aab", "comment": "Malware payload", "value": "0dd1cf2d9a72fdbef19e77af59ba9d1f", "object_relation": "md5", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501387, "uuid": "2ab7f040-5aba-4729-b530-b66a92cf3095", "comment": "Malware payload", "value": "aedd975e59ffe867bec9be9a33d438b8d34c96e7f42453f7661e2127890aa0e2", "object_relation": "sha256", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501387, "uuid": "0148d687-25fb-46ae-9680-3caefe8e66e5", "comment": "Malware payload", "value": "d7ed1afdf19ffbf3e667d3fcc0ddeb6342a4d5ab", "object_relation": "sha1", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501387, "uuid": "47f46a23-efbc-404f-aea6-373e2c978406", "comment": "Malware payload", "value": "6b935053740e7f8f84a72fda2e043abd6f40ea47e3a8ae71beebedacd99aae2424fd8da41cc388567155a4049d137901", "object_relation": "sha3-384", "Tag": [ { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501387, "uuid": "047704b9-aaeb-401e-a829-4c31577f5728", "value": "T1AFF31218462896FEE3F69379AA094B831C8701D9E4A1560C766F3DFD2938CE7130F5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501387, "uuid": "28b6a2cc-1529-4185-8180-a6974151015f", "value": "3072:EAkb7MJFDPnaOJlitktW+HQFVAtbwMcQaaaTIEza7/7m+qbzwCdEf:yi/zJlskVQFVAtbncvWEz1WCdEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501387, "uuid": "2e5bc7ec-8d6e-47d4-a611-f5a36798d6f0", "value": 157363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501387, "uuid": "81da0117-7f71-4039-ae79-6dfe8b480c5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501387, "uuid": "7471bbb9-5a68-471a-9541-e6e16bd4eff1", "value": "2026_4th_K-ICTC_Information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09522121-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515840, "uuid": "4e680de6-2cb5-481d-8e16-cdb155b00bc9", "comment": "Malware payload (Mirai)", "value": "f6947c01364e9b0afe982839d600b501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515840, "uuid": "b5ca7199-a3e6-4a59-8b1b-7ed756a19bdb", "comment": "Malware payload (Mirai)", "value": "af0a6756457daa409763023c9ca413991cb351a87cf4f0c6b536cccd52d1d2f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515840, "uuid": "6a79f902-bfdd-43d3-bfab-54d6f947b443", "comment": "Malware payload (Mirai)", "value": "92e4248e2a9e29bca75fe6c82fb7262a0df410a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515840, "uuid": "69cf9b6b-e1af-435d-b26f-89a424906840", "comment": "Malware payload (Mirai)", "value": "6718cb2cab549c12ad74d7890909dbd91d1340b25c87eabb0aaef8d415008ea25a8e7431803a38dcc13133dada2a480b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515840, "uuid": "cf58e103-fd56-4a59-86a0-db47c6e20c9c", "value": "T1F2A30702EF615FABC86FDEB342E90A02388D6D5736B523757974EC18B61A1C709E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515840, "uuid": "1f69ff0e-8335-4aa3-b5a8-d8893b3bdbfb", "value": "1536:PrXSKClO4jRcUjrgY8w9yk2fawTwwFCzDo5OVz85PF5Zvtx9swtDyrsI6eo5dWJJ:DXel1pskzzyF5Qsfet8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515840, "uuid": "a49a05b1-e9e9-4b54-a542-b4ba5606e13e", "value": 104344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515840, "uuid": "c89f1f79-564c-4a14-80ad-16b3f459fd6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515840, "uuid": "6a01e960-8674-427a-aeec-192e5ed13f63", "value": "SecuriteInfo.com.ELF.Downloader-DN.76474274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6045ca0-3206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775514063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514063, "uuid": "240039e4-5e8a-4a9c-920d-29292aeafbdf", "comment": "Malware payload", "value": "75d64a29d1e5e5ea429598d489a86877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514063, "uuid": "c1618a77-e460-49bd-a7cc-948c8d06f28c", "comment": "Malware payload", "value": "afd6b31e41f81f1f0f578060b6028b0ba5a692f5a8cca45bace31cd04ec131d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514063, "uuid": "1022d8b1-98bb-4c5c-a84d-29fce34537a1", "comment": "Malware payload", "value": "823f83d4a662afe178e7b8335a027cdf8baaf8b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514063, "uuid": "f8287eb4-63a8-49f2-b620-7321cf4eb4cc", "comment": "Malware payload", "value": "26544b4f5fcf8c4e86c2bf5db44da5d858a5cfafa21e17d09b20cb5bc6fbaa71c3d4c05c351d6506a738d8b6f960c448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514063, "uuid": "e86b7f0e-4395-4389-b6cc-7c0b099d53ee", "value": "T12C158D2EB2B3F5BCE017C03447DBCAA24535B07526212DBB26C4DA353E66DE51369B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514063, "uuid": "af0fb142-548f-458c-b9c3-80c664b1774d", "value": "12288:prm8jNgntFs+z2N9F5bd5HsPpF9utS8gCDGtOpcb2+1O8+D44KUaySps3zsFLHX:prZjNg8c+9Fs5bS+1OP44KO3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514063, "uuid": "ca93dc08-2759-4c47-b0bd-38a58f441e67", "value": 961136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514063, "uuid": "8c79a6f0-21d6-40e2-a799-1034ab3a7b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514063, "uuid": "2e675791-7ab6-4efd-b6cd-20e38277bc23", "value": "clientx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71c70bb-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463814, "uuid": "e5faee7f-b8f5-42a6-b0f8-8552a7ec64fe", "comment": "Malware payload (Mirai)", "value": "a23b837beb7b20e877e9e841477fe5b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463814, "uuid": "684652a1-dfb4-44b9-b3a7-dbc561ddc330", "comment": "Malware payload (Mirai)", "value": "afd96b12743f6ff442403067f337abbd3119a7055b03363e7ba6572db00c947f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463814, "uuid": "1c32ab8c-728c-4937-81be-6ca216b8bdcf", "comment": "Malware payload (Mirai)", "value": "b30670e3620cd9989269251d6a69f9afc5cd6e1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463814, "uuid": "4acd5c12-f02c-4e22-abf0-d3a5fdd7e0d7", "comment": "Malware payload (Mirai)", "value": "fa8789a912a2e9d201546450cdd5f6a3c15dbee2d887396fa838ac2b7bf6fd2c5a519bab6b2f2b696c2f1e3a602c3292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463814, "uuid": "c41ddcec-df45-4e5b-a338-02f8b2755ea8", "value": "T13DC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463814, "uuid": "f25860f8-c444-47a2-aed3-aba4f4868d46", "value": "1536:UFAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3W:U2FmSmviqS1Bs0+Nd6lAqktNMxSNbmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463814, "uuid": "17ddabee-8051-4cfb-bd07-d5b6fc5a85fb", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463814, "uuid": "cb49e28b-7960-453c-be64-80d6f12cf0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463814, "uuid": "0e1a0ed2-c7b0-45a9-8332-d48709bb9287", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91da09e4-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463671, "uuid": "2cec1d51-db52-42e0-a36d-d25101a97660", "comment": "Malware payload (Mirai)", "value": "85d75873844ccce4eb646ba9b9538aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463671, "uuid": "074ddbd5-903a-42c0-9500-8cc99b5ae71d", "comment": "Malware payload (Mirai)", "value": "b07885a5082f44bbd2a977cc36dbe45bbf966be1618e1528e132ef90e140fc16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463671, "uuid": "92f3dafa-4e68-42b2-a343-b6cfc50dab71", "comment": "Malware payload (Mirai)", "value": "9f2574cc2b1522ce930238cddc8422587ffd4677", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463671, "uuid": "11e6bb56-1c20-427f-b3e7-9c35693af4a3", "comment": "Malware payload (Mirai)", "value": "f657a1922bf941234607f077e44e2bd9dd121ef5843297c3617dba5ae08b9b64117a34dca5ab92265237fe5fe5dc1f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463671, "uuid": "7a2e3bd5-1a5f-4e52-8e70-165360292bfd", "value": "T1CAC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463671, "uuid": "11dcb545-2235-4dcc-83ce-92cdd01e465f", "value": "1536:6GB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dwJ:6UB4exMF7oZKJnCNYaeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463671, "uuid": "5160f133-6533-4a79-a260-44ebae9485da", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463671, "uuid": "6909f3c0-d053-47ba-8d23-c71bfba93d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463671, "uuid": "ec61ce6f-c3aa-40d0-a81a-0608090054d7", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060f7a4f-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775472885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472885, "uuid": "cab1e07e-6086-41a9-bf0e-2416affc1267", "comment": "Malware payload (Mirai)", "value": "8a07ad5cdf87df04c16ce52c9254f05a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472885, "uuid": "955e2a4b-30e6-4365-9f25-dda4a29fe44b", "comment": "Malware payload (Mirai)", "value": "b0a093dd32a647419414cfde1f9585b8f0c5768261ec8b907e3d587af4871beb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472885, "uuid": "b1bd5dc2-455e-41b4-97a7-6db83b6978d7", "comment": "Malware payload (Mirai)", "value": "0cf5b77ab1413b3fca02f71117c185c12439802d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775472885, "uuid": "4ebda463-788e-49a5-bcaf-94f9d2690b5c", "comment": "Malware payload (Mirai)", "value": "ed83398ce008ede0a067d9a1b0caf0b123afc9dfe48f1f00df81da89fbd7c2d646d288fc085056421b2ca4db369ec7ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472885, "uuid": "160e273a-cb59-4b07-983d-c29f4a320571", "value": "T125E2E1D559B7A479CE710DBAFC774B4E252EC5FC85FB102267F4372423B09964AB0442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472885, "uuid": "c0828685-9d08-44f0-a5d6-f2c49493f786", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8LrtHMg9q3UELdm:zLJCmjpkcMKUBKLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775472885, "uuid": "3dd8f503-20c6-4013-b1a0-2e7dbc4275c8", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775472885, "uuid": "5671bd9f-4045-4b37-8da4-4aa6f490bc30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775472885, "uuid": "7615fe81-0e2c-4807-91e7-497e7e876e8f", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da9d6a1-31ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775474723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474723, "uuid": "c948e9d5-b164-410a-9ce1-6f4504e403e7", "comment": "Malware payload (Mirai)", "value": "9e87dc7550968563b245a2aa45a7c36a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474723, "uuid": "76b00bf1-1cee-43f5-8af5-791031cf87db", "comment": "Malware payload (Mirai)", "value": "b0a28d6b10f76ea94f3e995df48f773b53744eb553b5ca6023165a44cd1c1443", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474723, "uuid": "b7a18e33-af59-48f8-b0a6-590821593e87", "comment": "Malware payload (Mirai)", "value": "4edb0c2673dfc44ee1a4f1991def3137d6e039e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474723, "uuid": "de016c8f-6151-40ed-a77d-e598e2ed2b94", "comment": "Malware payload (Mirai)", "value": "4e528f68d523b48b339ddc5ddd84f6e6f9f3c877a9cb3e6e8775c283da3bc3a9cce545851c0d0d632e3ad3035eeacc08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474723, "uuid": "7596e591-287b-49d4-a443-4af64fa81292", "value": "T156534C02B2180A5FF9D319B0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474723, "uuid": "6ce77ba7-a805-409e-8912-ee0f5e4b82ee", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6iGv2:BET6Rq1gSmQ+LzDIiEbW/ogI9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775474723, "uuid": "d860e5a5-2bd4-4a21-a35a-496e396374e2", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775474723, "uuid": "ac85c136-f278-4140-994d-44f816bb3786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474723, "uuid": "3943f9ac-3cc0-4996-8f1f-bb260764e52f", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711de6f6-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463616, "uuid": "7ffa8298-16ff-45e5-a95a-cd14088c8da6", "comment": "Malware payload (Gafgyt)", "value": "24ac1344f7bd343040fd97c385605a38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463616, "uuid": "63931de3-d239-4394-82b4-49db1934a007", "comment": "Malware payload (Gafgyt)", "value": "b135ccb9dadede605fd0d2f9269d455419ca5fd6e01df71ed011ea157fc5d857", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463616, "uuid": "e1053672-cbd7-4f27-bcf4-f66847052583", "comment": "Malware payload (Gafgyt)", "value": "f39170d7e6f1dce4d11e24d2176355949dca0645", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463616, "uuid": "e6eaba5c-3f7b-4615-bece-382c3c7b1b19", "comment": "Malware payload (Gafgyt)", "value": "aadad6ca9f335f495548083c1800c9a3ff814d74ba2c283bf4bc5fc7c5ec4bb7ef5669c19f92b533eaef6c969089f269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463616, "uuid": "8ff5ce4e-2629-4ecf-8aa4-02e872be9ed7", "value": "T1C6B2D051E1988DD8D5FF78B86E5B92C113F04ECC69F25EC2B9834F4346E1E23A6198C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463616, "uuid": "32441f09-1ae9-4b7d-bc76-23e196a704e2", "value": "384:FhEr4cdaMwwmgFAIsvGtBOwDNfCrBHt32e5KcWM4uVcqgw0Og724kmWs93eSgPUi:FSr4co9VWaGXWHV2e5Kcl4uVcqgw0X7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463616, "uuid": "833c1dc0-676a-4c78-b518-c9d10aa83c6a", "value": 23688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463616, "uuid": "3f7755df-c4f7-4d9a-a46a-c29f3f3d63e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463616, "uuid": "b7a28177-4c0f-443e-918f-a50882ea662e", "value": "cali.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435ea024-3168-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775445930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445930, "uuid": "2ebfb6e9-b950-4b61-9e53-bfcf101e3cc4", "comment": "Malware payload (ValleyRAT)", "value": "1a0a2e2dadbeefea002ba849db952378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445930, "uuid": "95faeb48-ad11-4f7f-a61e-4ab9d558286b", "comment": "Malware payload (ValleyRAT)", "value": "b1a9d2acc0024ff545e60a25c8448984b9c125613b63a00123ac8667432d6334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445930, "uuid": "2604d155-b024-4101-8117-b97e902054c1", "comment": "Malware payload (ValleyRAT)", "value": "93d9d5590d74223bb6e0f37fd8119ac4bed92896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775445930, "uuid": "915c1361-c1f1-416e-b9db-93324da7d0e1", "comment": "Malware payload (ValleyRAT)", "value": "ac3be53ae1e10500157a55cf113c3a4d3953973d5fa294d0d1ec324a3b87da8cac338a35b67ed38da5666a06baf01423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445930, "uuid": "6740e148-1010-41b9-8187-23ffb6183ce3", "value": "T13BC6C0A0F412AE27F73BC0394421F76C9B5DC16B5E1790AAF4BDF6B06A257402429B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445930, "uuid": "6b58f91b-358b-44bc-b4e7-a00f3c27d528", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445930, "uuid": "c594010d-885d-49e0-910a-53fd3ae9799f", "value": "196608:DoJwBMxHinMo5xIY75ZJ/j3H4kyRD5R+PY8VaCYhRnsrTGctJms:DKWKHinLD1z/7H4pB5UPY8E3bsrSctJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775445930, "uuid": "af4c0eba-d491-4702-8f4e-baabe4b9f982", "value": 11669616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775445930, "uuid": "7dd89ba9-57f6-4e9c-937e-74a3390a277f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775445930, "uuid": "dbfc9a02-d860-4f3f-920d-55289012b5a8", "value": "1a0a2e2dadbeefea002ba849db952378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca00158-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442966, "uuid": "93acdb39-16ae-42ca-9b21-81f7871198d6", "comment": "Malware payload (Mirai)", "value": "8672d0692beab36161bbbeef4be55e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442966, "uuid": "33911359-5cf0-44ab-bca8-af07891e3525", "comment": "Malware payload (Mirai)", "value": "b25777dcf041513123bf96d9b44650e21f06f9ce869400437527ddc50fbbcdbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442966, "uuid": "d5f0cd03-bc2c-4566-a10f-9d4d939add11", "comment": "Malware payload (Mirai)", "value": "4a720c251d17742b5fa8bdf18fa3f6119f633c4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442966, "uuid": "c921f194-c25f-4767-a1de-4e36804be260", "comment": "Malware payload (Mirai)", "value": "180279c5b1a9a60dad545fa46fbf0fd93ba72ddf65ff41f6f61ed033d720d4271cf826ab3ae8f1c81577169043369e4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442966, "uuid": "7a646ddd-75d5-4822-ab07-49dae65689f0", "value": "T160F2E19318784108D06E11790C77FD8E84B0CF69C5A985F64BA4B523C95BFEC395879E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442966, "uuid": "9c7d644d-d761-41e7-8b0d-73332ffef414", "value": "768:WCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIph9ornbcuyD7UHQRj0:WBGbyqhXrTBrQX4oExYnouy8HyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442966, "uuid": "3a059430-1250-47f1-9e4e-ff642a77a475", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442966, "uuid": "ac72ac40-da34-4347-b57d-5989bc5f88bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442966, "uuid": "751285ab-0ff0-4754-a889-58d4b6beca2e", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb890a75-31fe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775510636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510636, "uuid": "e05eb59e-55a9-4216-9954-2f6c2f773703", "comment": "Malware payload (ConnectWise)", "value": "f039b0caa008430e951cb77f1eb1d7b5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510636, "uuid": "2c7e720d-7b56-40e0-8af2-e37465120855", "comment": "Malware payload (ConnectWise)", "value": "b5ae40e79b10de7a0ca4b40a98e548ed50e7bd9e5c434880cc081ca6873d49d7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510636, "uuid": "39673c86-e426-4006-8eb9-8af32f5e9fd5", "comment": "Malware payload (ConnectWise)", "value": "9a315f7efcef39a521c673760845e355c9cf4019", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510636, "uuid": "e7de78a5-2249-4ac2-a1b5-868e8b9ee2dd", "comment": "Malware payload (ConnectWise)", "value": "0524a7d762097a8d5493aba63442c1aa8d9b39e0659c4761d1be97f7a697f3be1e9beae7a2f23decb05df4ae610f4778", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510636, "uuid": "69185b02-31b4-4f2a-8002-50f8b347e0de", "value": "T1612723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510636, "uuid": "91758a00-ddaa-4f8a-b837-c87ee198ee8b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510636, "uuid": "4e3ce280-4678-4911-bada-8e5735c30655", "value": "393216:JhMOvTi7hha62f3N11lOvTi7hha62rOvTi7hha62IOvTi7hha62g:JhMOvjf371lOvjrOvjIOvjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510636, "uuid": "40072b65-f055-441b-9255-45832addd098", "value": 20511288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510636, "uuid": "274c9b9a-918c-4dbf-9a3f-b146c9f6479c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510636, "uuid": "d7c22499-adac-4b90-a02f-d72a976d0afe", "value": "ScreenConnect.ClientSetup2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb612eee-319a-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1775467686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467686, "uuid": "d91188c7-dcf6-46ae-8e3a-a5bea7f71234", "comment": "Malware payload (VioletWorm)", "value": "3c28a5dd2cf5d5f0f4e24f6437fe70da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467686, "uuid": "7a3f3c03-fd1e-4500-9d4e-f1707f00056a", "comment": "Malware payload (VioletWorm)", "value": "b69c825f72a6a7630a356a90f5a4ca044960c475964a75d7c743ac0466dd81b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467686, "uuid": "ce4d64d0-7412-48fd-bf59-f84bf21371fb", "comment": "Malware payload (VioletWorm)", "value": "c061ab2e8778183482dcb2792d28449e843e272c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775467686, "uuid": "7d7ec9a7-876a-4f92-9c40-c9a9e8ba3c52", "comment": "Malware payload (VioletWorm)", "value": "d4b9d7834c39789a22b197acfc5d0f7a2d21aee60eafa46354a00f907ebccbc812efa2e10160435bd78a9c3e51969807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467686, "uuid": "5b68b240-43de-4e43-b4ac-8f1c33b49285", "value": "T12A53D5D532778872D27FAE7AE6C7224B6DB54173A801D5460CD276D36B02F82C90ACF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467686, "uuid": "10bcc55a-b74c-4eee-9335-97a7cc9b0a11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467686, "uuid": "4224c7de-c821-4c58-95c3-5f7e2ba3f8d6", "value": "768:XhQXs5Bx2EOwnyna+NIA/MVtR8E9b5sMoe96aPN+mhBCZrsMV:R+sR2ELnynH5/MVtRp9b5s1aF9M5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775467686, "uuid": "5b5622b6-a859-4574-b205-b8e057a5b673", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775467686, "uuid": "1947a57e-6859-497d-9f72-c671793aa921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775467686, "uuid": "773f224a-77f2-44a8-ab25-dc9061c0c224", "value": "SecuriteInfo.com.Win32.MalwareX-gen.31954327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75f8a47-31c4-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775485745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485745, "uuid": "c0f79347-c088-471c-b2db-bd4e553c4901", "comment": "Malware payload (StrelaStealer)", "value": "2cd1d905c3b5ab0fcc6b85282511fe3c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485745, "uuid": "851b8626-5a63-4261-a254-80de3bfa8621", "comment": "Malware payload (StrelaStealer)", "value": "b6d89d2122cf96591699f6d423c75e2aaaaa2711183b907c4f4794c5a4a398f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485745, "uuid": "39aef4d9-7d06-42c1-b770-b78935aeb926", "comment": "Malware payload (StrelaStealer)", "value": "99b77f06cb97487a9014a9161946cdeedbd611b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775485745, "uuid": "3ddf7f65-5812-4a3a-9bc2-a85a3aab5eea", "comment": "Malware payload (StrelaStealer)", "value": "eab1d66df95ae56982207b7da440781b83a179d082a70ad7275022910d5f268966b6b51fd10424080a8f17f10dea66bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485745, "uuid": "b3380c2f-efbf-4a3e-987c-df981edf8f74", "value": "T13A53866D87FE8228E66F9AF48537EAAFCF304352CC3026D1257D55EDC958B29708D488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485745, "uuid": "3e2201ee-82b3-475b-9f72-35733739d281", "value": "1536:voAwzmlbvIxflcu6rtz0wAtzENZ7FzEy3tvqyBVw6u/yzG28MJY7gz0ejig+tz0c:voAwzmlbvIxflcu6rtz0wAtzENZ7FzEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775485745, "uuid": "ce4f628a-7920-4afa-8125-3ee24e9d6702", "value": 63835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775485745, "uuid": "1136d9ee-ed79-4088-a4ce-3283e7fae5dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775485745, "uuid": "e5d5f010-c729-42f8-9e89-aaa32c67db1c", "value": "jobrpt_BONCDE_WCOMP_45058_pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647a2992-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload (CNBackdoor)", "timestamp": 1775501390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501390, "uuid": "7b018adb-3442-4b62-a59f-b68429eb5982", "comment": "Malware payload (CNBackdoor)", "value": "045455ed25a2bd208a781d72bd829281", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501390, "uuid": "bcac3307-236c-4ca5-9037-7a404b303b61", "comment": "Malware payload (CNBackdoor)", "value": "b76c5a4e63236a7275617ca568fed21c69b4e970a9919b112d957d63ed7fac1a", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501390, "uuid": "1e13abbc-ecb3-42f4-88f0-876f5aa2bfa7", "comment": "Malware payload (CNBackdoor)", "value": "216e5e2fee22a400ebdf964d31d4ad363c3bfbd6", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501390, "uuid": "065b24a6-1daf-4182-b52b-3a406322a0f9", "comment": "Malware payload (CNBackdoor)", "value": "3953755e72b26886e5407cf6fb77c4f68fb0ba907d84b53f20f297eab05e936854a8ad031732a5d5f6163554f349225b", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501390, "uuid": "9fa8fdbd-58c8-40b8-b189-fb3795a2cfda", "value": "T1B517338B6664A469CE772BB3923945F350388F3DE3754C1738EFB4A61BA3D64A411F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501390, "uuid": "f9d936d4-1e48-4781-bd0e-6578d63eafb1", "value": "393216:SFE/p+tT+DBG6hCowKcyh3gv1FHsZ+hIlUgQPpU15Xz6KjpoY7lDdEb:SaQ+DBGRpKSvs4Iwezjd//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501390, "uuid": "49eb91f9-3a63-4095-a97a-f8e9ec6a14ee", "value": 19814400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501390, "uuid": "1da30f9d-8449-4110-8a27-77eedf24b63f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501390, "uuid": "75f80d59-cd62-4965-8ef7-c1b304591746", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03adf1d7-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775515831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515831, "uuid": "053917f0-2cf8-4f2d-a274-6376f933ad00", "comment": "Malware payload (Gafgyt)", "value": "8aadeaf8a3d4b3b21638b3dc511a078b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515831, "uuid": "3e76d95a-e351-43e0-8b33-f1e32ff8273d", "comment": "Malware payload (Gafgyt)", "value": "b7fb5a5d78431abfee0b69d44a8c0181df8dd588bca93694890aa8b0a3c75ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515831, "uuid": "81f15501-9461-4960-8f4b-4d00f1baab10", "comment": "Malware payload (Gafgyt)", "value": "ff446a26be1cbc1857b98024aa845b79d0464acc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515831, "uuid": "9d8057d9-5a6e-48c0-b8a5-1e19ace4c27a", "comment": "Malware payload (Gafgyt)", "value": "834b102abcdb33994a9d7bd79e24e3b31403aa1d4746dbd9fb13cfdc9e7ea0d836bcb5842038b12470bb5c80d8eb8aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515831, "uuid": "13c959b6-e4b0-4782-8521-ffd13844154c", "value": "T189831946BD418B03C5D321F6BBAF418837266BB9D2EB3143DD2AAFA123465D70E37650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515831, "uuid": "df38ea92-3815-4f21-a2ae-17fd0d8a346e", "value": "1536:+W3vamZ01/zn7PqMNBbrB4wMkE7tD8ii5gUiE5xJGXzRSmvYmglJ2T6SIpG2aV1C:i4f39vYa2haVhAtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515831, "uuid": "e6c93175-bb6b-44fc-ac97-bbaa4aae195e", "value": 87956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515831, "uuid": "e54f68b1-4d6b-49ea-98db-7d9a08bbb126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515831, "uuid": "780587a3-161a-4bdd-9f84-d5b1e46715c2", "value": "SecuriteInfo.com.ELF.Downloader-DN.67419851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a83ade2-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499656, "uuid": "3ca04be4-7d65-4e39-b712-01ecc81f3ca0", "comment": "Malware payload (Mirai)", "value": "f6342a8919377614350502b39b3d5467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499656, "uuid": "f8c47a81-19f5-4ea5-ad06-49cef2aacb8d", "comment": "Malware payload (Mirai)", "value": "b884146fbbf7d3940de63f90aec940d843a0bceacdb9b18c2ba16240175fbb53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499656, "uuid": "d420399f-cb8f-4f3d-9d91-00d9cb7a3020", "comment": "Malware payload (Mirai)", "value": "2aa7d817815a5c6a9169135553dc18c572ac4766", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499656, "uuid": "1eea40c2-41d4-4e7b-99cb-6740a48c7931", "comment": "Malware payload (Mirai)", "value": "8a911d40569bef944ab741938f4ddf0792c1f998988c2ccb2ed8965ea111e1b4b005e6b913c556fe705efe2fdb297abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499656, "uuid": "2d152dad-0082-4356-9253-7bf6f7a1335d", "value": "T1AC932A86B9818B02C4C311F6FB6F554D33136BB8D3EF72128E24AFA4278A5D7097B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499656, "uuid": "10b05a1c-bfb0-48d3-af17-7a3ec1ea8dbe", "value": "1536:6SnVyOKtITm2DjuSKpkt+GQxsGxG5IkGgM4kQcY7+Wrco2tBgZvdCuT14c2jlaZp:5ryyZOSBTOPlaQyuqpXs6uI9pFdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499656, "uuid": "430f77ee-059f-489f-b06d-e5c05b756cb6", "value": 91200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499656, "uuid": "013429db-eab7-480f-8372-99b637f6fbb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499656, "uuid": "4bdbeae3-8785-4d3f-aa3c-3804001962be", "value": "SecuriteInfo.com.ELF.Downloader-DN.45542854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edc4a39-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499636, "uuid": "9d2d5e08-a7a0-4b9c-8e89-beac09191cde", "comment": "Malware payload (Mirai)", "value": "2fe7c35418a174ff07f9693b82f32f85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499636, "uuid": "aac65038-f2ec-4863-b60f-3106a159010b", "comment": "Malware payload (Mirai)", "value": "b9a20761bb4cc68fde5a918383f4b1e69b5c376e8748487746f11dcf2733f241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499636, "uuid": "206f16df-8da7-4c71-8678-dccab5401199", "comment": "Malware payload (Mirai)", "value": "4a6dc4785aadc3ae089a15a5e996daa216eca60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499636, "uuid": "65d1b0ad-3632-49a5-a260-9ec169d596ce", "comment": "Malware payload (Mirai)", "value": "164de5768ec8d44c0abaf0b0061523f9ed74a47e370079749c9464cd54d66b7f3e7e8fb0593cacc4b11bfda794e6f08c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499636, "uuid": "3474f441-d348-47c4-b29d-03eda56d9945", "value": "T15F833927BE724F27C4C271B522F30B38F6B5AB9A1C78411ABD612DCDAB641D031567E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499636, "uuid": "42f661be-587d-453d-a7c4-282772f7ba64", "value": "768:R6NlFYO1cREMqYIftIaze+XXs9uO+lM5VJU7obIi1t81b+aLtuuIF0:R6NlOO1cREMq7ftIse+HBlM5NZtstd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499636, "uuid": "f35a580b-0384-4034-832f-9ff30b03e386", "value": 83516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499636, "uuid": "67970ffe-7750-417a-ab98-3383d6968e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499636, "uuid": "7a7c7c82-6db8-4dc7-a529-9e0e9886aaa1", "value": "SecuriteInfo.com.ELF.Downloader-DN.16328145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cf673f-3188-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775459975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459975, "uuid": "447baf75-4760-4208-9b71-1efb45742a96", "comment": "Malware payload", "value": "85a89aeacf1dcda418572a09ab753d8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459975, "uuid": "e7dec9d2-dabe-4de8-9361-a084fa8a99d5", "comment": "Malware payload", "value": "bb4556d15c9d4e127d0964d096b744ba37abab2e1b52a9c18a7ca9c822a98479", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459975, "uuid": "0d1b2332-0e8b-47fb-9238-47b12fe2d6d1", "comment": "Malware payload", "value": "980f8dd575ec8aeeb07caea7b0babdfdd22156ba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459975, "uuid": "37b1b0bf-ab50-4b82-b2be-a2259a659f8d", "comment": "Malware payload", "value": "13206b5dd06fec719070c0238feb71620083c40c08833ffe89951267cfca0794ed9fc4923eff26b416b8a0d180edc4b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459975, "uuid": "10496526-558d-4407-ab84-24463a084199", "value": "T15786021189C42FB9DFEC5A1C80FE1A1EA3F14A9E5016B989EB33BD47AFE7504110B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459975, "uuid": "81dd4411-7b94-4b59-9323-d61a24408402", "value": "49152:M4WgPEusQgy3ryfSIel5BxzYASLkZKaJzyQs9NqJaX4WgPEusQgy3ryfSIel5Bx5:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459975, "uuid": "d3477a54-1f2b-4556-8555-4479b587bba1", "value": 7858384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459975, "uuid": "ee6a94d4-19ce-4fb4-a48c-fd59c3961a46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459975, "uuid": "9edf81a8-4fa7-415c-9d7e-113f002c7c72", "value": "RFQ Import 03884 - QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e851e763-3206-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775514067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514067, "uuid": "4efac6ea-c564-45d0-b2d9-d63619bb006d", "comment": "Malware payload (Mirai)", "value": "bb60022b64da059835da6c7da853a59d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514067, "uuid": "d9382a45-0f7c-4d5c-999b-aef120795d5e", "comment": "Malware payload (Mirai)", "value": "bbee397f1a2b90daf3087b5001c4cda6f15b02415b872bb34915d6735d7044e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514067, "uuid": "66ec9c7c-8f65-49a4-a333-d05ba40a8112", "comment": "Malware payload (Mirai)", "value": "0c7baf40d0cdcd6b8af9f7e62551553871ef6f0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514067, "uuid": "46d21c61-4a5f-405b-81fe-4a36defaa70b", "comment": "Malware payload (Mirai)", "value": "fdaac87bfef2b5c00a33beb51962585b18adeeb9d23bf7f5721fe224fd00e80d9476cb02de5325891d5da00a95c2a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514067, "uuid": "973830b0-454c-4e71-86a1-0ae827547c71", "value": "T1DBA3FA0B7E128FEEF26992754BF34E31E65877E727E18581E25CE9401E202CD581FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514067, "uuid": "c3d64338-3ed1-4e6e-b8c6-bacb02be2fee", "value": "1536:NGk5p8/linxkM6Yb2ie8A6fLNToE1BkWdVqQ2RPxJhxEeB0PTRoTMUTQ+feBXQXK:NGUxaRVNYPSTMUTQ+CQl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514067, "uuid": "81b297eb-53bb-471c-966e-5807b7b396be", "value": 100248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514067, "uuid": "fd9f1bb0-096b-492b-b788-10def74ad654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514067, "uuid": "6518c231-5984-4a26-bb3c-c8a6178dd7a3", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a2598-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442998, "uuid": "39f2ac9b-7f4e-4c63-9a97-13238fc9f679", "comment": "Malware payload (Mirai)", "value": "66c79437c2caf73327cfe662dcd07795", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442998, "uuid": "4b164d44-53d4-4b64-aec9-632553d2694e", "comment": "Malware payload (Mirai)", "value": "bc58166ff5de11853bfcf195f45caad586119214f7bcaa6f3829ab820442952a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442998, "uuid": "575ab2a6-366e-4bdf-9d97-5948ace1fb71", "comment": "Malware payload (Mirai)", "value": "1cd49d880cfddf52c98a2735c4377b9e74a3c1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442998, "uuid": "d2f734ec-213b-4c5b-8898-c4069f1cc09a", "comment": "Malware payload (Mirai)", "value": "b861e8bea1106c899a2050a3df4ce67165c48055021973d9d9192e514daa308cad39ccb2d31a0c5307cc125bfcbd9c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442998, "uuid": "39509e77-9da6-494a-8256-0a466625c6f1", "value": "T180E32C46E6414B13C0D21779BADF42453323AB64D3EB73059928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442998, "uuid": "d52ccf34-99a4-4929-afc0-2b16975f86ef", "value": "3072:szUEbxeByy5aA0U456e9ZElTnXRzUJhO/+UeLsM/9guJCVF:szUUeM4aA0U4566GlzR4Jc/+pYM/9tUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442998, "uuid": "e5fc9922-48cf-4a27-b946-fe459755405d", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442998, "uuid": "824098b4-84ca-4d5b-a0c5-971d12c7e42b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442998, "uuid": "2915299c-73a3-42c7-9019-96ce2a54535f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09339e61-3206-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775513693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513693, "uuid": "38023a51-861e-4f22-b8a6-26e56c29690f", "comment": "Malware payload (Mirai)", "value": "f16d904d83b3c10027ed9816ead864f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513693, "uuid": "5e02f61f-b8ed-4e90-a6db-71022d2887f5", "comment": "Malware payload (Mirai)", "value": "bcc6628076dd11bdeb82a82a2f408eccfe645713b211f94d237c263f7ca1f641", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513693, "uuid": "03b90172-fe76-4634-aa1b-26243c840b9f", "comment": "Malware payload (Mirai)", "value": "1841a30a495b78ab266860879856f57c71891239", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513693, "uuid": "9d17415c-a86c-4339-acbe-67ca24026d5c", "comment": "Malware payload (Mirai)", "value": "13a88857300808a9ad2f6fc0bcc0eea3eedc6d019f055e451a000ea8fe63bd31a3fcc9f7e5895cab15ae738a8eeea7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513693, "uuid": "75822631-0e18-42fb-90f6-4eead110ad36", "value": "T1C4248D03BF454D9AC6AF83B51ADB97318623F4350753BB8F73A828E47E062D8AF55604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513693, "uuid": "58ec9705-a76c-4cc7-8d5d-327cec653a91", "value": "6144:gD+kE62tek9sTOpP/Fw4bt+ephHVLWZYfA5E:8+9ttB9sTM/q4brphHVLWZYfA5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513693, "uuid": "b29a3d9c-8390-4dab-93c1-76f6de46764e", "value": 224293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513693, "uuid": "5004270e-8836-4c8e-be21-8d51e6b4230b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513693, "uuid": "fcc9aa03-8ce3-41da-bb38-30ede7de3c1f", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9205732e-320a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515640, "uuid": "64b96c34-6b83-471e-9e79-7bf57b467794", "comment": "Malware payload (Mirai)", "value": "8506b6eba4aecda73c86d4134c043e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515640, "uuid": "d733a5fa-58b8-4f38-8cf6-3b157f1a3832", "comment": "Malware payload (Mirai)", "value": "bd76539a41baab38dc1fb704073a6933b93b3bfc0288b3211b082101e67911a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515640, "uuid": "9ce68b26-aefc-46ab-a30f-7235d2c50142", "comment": "Malware payload (Mirai)", "value": "876975bb6b57f628d2b654420bba656b62e77804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515640, "uuid": "1e6e500c-d89c-4326-8885-027e3943b8a1", "comment": "Malware payload (Mirai)", "value": "14ec1548ab6bf7ef351fc6b8c56faa63932c96571c7df5dae1abb8d313cbef9dce478e8a1a6b268ce89f6e3808e926d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515640, "uuid": "515dcb85-a72f-48bb-856e-da952cc502d3", "value": "T1C4C44959A8419791D5C02BBBFF1D934873131B38E3EFB106AD196B246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515640, "uuid": "b562d6b6-a727-4bc6-af98-0d88b78ca3e2", "value": "12288:SDyXKI4LGxVPbHCs5yLgEYKHRSG4t/ZLSsVclynyaUsWL2spP8ABT7qAh2i:SaKLGnbHCh2G4tFVG1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515640, "uuid": "fa03303b-f62b-4cf6-bbbb-a801d1bd68cf", "value": 568592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515640, "uuid": "dfd2f8e7-d674-4504-895f-5af8f29bece7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515640, "uuid": "4831e43f-84b8-411e-9546-00f1effd0e87", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6476c35-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775501581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501581, "uuid": "86410f94-fdc2-4db7-807d-ca43785651aa", "comment": "Malware payload", "value": "fcfad51db32121a21b24d1d641779940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501581, "uuid": "995a7d2b-f343-4063-b596-7b04f78fbc3e", "comment": "Malware payload", "value": "c1002d61b6abc7d87158b28c829c9bca9bf862ba1fbe2994405a865115150485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501581, "uuid": "afc97d2e-cc4d-4bee-a6cc-350c93f95e39", "comment": "Malware payload", "value": "aaca01cb14607f202d2f4675c141b4a103cd2a0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501581, "uuid": "50d7b3a0-2340-454e-9ec0-41ca7cb341f5", "comment": "Malware payload", "value": "68c1c7b8b5ee4a841f59ff15eb6975030020a3e484b8430bb3c8c8d49e8db5d0c02232e02a71c134337c9e302ce2d339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501581, "uuid": "282b8112-8e18-4d00-b3d3-97f01d56ea57", "value": "T18433F945BD829906C6D84377FA1E42CD331173D8E2ED3227DD153F52BBCAA1B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501581, "uuid": "1c072aa8-7d9e-4b7d-937f-c7d4be2c7880", "value": "1536:GcYZ7LMohtjgj4oa/RbYrdV8iCqwbZnH:XYZ7RhiEHRbU+qwbZnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501581, "uuid": "d1d412f1-9db9-4123-8b5f-9120fd2ee69f", "value": 51608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501581, "uuid": "cdcfe043-e626-4c28-9dac-0c398822e89e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501581, "uuid": "1bc5bac4-0457-4dc8-bf53-e7814697e0cf", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72035d9e-31b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775476932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476932, "uuid": "e190f6e2-ba62-44d8-a1b9-9cd1cc02453f", "comment": "Malware payload (Vidar)", "value": "bf508eaea100c1af1c175e0e65505d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476932, "uuid": "f0a84e00-597b-40ae-be54-91487545e980", "comment": "Malware payload (Vidar)", "value": "c221a46d0f3abd39f3be35a1b1f638f716f9f6697ddd23733f11ece168725282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476932, "uuid": "941f3fc2-8c86-4ee7-9f71-aa5a00d7bf89", "comment": "Malware payload (Vidar)", "value": "65c4e8d7ff90e8f0e02f9954ac3c1ec404b6cca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476932, "uuid": "81eb236a-ee9e-4fa6-a545-a074a7454e89", "comment": "Malware payload (Vidar)", "value": "d0c5d9408f0d7e0812d602edaaec8776fef36e0539f2e64ff36503588e6cada6707a986155718513603ae3a02038feae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476932, "uuid": "511b97c3-f3ff-4b39-9288-2c675dff741f", "value": "T19C05122B73A431F9F566827AC6528506EB7678710B6067EF078887752F13AC14E3BB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476932, "uuid": "3275b0e1-78f9-4c96-b973-a3e9f53c14c2", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476932, "uuid": "77516552-c038-4051-98d9-d305bb63586e", "value": "24576:/eJH6iRyi3hCX9+eeP8+XgpFto3ampFktTP:Vit3QX9+bPVQm3Pvk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775476932, "uuid": "52f9e9f6-8769-4e2a-afb6-17f67da3f9c8", "value": 825203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775476932, "uuid": "349110bb-c5e7-4dd3-9e98-c6da1ecc06cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476932, "uuid": "6483d90c-34e4-4f9c-ac21-a292ad9b0a7b", "value": "v4343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546bcb3d-3187-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775459273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459273, "uuid": "9a9d8438-f3a9-4c23-9c0a-bd5267daf964", "comment": "Malware payload (PhantomStealer)", "value": "f800dafdc93c5a77d7b7294436f51da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459273, "uuid": "5efeab31-ec78-4e11-a426-27fc634a5000", "comment": "Malware payload (PhantomStealer)", "value": "c2cc4c2ce6a02ad96869f46b08c74f8ff6c56b915b3312f306996c716a6dd627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459273, "uuid": "122ee9db-a3a5-4ea2-aa04-817b3639f936", "comment": "Malware payload (PhantomStealer)", "value": "3bd1154e73f636b6b7698e3621b62e5faab9fd47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459273, "uuid": "0c5a1f19-0f90-46c4-a662-5cbf98529b15", "comment": "Malware payload (PhantomStealer)", "value": "625cdb1e77c67cb7a27bed1836aec486672d7a44faae86fe2dadb0649a959b2bb722ac8dabba1a02d5a61e011bf1ba7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459273, "uuid": "7b8eb611-8d42-422a-a041-ecda82d4ae5e", "value": "T1F5A512457706CE59C862ABF40D31E2B107F96D842411E207DEF67FEBBD24B12AD62A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459273, "uuid": "460a5130-2396-4d51-a40a-0cf3ed8c07ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459273, "uuid": "cec1ad58-ab91-4a3c-a70c-b27c397bb971", "value": "49152:hRqUwvJ1MIw+y8s1mZ9s0DGfJ6FzMwFbtr654qCjsfTarGZ:3rwjVwQs1h0MwdV/cfTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459273, "uuid": "f14c21f6-6b11-47c9-8e06-0f3b24877c12", "value": 2079744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459273, "uuid": "41540f41-3bf4-4289-92a9-dd4c24b86e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459273, "uuid": "59978157-502c-4697-bd7b-fdf08a84df97", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e74b0d0-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507286, "uuid": "1718ff26-f57d-4974-ab76-5497e397ab72", "comment": "Malware payload (Mirai)", "value": "5af57b99889f858cd7ae0aa49db3fd44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507286, "uuid": "8c681bcf-f1f5-403d-ac59-afed49e0587f", "comment": "Malware payload (Mirai)", "value": "c46d8e4ba4aaa165cbdf8e9bfdd85aec04e042a9effd33a5dcd4aeda274fee62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507286, "uuid": "e3a0be2e-7d34-49eb-8228-a10ce636d134", "comment": "Malware payload (Mirai)", "value": "88a1cba3c3b819f3c920f666718d33d02777caf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507286, "uuid": "a8286672-e558-439b-848a-66d543cece2b", "comment": "Malware payload (Mirai)", "value": "97afebb021d0fccbec1459918bc5214bdbf44bf98c04b3d2189b7c14ffb7d10d7219ed518d26ba2f578f28a78ac44bfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507286, "uuid": "370a8e5b-e790-4386-ae6c-ba4671d72e99", "value": "T1A2931A86B9818B02C4C311F6FB6F554D33136BB8D3EF72128D24AFA4278A5E7097B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507286, "uuid": "63ce6d62-6b92-4077-b485-391c79a03274", "value": "1536:6Snv+twDs0uTZQb6Sn2YYLlW2dl2F2jVGGyIgG26OiWKhZg1Jhidd7+hv9zaz+rk:QhTi5gPteL9zaVUympeS6feDGdBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507286, "uuid": "7036e3dd-7984-486f-8257-644ba6073f74", "value": 91200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507286, "uuid": "2e1b34b5-832d-4e23-9fe6-bb3ef6ea1620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507286, "uuid": "2dc1e87a-d8da-4775-b9ae-6f736cb9be23", "value": "SecuriteInfo.com.ELF.Downloader-DN.39245212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e974273f-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463818, "uuid": "7edbb899-9737-429f-88a0-588a98c1ea96", "comment": "Malware payload (Gafgyt)", "value": "c54bdd03d8783ed9d97a0f8a1cd8c788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463818, "uuid": "a90fc021-9af8-4654-bf40-457474dcda66", "comment": "Malware payload (Gafgyt)", "value": "c5b64fa574c180885ca777b31dc4c401d64a29838e49290f34dae08ea78eafc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463818, "uuid": "ce4d95cd-ddb0-4253-bdf6-0122a5c5cb89", "comment": "Malware payload (Gafgyt)", "value": "d8943a812a7405e43384c29c285ea9471edc9ccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463818, "uuid": "c417655d-1a8d-4951-8aa7-abc6003857a2", "comment": "Malware payload (Gafgyt)", "value": "190e1507c0b209286783cfb109e844bd92cd1900608166654b98cfbb9ccc183a5101441858c8fca57e8299bb96db7645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463818, "uuid": "3aa28e67-658d-49c5-843f-9fc58e8de30d", "value": "T16283645BAB619F73DC5EDD37029A4502208EAD5A02D86B2FB274F51CE7BB84E08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463818, "uuid": "224f2813-381b-4fb0-8694-443a7790bdc3", "value": "1536:Y2MXeTUgMwUAgRrCeZ9WCoHhT4bFPvclMh1msI4beapa2:YZZjkTlMh1mCCapa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463818, "uuid": "c9aee6b1-70db-42f6-805b-7923c315850d", "value": 82161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463818, "uuid": "94148cff-45bb-4317-b733-be56ccc12bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463818, "uuid": "f52717c1-dfb2-4095-92bf-0d2b6fa0cda8", "value": "cali.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43740963-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442923, "uuid": "c6ef6902-9da3-4fa1-8d3c-2567700e5443", "comment": "Malware payload (Mirai)", "value": "a2167032aec6be518bbad9e8805a5de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442923, "uuid": "848026bd-640b-40c0-8bc8-c5f3ff2c6c88", "comment": "Malware payload (Mirai)", "value": "c5dbb60ea8f107607c668d45b5e8529791c7b7c2532d1fcf5f0d67ad26f0fcf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442923, "uuid": "151454a8-1925-44a4-843f-50fbbc898e33", "comment": "Malware payload (Mirai)", "value": "b52e04be712efc847b6d794effc7f055b9e02614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442923, "uuid": "01a1c1e0-0a09-401a-babf-0bbddc3a2972", "comment": "Malware payload (Mirai)", "value": "7a1bf8701b42c807c20c8dfc2ea333ede7b295c5a6eb4aecfdf02e1519dbfb1c4c04435a277a67833ca7a500102d4226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442923, "uuid": "25791b0f-f246-4c1e-a207-1272945da15a", "value": "T105E2F177B05EBA7AC6B03EBBECBCCB8213071F2854653A012F2741524193C57D6B6643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442923, "uuid": "71944750-0ea0-4097-a124-ed8d3403a3c8", "value": "768:OUd82887B6jaYxJBgEPPGPr/h6LV6rTk3SHirXs3Uozk:OUd8L87BuB5mPbLrTk3SCezk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442923, "uuid": "a40b2208-eb75-44d7-bba9-9ec325833d1a", "value": 33904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442923, "uuid": "b8ad25b4-4ae2-4191-92a2-5813b1846160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442923, "uuid": "db451f13-1f2b-48a0-8d64-58e7f65942c2", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9a5015-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496926, "uuid": "a186cc40-f131-437f-b3ed-b334c3828e6e", "comment": "Malware payload (Mirai)", "value": "f76362b5bafcde2f40a27f42bd8f44ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496926, "uuid": "7265b8d2-a859-449c-8af3-9e1d5c783ae7", "comment": "Malware payload (Mirai)", "value": "c6a8291f77c7baa4d32a00555ca7882bd4ab9dad63b329be8cfc01a816c2bdf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496926, "uuid": "fa6d98ae-6616-48f9-b7d3-6f4deaa513dd", "comment": "Malware payload (Mirai)", "value": "428bb27ac0bd3cdc89ca140a6df2e5428abd9daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496926, "uuid": "a12e3b80-57e5-471f-b1b3-49162f267a18", "comment": "Malware payload (Mirai)", "value": "fde206af58e6bb7bacf33e2c5eb966e15530c8432040e36a26f60bd6bea46b83139670140a7a2e9d070dcd3a1161eef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496926, "uuid": "46e34acc-35e1-48f8-b23e-d1dc14e9205e", "value": "T154831986BD418B03C5D321F7BBAF0188371A5B69E2FB71439929AFA127474D70E3B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496926, "uuid": "ef5980b8-d62c-4e33-b216-b8baa21141e3", "value": "1536:AiB4xCgjqdD7px7H+aiobS0ocwERPCe00p6XXwQnmcrnZyNGlVqOLT/d/Ew1hOLg:J4GZKyxEGw8Mh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496926, "uuid": "57ea910c-f048-49ae-8cfc-f3420ccdc165", "value": 86348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496926, "uuid": "ed796db4-e89f-4f6e-b3d0-9746e2c61e43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496926, "uuid": "e6ff451b-7415-4188-82d3-558749e4183c", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61f0006-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463732, "uuid": "4aec6b3b-cbcd-45c9-905c-d80995d271bb", "comment": "Malware payload (Gafgyt)", "value": "8d2a309fa0867f843aeaedb1a0ac4b00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463732, "uuid": "cb0235d9-dc0a-450b-adf1-0ba1d1d93c8c", "comment": "Malware payload (Gafgyt)", "value": "c74bda6c601c08802724569b523ab94f2bff979d6ae2e1972a618dc4e303a08a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463732, "uuid": "fef787c5-512a-40cd-93f6-dd7a97b88cb0", "comment": "Malware payload (Gafgyt)", "value": "450910d8b766ee62358575e3e837d8a1c48d395e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463732, "uuid": "710b6332-aeab-4d17-9a59-02ade4c7c446", "comment": "Malware payload (Gafgyt)", "value": "c37c30558371b651abf90984a870374f9b5450fd6712c7c538b801e11f93bc107098010ed7409c0a9f2c219596da94be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463732, "uuid": "fe9a18b3-560a-4fe3-a509-dfe987f2f1d8", "value": "T17C43F88398A26FB7C055AA75297B19240717FD121F4F0F8A252CBAB5477F1CEB40EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463732, "uuid": "347a34a0-1062-46a5-9f7d-8931065d8867", "value": "1536:dyqltKwUPhB6GrrbOmc0n6ATW1CQRICQBBJ3f2:JltknrrbOmc0njTgC11PJ3f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463732, "uuid": "79bbd59d-c743-4e30-b677-99cbd0e9163a", "value": 58674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463732, "uuid": "6d174976-2f7c-4693-bfa2-d465b6069904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463732, "uuid": "5b9a44f6-bb8e-4b21-9a40-1ca4afa6bfb8", "value": "cali.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d50a0c8-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442940, "uuid": "838296f2-2091-4ba7-824d-af9ca8ce5480", "comment": "Malware payload (Mirai)", "value": "0f6500be39ea0ffd80371913a873dd6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442940, "uuid": "335ac15d-9d14-4c76-8e49-3b003fb243a0", "comment": "Malware payload (Mirai)", "value": "c8a68b9efad18b1d40445ccb470f894ad954daee0ed642daa9bb2bb3037d8d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442940, "uuid": "bb4b39ee-8318-471d-9a02-109b52df5b3d", "comment": "Malware payload (Mirai)", "value": "0e5523d441eeb3513b582dd058d36df0a1b629f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442940, "uuid": "32f5ab91-ae2c-4273-a0f3-1fe9b266c91e", "comment": "Malware payload (Mirai)", "value": "34b598818178adaaeb40ea4a045f1851168dbaaefb63eeb0746745696edd085b42d60c57f5d64046b17954d915ca56c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442940, "uuid": "cfd59c71-7a58-4b8e-ba01-032134cd0467", "value": "T178F2E174D1DD4FE2EE99CEB427D153DABAEC0F4B1715CC9331028F918B05811899AAE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442940, "uuid": "cd8fd419-27e8-4247-a1ef-e728c5773127", "value": "768:seDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu23oD8wg4uVcqgw09z:sCRocD0Lu/PWUWr/iuMobg4u+qgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442940, "uuid": "82cae4cf-2b3e-4cfd-bb84-accbf8df27c3", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442940, "uuid": "16615ce0-2993-493a-9383-314b22ec4d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442940, "uuid": "9acba890-51f4-4e67-b23c-c55d1334413f", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c2b92e-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775501587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501587, "uuid": "278f2609-4326-47cc-8384-bd187b36e026", "comment": "Malware payload (Mirai)", "value": "b24370d5e099816b8677abd6f498bcac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501587, "uuid": "4009d36a-5b34-4d49-bed4-ab9572532f7d", "comment": "Malware payload (Mirai)", "value": "c9288be6a0dc58feff3c8011ed99a0d57873c5c710a8840f43191fa2948198a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501587, "uuid": "a66527f6-3ba5-4fd6-9337-40d2e0656b13", "comment": "Malware payload (Mirai)", "value": "2932516e129d4e70086c16407b939b7e9dac48fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501587, "uuid": "201b112d-9778-4a9f-9a3a-3fc2f630bb4c", "comment": "Malware payload (Mirai)", "value": "3b462d49cdd2a1b77e803c66d3fffde3b397029091e4533161f1cae631a2fc7a69143be71a44ca778b9b0e1553a02371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501587, "uuid": "2888682c-c21f-4455-9be2-b2b4983157c5", "value": "T19053E846B9829E11C5C8077BFE1E118D33137798D3DEB222DE116F21BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501587, "uuid": "0d8e3f2c-cac8-4a7b-a90c-f0c1168b0151", "value": "1536:wRn78zEyaRDCvEsDCbscC65IrqrrYmPOIRiM/3qFsIwbZnE:aSEJDCv7Ssckrs/3qFsIwbZnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501587, "uuid": "d513861a-f805-4de0-9cdd-16fd5f9d5141", "value": 62640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501587, "uuid": "4aa66b17-d7d9-4a60-b78a-9899bed38426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501587, "uuid": "6ffe4814-a74e-4472-ae27-36be8ef97e62", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445032a4-31ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775475567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475567, "uuid": "e87bba0d-bdeb-45cf-8930-94edb9db10d5", "comment": "Malware payload", "value": "c6aa614f76e0fac91aeafb2d692bf315", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475567, "uuid": "5352363b-0a1c-477a-b4b3-43a1a532681f", "comment": "Malware payload", "value": "ca04780ecaace8602d75c8f928fd6274a7025d953ebca9ce5ea2d7ce932f176f", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475567, "uuid": "dccb9fa7-fe9e-4652-b876-3774aed35189", "comment": "Malware payload", "value": "6553abe0825ada299fde1b9684172fb21ee62434", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475567, "uuid": "5db5ace6-3cff-4d3b-b569-99194e551018", "comment": "Malware payload", "value": "6dbcd3f718526c7b371e8c7831b86153e2e2595b716d21e8227f236e54a81bbf6b23667690e1bb29de9425b99bc75ac2", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475567, "uuid": "212c10fd-9750-4b88-b379-4f6dd7b90f63", "value": "T1C964D044E5FD100CF5BB9F19C9FD25918D69BE62361ED0EE0C189C4E46A5D8C8CA3B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475567, "uuid": "80c8a4b9-4385-4b53-9869-4408cb12326c", "value": "6144:z8OiAkwhv/MN3WAaAy9P+b99wT28Cgh9EEkm0MkWruESb:WRw5klXPy9SX0284jMeESb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475567, "uuid": "79e4196a-8374-4c49-8745-bc7ea7a71ed1", "value": 319878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475567, "uuid": "f4527b2c-b9d0-434d-920d-aeaef8ee976f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475567, "uuid": "5cd834a6-0606-4e3b-9d1d-2b0da77ccba0", "value": "629174800.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90afe30-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496915, "uuid": "82515fdb-1a3b-406b-b329-4846b027863f", "comment": "Malware payload (Mirai)", "value": "0caeca38e0a8a0254690033d878ad075", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496915, "uuid": "2fe64d12-d05e-49b8-b8f0-ba75e85f4936", "comment": "Malware payload (Mirai)", "value": "cb3421c497d0526f9c3539f29f01e68b1e61f951abf36fcfd98bf5cdafa27c40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496915, "uuid": "ccfa2142-32ed-4891-bec2-2a6e88c228f4", "comment": "Malware payload (Mirai)", "value": "220a0dd70a0e4bdf6bf7ff9984cc208359247e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496915, "uuid": "fa1d348c-f2e5-4b20-a836-08c5e2d4ca8d", "comment": "Malware payload (Mirai)", "value": "c219fae39ab0fcf8fe9e07532e222a370c0f56ae5973a429b7dc5315b7200db148d0518f9b9475590f55f1349568fa87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496915, "uuid": "3c7ce957-2893-4bf5-85a7-24b15237f8e0", "value": "T1E8633A866B43CAB7E85315B002B7B7365D30FE3E0835CAA7D3647DA39A229E1611735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496915, "uuid": "8449731a-cf34-40e6-899e-0fe87a4aed02", "value": "1536:0ftetmwQlDEevktp7S2n6pEGDBhzXOCjHS3GK:6teITEevktp7/6iGlFXOCzdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496915, "uuid": "a0f26a42-dd51-4075-96f3-3a407eebbfef", "value": 69872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496915, "uuid": "9281ce2d-1405-4acd-9681-6f448f1b387f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496915, "uuid": "e0949651-72b7-4637-89c9-0a50927ea758", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a2ad96-31e6-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1775500324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775500324, "uuid": "e45b67c8-0a8a-418a-b220-a1dfa2b9bf72", "comment": "Malware payload (DonutLoader)", "value": "5c360b0c2157edb364b09a825ac1fdaa", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775500324, "uuid": "5af3df47-3abe-4895-b0a4-c2a8397af13e", "comment": "Malware payload (DonutLoader)", "value": "cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775500324, "uuid": "72d04131-73cf-4e97-8357-7118df06fe8f", "comment": "Malware payload (DonutLoader)", "value": "e0bdc44a523402ca037b93e736fb647c98f8e6ce", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775500324, "uuid": "c1bb8768-ea08-45a8-9586-a98167063486", "comment": "Malware payload (DonutLoader)", "value": "a8ac1a6c40f24c168d9e10d74ef8c9bb9030e17c41712832a7f39ee6f578a1518fc65c9e014f1d31e43a5ef84b60a188", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775500324, "uuid": "a348351d-dc85-47d9-9587-bb9e2932468c", "value": "T110283331B12A6954C11F67BFE564AF8E8431BCA1B32B629BB7783FB2457498350B1C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775500324, "uuid": "9a9fbb3d-35f6-41a5-b8bf-2f5bea9c83c0", "value": "3145728:Ykyfx0hwE0/zrABIMiCN75Cb0T0cxdDzncLJ:Ywhv0/3ABIMzNiWdDznwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775500324, "uuid": "97387440-2af4-41b9-84cc-9eaa3595fba6", "value": 100962304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775500324, "uuid": "81c80baa-8490-4de3-afe5-779bd39eae08", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775500324, "uuid": "5fe0eea4-bc3b-4315-a49f-9cbcb83c2e8c", "value": "Win-malqla-x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338890d9-31e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775501308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501308, "uuid": "bd815854-9a09-4f48-96f4-764d75efaf24", "comment": "Malware payload (Smoke Loader)", "value": "0cfd7e07067730f6d449f6e10db25ffe", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501308, "uuid": "4a81285f-e5e9-427f-8bd1-59f890aba467", "comment": "Malware payload (Smoke Loader)", "value": "cc5124db56a31929b6be124bf89a6f495038aecddb575bab340c5b43385ed891", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501308, "uuid": "643cf6cb-8366-4b96-be1c-e0421037c2ca", "comment": "Malware payload (Smoke Loader)", "value": "76d253bced415c2ab4ced5418487de2ee1d0a357", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775501308, "uuid": "2c826e86-f1c8-499f-8e22-b9ec3aa31c43", "comment": "Malware payload (Smoke Loader)", "value": "3fc73c933d652a09f8ee70f14c383e3a32c5692b34cd9e0e44dbd1b39f5c695dd4a35a29b9c8d7b98ba88a2eec40dfdf", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501308, "uuid": "6820c1ef-6fa6-4f96-a945-ce18e2900a47", "value": "T15E655A4B7CD008BAD06A933289B292927B76F8190B3233D72F54B6783F76BD05979714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501308, "uuid": "d8254a90-0399-481b-a748-df05f4a7af72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501308, "uuid": "a073287b-911d-4f04-8d02-eda3316703be", "value": "24576:SkkjIC23dBzRMf6j+1O/Cd6bOFMxAnv567pYOXCGiWPr73:Skpx3dBknvo7pY4tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775501308, "uuid": "605669ad-8f0f-4d4a-83c8-796fe7eeee5d", "value": 1483408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775501308, "uuid": "b7d77a23-be86-4176-b050-55bc461f04b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775501308, "uuid": "8a7cf9e2-4fe2-4b84-ae5d-7fdebcda50b3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e13502b-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442914, "uuid": "80a5ea64-aafb-4e35-8424-426acb0728ca", "comment": "Malware payload (Mirai)", "value": "145e6e709ceb8e5e41c49645bc3859ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442914, "uuid": "6d3eb49e-92b4-4645-8c92-e04ab81509ae", "comment": "Malware payload (Mirai)", "value": "cc8df5f8f99f5865b450fea2c99bf99ba741dfab9e41fc31850404cf0caeb9c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442914, "uuid": "43f06612-3c7a-4aa0-95f9-314d647a8b88", "comment": "Malware payload (Mirai)", "value": "d33734a83b03b85ec104d2514900c7ba97e3a83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442914, "uuid": "16ecd0f7-b015-4528-8e17-a1a7f9d3986a", "comment": "Malware payload (Mirai)", "value": "d5cd422e2d0fb0df44f16f75a0cb3b27c3313c97a59fafa5c13dc11c37141f0d6331f8cfe1f47ab69c88d04f3d5269f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442914, "uuid": "0d4c0252-ef0f-41d1-8f92-56c00580d22b", "value": "T18F03E056E491702BC82E1C3F638A11AA0590E1DA71463B37A36DCCC4BE36C5F989D8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442914, "uuid": "4fecb1a0-a090-471c-8a6f-d32a4cc0d111", "value": "768:CF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0Z8XrRCFzWH:El5JnsrXvrKy9QjyBZLvDmR0Z84Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442914, "uuid": "53ad03fa-d9b5-4ded-ba01-756b5a7f81d4", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442914, "uuid": "eda10ebe-930b-4d8a-b164-05d9d1d5e0ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442914, "uuid": "1219e04e-0ef9-4e77-a00c-891b180777b0", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507dcb26-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499639, "uuid": "3049bca5-b65c-4a88-a36d-f5735f8d0bc1", "comment": "Malware payload (Mirai)", "value": "b0e1f35b7825316d71b40193cb54ce32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499639, "uuid": "b85b13f8-5d94-445e-b6c8-c264b73d9f8e", "comment": "Malware payload (Mirai)", "value": "cd405e366b74e5acf25a923a295ae32204407e099f1940880efb2039ca527e1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499639, "uuid": "e91e3deb-bde9-4f24-b542-44acd829a769", "comment": "Malware payload (Mirai)", "value": "97e3508bb503f33074bfdb4a674577232cf40c44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499639, "uuid": "b7b4413d-1235-4411-bc12-38534ffe179e", "comment": "Malware payload (Mirai)", "value": "e4a1706443f9e627940603f7e2db418f5d9a3a962d24eecd47689cf6803c9f8525dce19aebf9c05ad75d49f6f85d610e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499639, "uuid": "e2c0fb45-96ec-47c8-8907-8dfd608b29b8", "value": "T1D513F8CABC819B26C6F011B76F1F9685371393A5D2DB7227CC0A4B396A5754B0E3BB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499639, "uuid": "e1787a5c-a01a-4a1b-ae63-94e89247a4a9", "value": "768:xFZxZZ9iB4Sj+A+0+v+JeIzL+K+3+3aQ7ta1V+wok3T6O1QS4U0g3v8e6PiFNHWg:BGB4XTv24dOdq0wBHgsokgKuS2zX7Ykk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499639, "uuid": "f121f224-27f9-4c68-a214-658532eded72", "value": 42508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499639, "uuid": "5dd8a14c-be99-488e-aed4-a1977aa583dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499639, "uuid": "938036cd-9e8a-4be4-9e76-88f9fa11851d", "value": "SecuriteInfo.com.ELF.Downloader-DN.84454289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69512932-31b4-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775478635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478635, "uuid": "ef4588f7-5db1-4a2e-a853-c1d0fcfcd43e", "comment": "Malware payload (DCRat)", "value": "3e364a94281c1f233105ebda902e6737", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478635, "uuid": "44a38cab-ffc9-40e3-a1a8-c4b14894857e", "comment": "Malware payload (DCRat)", "value": "cdd4e453b647d90d80b2467f4cedd8c236764efc9769d880ca33ffd9c069a676", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478635, "uuid": "ff4ab8b3-4f23-4757-aa2e-2877f991e8ee", "comment": "Malware payload (DCRat)", "value": "cd8ecb67e22b4bf534499573112b01db4eb77b0a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775478635, "uuid": "6e12753c-4c12-47a3-af7d-a4325b614a2a", "comment": "Malware payload (DCRat)", "value": "f613308cdb9797a3a58af47fec3c932ff5c7a1d13b529e215e4be0c9b2a9b5eaff3f97dfb9f3cdb2d1f817a55bca5077", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478635, "uuid": "fd027ce6-f6f7-43b1-83ad-6b26a990fde2", "value": "T195454A01BE44CA11F0181633C2FF494847B4BC516AAAEB1B7EBA376D59123977C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478635, "uuid": "1b3ba2f5-a7b9-480b-aba5-7dfed9a8b999", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478635, "uuid": "c739f1f2-9487-43dc-8281-9c16d56c115d", "value": "24576:U2G/nvxW3Ww0t1JHFVDXglC0HwdoRObjjWaZxM2Of:UbA30PHrglR4jjxFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775478635, "uuid": "d94215d6-9664-4a18-9f58-36629e961210", "value": 1165433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775478635, "uuid": "0acf04f0-4b7a-400d-8baa-0a5a32f729a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775478635, "uuid": "a51da43a-ba50-4ef4-af52-bb73052ba126", "value": "3E364A94281C1F233105EBDA902E6737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cda4ed-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775443053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443053, "uuid": "e9d1baf3-81b2-48f7-86d2-87c3310b0974", "comment": "Malware payload (Mirai)", "value": "8a8b06bfb2cbceeddf3b3f79a16589b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443053, "uuid": "43c8f0f4-e026-4461-929e-28ae799f12e9", "comment": "Malware payload (Mirai)", "value": "cdef00757f39a22a33e76ba4d024b6498c0c6ec365c9ffaf8d8a9b43d5e98721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443053, "uuid": "b93f8450-c70d-4ba7-873b-1e5cc8b31227", "comment": "Malware payload (Mirai)", "value": "9412912851096eb3d91c7b152af3b4f6884ef607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443053, "uuid": "550980ea-f0cd-4778-9aa6-d8f084dc0992", "comment": "Malware payload (Mirai)", "value": "b2f273d2a4a9442ca89692a12c339be86cefd62f7c9018634665d9e5fe925b001041fff261694dd9ada6c0966291e737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443053, "uuid": "f4727196-e270-4353-a78f-67619b12ea01", "value": "T172535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443053, "uuid": "5feb052d-18c8-47d8-8ae7-8d82c3a0914b", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6IQcP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bDP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775443053, "uuid": "8ce9b4b5-40c2-465c-8b1a-27fe16c6fef0", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775443053, "uuid": "9aacacbc-4008-48a0-a9b3-78631ba8a318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443053, "uuid": "d8610e0f-4fc6-462b-aea5-6bf842e0d376", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305d21e-31f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775506810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506810, "uuid": "026b9cc1-4633-4be7-8a62-d76a1bda2595", "comment": "Malware payload (Smoke Loader)", "value": "258a6960006d5f8d2f7246c00fcf5487", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazzo-bet", "colour": "#F6465E", "exportable": true, "hide_tag": false }, { "name": "morkaj-bet", "colour": "#CCF4D8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506810, "uuid": "69c2dbb4-2915-4702-854a-db41c3eb6f6a", "comment": "Malware payload (Smoke Loader)", "value": "cf87e503337479f15b7f9394e70269dccb351dcecf1f9d82620a8af6618bff92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazzo-bet", "colour": "#F6465E", "exportable": true, "hide_tag": false }, { "name": "morkaj-bet", "colour": "#CCF4D8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506810, "uuid": "bbee6810-e326-4170-a658-26869db72fe7", "comment": "Malware payload (Smoke Loader)", "value": "f17565390307100ee59ca623f342a99f2fae4428", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazzo-bet", "colour": "#F6465E", "exportable": true, "hide_tag": false }, { "name": "morkaj-bet", "colour": "#CCF4D8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506810, "uuid": "cfbdc91b-de6e-41f3-837d-3eeba30d27e8", "comment": "Malware payload (Smoke Loader)", "value": "7a3d727a7e455acb97c0e8af1e7c9380a47a8065fe9b4c1b152130faa5ddba2236abc1885def1eb1c105609a810dfaaa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lazzo-bet", "colour": "#F6465E", "exportable": true, "hide_tag": false }, { "name": "morkaj-bet", "colour": "#CCF4D8", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506810, "uuid": "5356ca1e-0332-4331-98af-ca044cd8060b", "value": "T1C7D487DB6F7065C1DC167AF8A4D16D01C760B8AAEE9C80BE1D86AF1B8D38D078E1F154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506810, "uuid": "b471768b-74fd-4c6f-af57-b856eac6d574", "value": "6144:ORPiLa1hEEg41iEuli+XKUmMev86V/UbECNjgnUv0I+hNrM/t36:Qq8h1ml1FTev86V/6LNjgnUJ+0/t36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775506810, "uuid": "4a85371b-06a0-4b30-aefb-ddebd9ed53ca", "value": 641200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775506810, "uuid": "f06d81a0-2ed6-44b5-b516-16fbeebab9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506810, "uuid": "9a975c3c-a9c3-4d20-a124-5b68e9ed2dc8", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1912f06f-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507277, "uuid": "9841f2ec-0424-4a14-bf50-a302d88ee63a", "comment": "Malware payload (Mirai)", "value": "487cc9727716a9961a6f63b5ce69df68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507277, "uuid": "4a1df035-b9e1-4247-a207-147ace722fc5", "comment": "Malware payload (Mirai)", "value": "cfa8ccd764bc145d2a4364761fe75613a23ae4d42d33e58b64058a0bd88970e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507277, "uuid": "dbce207b-5d17-4381-9ee3-c6f2b82d3371", "comment": "Malware payload (Mirai)", "value": "b1386d62bc95c5b56e40db144a9ed65db660228d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507277, "uuid": "009ed071-a627-41b7-bf26-60289665df96", "comment": "Malware payload (Mirai)", "value": "5ae2642e6122af374f9636c4b0f0286441e924b879af978bc34038ab5f43990c86edb89a8d4355aa18756d8bf5e324c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507277, "uuid": "e15109be-0226-4ed6-a153-de890165c08d", "value": "T1E4A3F702EF611FABC82FDDB306AA0A06348DAD5732B527757974ED18B61A1C706E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507277, "uuid": "d3ece267-7a1f-43f6-a833-d4d5a0df000e", "value": "1536:iDYM2Klm4awLIgAuWrjAoEPSgvUGfx/c/LcCSexntkZkObg5VPXAcdrcz84rm:qYQl0wL5juAkTpxtkf8rQrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507277, "uuid": "7ec6ba46-b355-4b68-b154-c7a72b58cc19", "value": 100168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507277, "uuid": "08b1a8d1-f806-4617-93c5-2103cfaa7e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507277, "uuid": "f54b3041-5494-4159-8f42-7fd33c92d567", "value": "SecuriteInfo.com.ELF.Downloader-DN.27625195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f63d12-3189-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775460003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460003, "uuid": "3d1ca43b-16d4-4c99-84a7-f7a463853efd", "comment": "Malware payload (PureHVNC)", "value": "69da23a1a648c49b4610a9ade4c61330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460003, "uuid": "1fbd0af1-e8b2-4114-ad3a-aa72ab35b71b", "comment": "Malware payload (PureHVNC)", "value": "d0130981433ca3dbc170293fba71fc8c66c6d109ad43cd55a5b84c3094804391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460003, "uuid": "c6cff493-5772-4112-a45f-ce00b807fa20", "comment": "Malware payload (PureHVNC)", "value": "9d29b2806cd35a266c53811440a1af8ef30a3d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775460003, "uuid": "9f278df3-8d63-4773-b252-90c491068956", "comment": "Malware payload (PureHVNC)", "value": "7240eed08ea483c28830edcb0e90f5f58301820b77cc785024bfd7e9af11c5017e1c8a3bed3bad96f9f63821b705f1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460003, "uuid": "a589b188-34be-4c91-8e39-e0fe7f8f9927", "value": "T139560123B28A673EE06E4B3749F292104D3B6E61651A8C56DEF4684CCF3E1701E7E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460003, "uuid": "49217389-6982-47e5-aeaa-be03f562d1a7", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460003, "uuid": "3586ae9a-838e-43c1-9e1d-1c8df430f6f5", "value": "98304:oN66Xc95fxTdljTY7Bb2Q8CPfVHRnP1LCuF+mFM:MXQfxTjYXLPfJ/9v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775460003, "uuid": "f07c2e48-0057-4f68-9e76-2c6fe03ec6b7", "value": 6315317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775460003, "uuid": "41487b21-d01d-459f-887c-81c16706e323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775460003, "uuid": "c837e3a5-5b74-4753-a657-632456c2f37c", "value": "69da23a1a648c49b4610a9ade4c61330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6961fdeb-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "de228db3-5a9e-47b5-87a0-221d4423fa04", "comment": "Malware payload (Mirai)", "value": "a20da4b74610f8b085113080949af232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "7f9ee089-9678-4c63-b850-bb53a36fdbd5", "comment": "Malware payload (Mirai)", "value": "d1058b3eeb0b519bd4852826f34439834193dbbefd5e7ada2572177536b05f02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "e6c2fc62-453e-4e9f-b35a-73737e871351", "comment": "Malware payload (Mirai)", "value": "2b0652724d970581e06c6f79934c822831cc1b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442987, "uuid": "ba34c4de-a16f-4cd9-8770-9363b2dd48c8", "comment": "Malware payload (Mirai)", "value": "75f95b59a6e4ac2c44f7f0f0e46eb349a596b84aa1b99157d8596e60c3fed2ff8165e2bef4d49a79373893830efeceaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "0f17f3ba-cb97-4c37-b04f-9ac180a1cf2b", "value": "T19EE2F26A51ECB12CE44E903BC32FA98E31E65D11FE17C69424C476DADF601F814B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "0b4f9072-96f7-4e06-8e7e-dc6e7aa054fe", "value": "768:g32bRAqg2rQzSPMjFY8AFOEPB6ZSq7xnwNQBU/:DbRAp2r4ECF+FvB6ZSonwN2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442987, "uuid": "d241c139-e5e9-4b27-a651-93aa18b2270e", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442987, "uuid": "0f7d1d9b-07c8-4003-b81c-a12796f19b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442987, "uuid": "21a521e1-ebd9-4b9e-87e2-0fbfeba3d70d", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8ed7df-31fe-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775510420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510420, "uuid": "ffe5dc36-49a2-486e-9456-49f1325ae29f", "comment": "Malware payload (ConnectWise)", "value": "ec8e9f52b9a0cb496692812014a199ae", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510420, "uuid": "7f5dde58-c469-4b4d-9569-65590a079839", "comment": "Malware payload (ConnectWise)", "value": "d1382c860dba5f7bc46ecc5ad40bcfa4904f075d0d06e7e527066f72b9079812", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510420, "uuid": "efe46a35-8c11-4999-8015-0cc2b3fb2f1e", "comment": "Malware payload (ConnectWise)", "value": "ebfd80ed325bb005d9a904b962dd1401caa3db83", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510420, "uuid": "c1cb3535-2df8-48c0-99e6-70d237b9bdc3", "comment": "Malware payload (ConnectWise)", "value": "3b49b99974126f175270120378f0a3e3b7baf735f4efc797f28f642ee303cf6d230a8791df698b2d3b2ac70abfd736b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510420, "uuid": "96644922-af48-4ff8-926b-3fbecfde0cce", "value": "T1ABA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510420, "uuid": "0dbc961b-f1b7-47db-8403-06f1bf477d0f", "value": "196608:7nCtVYqI5MvbWEpKkqyIJqKlnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqYnCtO:DCXvI5MvHxyJ7CXvI5MvHx6CXvI5MvHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510420, "uuid": "ab50cb3e-448c-4035-94a9-98abaa624d1d", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510420, "uuid": "5aa0e434-d6b2-47b2-91f7-b493ce625b77", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510420, "uuid": "4f5e6a5c-f1da-4bab-8912-5dc788fd5964", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4dbe73-31ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775475530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475530, "uuid": "93c0a709-d740-44a4-8b71-8a42a5bdc6b8", "comment": "Malware payload", "value": "e8e2f3546d2d5a43813e93582485dc0e", "object_relation": "md5", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475530, "uuid": "8c5a57f4-9480-4a38-a8a1-8020e8cbd03c", "comment": "Malware payload", "value": "d28941b53c863094319c137ed55a81bb48616f453ce154dcfd655aa655c74245", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475530, "uuid": "5d75202b-b8e5-45be-ad3b-6ce2cba7b8ce", "comment": "Malware payload", "value": "94af7ef11d94a6bb01ea361b239b2139e2f988fa", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475530, "uuid": "0a5935ae-da7c-4b6d-92aa-cface191a114", "comment": "Malware payload", "value": "a542988c4fb525f8b9dd0a81be7ae3a8da21720b9fd730a9db70087cb4af427dd73252856c01549d0aa16338ca17a7f9", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-108", "colour": "#4C584D", "exportable": true, "hide_tag": false }, { "name": "iopajkflorta-com", "colour": "#8B4927", "exportable": true, "hide_tag": false }, { "name": "zarnoflidfgvv-com", "colour": "#6CBF63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475530, "uuid": "1cfeb001-b9b9-4a52-bfad-787fda31eae0", "value": "T194129F1ED3C88C82D1EFF6B41A908155CA26DB9446EA04051BFC53D97F81EBB7531275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475530, "uuid": "132fd2c2-5760-4652-80a4-7828456d99f5", "value": "192:BRUARmyca9fbpkjXskAPyXXlKaO/Ax8/dI+5:rUARm/wksuQJ/g6dI+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475530, "uuid": "0424e79e-7d08-4e82-bf55-37c260f8e768", "value": 9038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475530, "uuid": "628cd533-0307-4926-9f88-1535525dc805", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475530, "uuid": "c63c79a5-abe5-41ea-aaa3-933a144864cb", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5ca5ee-31a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473402, "uuid": "7ae3b67a-528e-49ba-a494-0a7847a74dcf", "comment": "Malware payload (Mirai)", "value": "5d41eb82780153e89836819d280714c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473402, "uuid": "d8feca24-2a22-4f21-b1a6-16bc0da40f09", "comment": "Malware payload (Mirai)", "value": "d3047ff521542e77f8206ddde6af450fe760bb782646dbc4ee22ace6f0c72d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473402, "uuid": "0c9ea519-c37c-4b16-bcbc-deaf41319d56", "comment": "Malware payload (Mirai)", "value": "8ab31feb1c959acba6c8c7a091a6f152349724d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473402, "uuid": "20262346-5e12-4915-b9a7-6975e65d4020", "comment": "Malware payload (Mirai)", "value": "8b61065ca5bb75d282d7f151bdb34555b5003f28e2f6ca940b202c37b5ced1dc739a50ebd6340b2a459c968651a574f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473402, "uuid": "eb00f785-844a-462d-9545-89f62cb0f3a5", "value": "T109734C0BBD4880FDC159D53C83BEB53AC56770BD1139B2EB2BD8BE271D46E612A1C858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473402, "uuid": "9350d911-24c5-4d22-ac1d-6cd79d9a5ad3", "value": "1536:7YSDIfasSohWyrHsxz0Wjv7U1maJYf4pdcmmDQzHvYaXua84+:NGBSoEssxAcUgaJq4pdODQzHvYaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473402, "uuid": "ba9e3e22-aba7-454b-9f00-aa63d9844bf1", "value": 76016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473402, "uuid": "db4b2268-bff8-42e8-9049-70623c437187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473402, "uuid": "1d3687d4-d756-4da5-b01e-2a20f3e836ff", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f13f30d-320b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775515984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515984, "uuid": "bc057a06-e44e-401f-a428-a583cd7ba4d9", "comment": "Malware payload", "value": "e4f07b1828235436e815a433b7502ba5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515984, "uuid": "e5d0f7bc-e09f-4efc-883e-a11a5647b0f8", "comment": "Malware payload", "value": "d32ff8801ab16f9025b132e70c5a15c6eb54f646e52cc5db08eeaab34deefc0e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515984, "uuid": "835f4b15-d190-4bb7-93bb-d8bcee54911d", "comment": "Malware payload", "value": "362fcdeba6b9153f8786f293378dd5053125617d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515984, "uuid": "b3186c19-380c-4bc7-b571-41f8fb26465a", "comment": "Malware payload", "value": "f096261556cabefe0b7dbfc506eb5491dae1cf87f25cad9f680dc19ab32d225304e830e50954e2e5c5177551ec370c00", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515984, "uuid": "a057c935-ee59-4f59-88f8-79a25db14572", "value": "T11351E48E235282F87C48EA17F475DF9078E09DD24CEB8F44DEDD2B51918CD5478356A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515984, "uuid": "aa3f9159-d0bf-4621-a4f7-2208ff6a6437", "value": "24:faTsdYgqmP/R/EECErQ8QpfL+IvICIqIDIVNIVwh0opyl1v28:UPw/HEVuVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515984, "uuid": "a7371b66-76f3-46d4-afdd-7f694c307df7", "value": 3090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515984, "uuid": "559f2095-614a-468b-9a0c-e2b6709a3c56", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515984, "uuid": "aaec57f9-9a99-475c-9629-be02ebeb7fdb", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea635df1-31a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473698, "uuid": "75e493a7-276e-4ccd-99fe-3b5a8a858919", "comment": "Malware payload (Mirai)", "value": "f657466d7d0a472c21770a50c8f8bbfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473698, "uuid": "ddbc3875-6c75-4c64-b3d6-2b1b06657acc", "comment": "Malware payload (Mirai)", "value": "d34b56584b96b5989297ff866631eb6b544d9a3ca3a24f388d0c3b24b19ef437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473698, "uuid": "c33681e2-9eab-401c-8f48-921414f73de0", "comment": "Malware payload (Mirai)", "value": "1b916d73d851943123af5171fee49150e40d5042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473698, "uuid": "b47ccdf3-ac62-4e4c-8e41-5c4541a13ad6", "comment": "Malware payload (Mirai)", "value": "28e6be0ba1ef3ea0991affe552ed797fd33932729008f93a221486bd157bd58ee31d1dc237f12f78b1f88a86871482a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473698, "uuid": "af3ecde5-9601-4bd6-9ed4-747482abd7a8", "value": "T1E663AE66E4952EF4C14445B071B8CEF90B13A905E6A62FF055D2CBA7844BFECB6093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473698, "uuid": "41b9c60d-dd39-487d-a101-3e2aea9366ad", "value": "768:9uW3wSBIgyMqddTkFCuQIU7C80PwJ1qYJqRoioS/iB+CaaZA6W30Fn79b:RgD80sCKUGwuY0QSW+CaaZA6WkF79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473698, "uuid": "cb01a953-979f-4d42-a23e-f110b0e3ad3d", "value": 71236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473698, "uuid": "65936fa0-b8f9-4126-8f75-0b450a0a04d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473698, "uuid": "5bc176f1-bf07-407f-8985-2ae123835900", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4496f51f-3187-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775459246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459246, "uuid": "139e1e2e-55b9-4a0a-b922-9b17835e35dc", "comment": "Malware payload", "value": "a9f9aac80662d5515129cb0009dc4434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459246, "uuid": "46969ca9-ed0b-47fa-beeb-f228b20b8c4c", "comment": "Malware payload", "value": "d3606b93946f54890635b08a23d3b4f9c81bde9339bdbc0a9e8ccb35b2f59330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459246, "uuid": "c70c585c-8ba0-44d5-9a1b-00628b9d5cf3", "comment": "Malware payload", "value": "7eb03874c91b28c92cb4394d8d3ca3942113a5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459246, "uuid": "5fd21194-cddd-4250-bf9f-28bb4536c02b", "comment": "Malware payload", "value": "9fcc1207359c37860ba0ecac8ee0cdc90781ac0c8a1748c08485ec37e753f4db1dc18494628874c4f0d095bfba142991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459246, "uuid": "15d2dc5c-cb74-4903-8a03-0adb69e5a148", "value": "T14116AD6BFB841B82C1BAC5399923D327B2727C51077563EB21527B5A0FB2BD48D34722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459246, "uuid": "0d4334df-6684-4d9e-a249-6448135a998d", "value": "8754c733ae8637f205a0bb6cda41f65d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459246, "uuid": "094d745f-ace8-4bc1-94a5-338ed8dc85f6", "value": "98304:h/d9r+7U+ZUw7iENmKi0EGo/fl/Gx4QB0FjEj+GVIc+zBvycB6:h/dBstNUZGTeLFjESGVKzBv1B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459246, "uuid": "03dd4059-e149-4237-99fb-93c3baac2a95", "value": 4392448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459246, "uuid": "f60e5294-dd6a-44a9-a810-fd8802c1e677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459246, "uuid": "4996e22b-b626-42c0-bdf2-1b13a46887c2", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78438949-319f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775469641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469641, "uuid": "52c614ef-5f04-40db-8c13-6782a9f558fa", "comment": "Malware payload", "value": "1630072fa0efef298845067822ab1be6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469641, "uuid": "48cfdca9-d33e-4ac7-b9a1-abac31bdb384", "comment": "Malware payload", "value": "d745d54968f46c19ae684eee92af412a3abfaa8637e633c794f99a943c67a227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469641, "uuid": "7bcb77e2-22ad-4520-b68e-4db52c9dd4b0", "comment": "Malware payload", "value": "0628cf5482249c0cdde20d3bedb56d6feed88b17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775469641, "uuid": "11a03312-f9eb-427e-814e-8988d75a4ffa", "comment": "Malware payload", "value": "28d195d585f2b46e6af7aa02a420ece25ee00fdffa837dce50a3beef5f4da69df10cb704811afad7a6fd425af00cca1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469641, "uuid": "979f0d88-2f48-41b8-ae1c-4efa1cb7998d", "value": "T17EF69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469641, "uuid": "01134e24-f0c9-4d3f-a2b8-e4a381d09a0c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775469641, "uuid": "14130fc3-1c73-494d-bd73-033044eecf2e", "value": 15433728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775469641, "uuid": "dd954396-9d46-4c69-aa6b-13ff4e16ddac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775469641, "uuid": "59bafe6c-d554-4b78-99bc-8539cdcb1168", "value": "d745d54968f46c19ae684eee92af412a3abfaa8637e633c794f99a943c67a227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb652d47-31d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775493483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493483, "uuid": "b57ac9b3-4023-4c5b-84dc-12b3fa8ed1c1", "comment": "Malware payload", "value": "61e34a5873e280b6f613d31d5f8f4ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493483, "uuid": "ceaefcf7-8a4a-492e-8fec-0864ac09cfd8", "comment": "Malware payload", "value": "d8327ae1641dbb2568a58b94b41bac46b45226973c00dec893c6364400937797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493483, "uuid": "8c4dd1ac-a4c7-45fd-a010-6fa1055c1900", "comment": "Malware payload", "value": "353dfea3985ab6ae0d5a4a6cae280e4447dc3ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493483, "uuid": "2fdcfb76-2a97-4e5f-a1e2-c8c91ceeca52", "comment": "Malware payload", "value": "d3240fdaf45cdcb082c43dd7502261efc8d341adf2846ffc6bd46ceafcc402b70449243d0d78f602856b4f0d8765a3f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493483, "uuid": "f694834f-05ad-4f84-ada5-f1ed8210be3c", "value": "T182658D47B6B800ADC067C179C9175A07EBB1B40513749BDB5690CAAA6F63FF21B7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493483, "uuid": "8e70ac7a-8724-4975-958e-15cde58764fa", "value": "4e6f2e64b1c117a78edda62c9060e0f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493483, "uuid": "a4c88008-e91f-4cd3-ac9c-86f107c20f0d", "value": "24576:V6ehlPcSVgyg0iqGDni5AUDgdgG9X+slDzhmhmoJHwkcGpt:5/BaEAUDgdb+slDzkmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493483, "uuid": "801771ab-d6a2-424f-a959-dca3e8373010", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493483, "uuid": "38095321-127b-46fa-99ed-aa55f70d939d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493483, "uuid": "6f447f7a-1f19-4a71-b304-902b1364e732", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00f7aab-31ae-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1775476204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476204, "uuid": "1b586a81-9d8f-425e-a431-2cadd0509935", "comment": "Malware payload (SalatStealer)", "value": "130e589dd864fa1b1873619e69689904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476204, "uuid": "fd26ea40-8489-4680-936e-195f8a315d8e", "comment": "Malware payload (SalatStealer)", "value": "d88342d33df0b09197336acfae29df968f7e7f3b3e8a1cbe1e401e859e74b4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476204, "uuid": "3d7b8c1d-a785-4e76-9890-57116f613beb", "comment": "Malware payload (SalatStealer)", "value": "34fc03b7287a867a0be9d7a190303615de64f669", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476204, "uuid": "efcd045f-1ef8-40e0-ac04-93417b087fcc", "comment": "Malware payload (SalatStealer)", "value": "98607c2b2b422be45efe11102faf1ff4700ac6704ac60e6c61f4cd047c3d57a4dd50b7c364266f73b59935b3e3f320e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476204, "uuid": "08a8c933-e30e-4848-854c-74c9d3b88860", "value": "T1CDC65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476204, "uuid": "c87f56d2-37d8-4445-a8b0-2661fb990b67", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476204, "uuid": "7342faec-9b36-434f-b969-99df27961234", "value": "49152:ORpK6fWxZHGQAulw19JRgfFC3b7HJFlwNwrH6PfLsdRyzVeAXH1SX8wRanDyBZOR:UKkWvw1rGtCfHur4EbRyv34pDEpO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775476204, "uuid": "4724dd94-a544-4362-8775-d4e76d1423c0", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775476204, "uuid": "ed15b0ee-bdf4-4f9b-913c-71431b5cef4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476204, "uuid": "e1f1e5c6-20e4-4a8a-ab1d-3e961905c0ab", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78503ffc-31eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775502283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502283, "uuid": "d14d1f06-638d-44e5-bf31-9ed4d12c341c", "comment": "Malware payload", "value": "854b167f62e3c69a0149726197296316", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502283, "uuid": "15b86bc6-a782-4e71-9e50-a32ec2b6deb5", "comment": "Malware payload", "value": "d9b06aeea72124be8f2601c09193b087175e0eee4759e9337cf0a5a62f3e135b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502283, "uuid": "323c6e94-40f4-478e-a7b7-4b4959f12886", "comment": "Malware payload", "value": "d6734adfa938c4391c71d1f4b720fd46ea89941d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775502283, "uuid": "5ce8d7ca-e13f-462d-a980-a16c6e98d63b", "comment": "Malware payload", "value": "429dfb403d0929beef00d6cd36408a68dc4fc8a64e41b85a29a7841eae20cbf40db3423ec75b675fffda4885c330879c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502283, "uuid": "eef55fe0-dccf-45c7-970f-e9f523f47adc", "value": "T1312733C6758D49BCCF8F687E4CA1FE0E1F668401B89715FBEA4ED695883226306EDD00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502283, "uuid": "a9a43737-dd59-4c0f-ac12-a32400ecc731", "value": "393216:pUdvXpjK83HTmB4hwBiL3JE8Y0yoaZE54gHSJmrVHvvbv/8nSwoq:pcXpX3TmB4h+0DaZwXHSJmrVHInAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775502283, "uuid": "2414f18d-c1af-47a9-b888-df92a9dc4b9e", "value": 21375968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775502283, "uuid": "690ecd18-3960-4395-af3f-0c4bd76298fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775502283, "uuid": "e1a4cbc9-ffbb-4559-b02a-2d85d3a728dd", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8888d62-31f8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775508027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508027, "uuid": "71a2a232-a4bb-4ec8-874a-a3e6e3a9c943", "comment": "Malware payload (RemcosRAT)", "value": "5622576226361442af15cd98f7429ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508027, "uuid": "1321f0eb-c4cf-40cd-a169-522bda811bda", "comment": "Malware payload (RemcosRAT)", "value": "daa6591561e413c1fd5d29bfcd15224730a56c96099a7cb05f6efa40da312f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508027, "uuid": "f696db39-9e35-4129-9601-41d710efc941", "comment": "Malware payload (RemcosRAT)", "value": "96b8c3e17dc988dc1fe2a4aabc2208f72d991f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508027, "uuid": "b23f620d-1fef-453f-aa4a-fe687c6b4224", "comment": "Malware payload (RemcosRAT)", "value": "4326802e2f44a1db8a7e36a2b7cc06a38710cc85ec1664d23f92e18a82357854aa5b9a4caa0b81f1d1f799951bbc2968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508027, "uuid": "d4fba80e-ccdd-4328-b8ea-7ca210517bda", "value": "T175B4B001B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508027, "uuid": "8d165749-c6ba-45d4-a473-12ba1ae2d788", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508027, "uuid": "57f4910d-4cc4-410f-9637-ca85a16a9401", "value": "6144:TXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZ0AXiBceU:DENlHV9FGeDWv3jADnyYiCNrsPZ0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775508027, "uuid": "7c995903-fb27-40e6-b163-825e1479e769", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775508027, "uuid": "c6af7721-d33a-44e5-906d-0dcf5faf64d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508027, "uuid": "a844d5ae-08ac-4c7e-9517-caf0527a57f2", "value": "daa6591561e413c1fd5d29bfcd15224730a56c96099a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f0d9e8-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775507270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507270, "uuid": "afb0295b-36dc-460b-875a-5dbd29de1a49", "comment": "Malware payload (Mirai)", "value": "d54529f2f7987a69422430718f1f28b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507270, "uuid": "53a03caf-4594-4d1c-9480-721c8eef74fc", "comment": "Malware payload (Mirai)", "value": "dd8ae96dc7f78f086e576535a61ec7cbcc4fbe8c2f0b16abd0c7aced5995d7eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507270, "uuid": "7961c568-cbfb-499e-8cdb-e11adc221579", "comment": "Malware payload (Mirai)", "value": "58d84dcc9643d6d4348bc5c3a22bca1324d94535", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507270, "uuid": "8a77c425-290a-4a10-b1d2-ff1b2ab53135", "comment": "Malware payload (Mirai)", "value": "fd8b9a469d0afdda36c628bad4aad11839e2270faea87180c7a95a3e7731660606f6b7f801dc53a907687451a6035aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507270, "uuid": "dd773781-6c23-4e90-896b-6fcb6c21aad1", "value": "T11D630981FE87CEF6D40F14B181F7B63E9A31F82E0435C6A5EB656EA1DA235C07216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507270, "uuid": "9152a788-a7a3-4436-95fa-0f691ddafd75", "value": "1536:pxwxrlXxsTTHF45TNEWNcjGbkkvqK22dNqX73:crlXxsTTHF2XeibkkvnJdNQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507270, "uuid": "5722bda4-aa31-4444-8064-84b58f15e013", "value": 70256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507270, "uuid": "a5d5e940-84c0-497d-b53b-35824fa65ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507270, "uuid": "d54d03a1-b9f8-4721-9812-57f5097d23af", "value": "SecuriteInfo.com.ELF.Downloader-DN.41515265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8bc17d-3202-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775512354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512354, "uuid": "cef836a9-0316-417d-88ac-ff2daf75ddfb", "comment": "Malware payload (Mirai)", "value": "96ea555479cae4c1cbbd5f31bb3909f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512354, "uuid": "eed4665a-16c2-4e0e-a4b7-d040585755a5", "comment": "Malware payload (Mirai)", "value": "dda359d85387162a3b5689459139b2473304372b511a66cfc75fe9d03357a82f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512354, "uuid": "48e912e1-1efe-4ec9-bace-ef55bd435899", "comment": "Malware payload (Mirai)", "value": "43f42660ca0887a3f746313d8cffccb4c858d5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512354, "uuid": "2e8ade99-9b6e-4762-ba62-bda6d02c2229", "comment": "Malware payload (Mirai)", "value": "94f56eadce57569a3c470670c80e605b2bcaf2ec13b988361cdf0b693855804c111b69c05e95dd71d60cbbf08d842e19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512354, "uuid": "736f3fce-eb61-4374-adab-4f18e11b56d3", "value": "T1A55423D346EC83E6C518A37CBDBF9C245CC0CC7984D62C9A95E4CF91AA715098983FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512354, "uuid": "2896386c-5b8a-4c47-adb7-ed53a91e1e4b", "value": "6144:DYuNoceTJJTVtP4ISYEsZgLIbI026vZhtzpmwclt2Iz+iS4:05TJJTVtPt5N+L8p2uZ3zAwYt2JiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512354, "uuid": "6fd60b31-bfbc-4c77-819c-346d937b990f", "value": 290680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512354, "uuid": "03dc5636-b39d-4182-b3cc-e802be88fb24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512354, "uuid": "b87b1a5b-2a49-432a-beac-c07d947e916d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d09aa5-31fd-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775510229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510229, "uuid": "bf29d4ab-af6e-4563-a5af-f5f37d7694d0", "comment": "Malware payload (ConnectWise)", "value": "02e83edad850489a49b274dbb989b8de", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510229, "uuid": "e1a93152-a4f6-4bfd-a680-830ff529ee86", "comment": "Malware payload (ConnectWise)", "value": "de4152e2623b9a98c812ad8b22a2a89eb74f4cdd901af269f874eb7980f54d42", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510229, "uuid": "0560e299-4bad-4c8f-90b0-62e0bf71edfe", "comment": "Malware payload (ConnectWise)", "value": "5e8d7c6207afed75b7465b46b10e23c3d2f4ea02", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775510229, "uuid": "46c87830-3b09-40d8-87c1-a25ab88634ed", "comment": "Malware payload (ConnectWise)", "value": "4343a59840f27082a3725af9108efa66114fd40fe73779370b361568c5c1581b47c842d994eb054a823f4a9e8c022ef0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510229, "uuid": "f9273248-9bc3-455e-8dfd-09a8b782ebca", "value": "T1CB172311B7E585B6E0BF1678E8BD51614632FC140B26C2AF17A4796E2C32BC08E72777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510229, "uuid": "373a5d0a-3c24-4ea1-bdb4-9fe487391dd1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510229, "uuid": "42fc5ffb-8338-4fc4-bb06-f35c9e035035", "value": "393216:tCXvI5MvHxIJwCXvI5MvHxBCXvI5MvHxuCXvI5MvHx6CXvI5MvHx8CXvI5MvHxiS:tZ6HxZZ6HxBZ6HxuZ6Hx6Z6Hx8Z6HxiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775510229, "uuid": "7c857d79-2bf6-4deb-9087-162c2a665869", "value": 19307576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775510229, "uuid": "aa68af9d-f4ef-4676-98e5-b131d0797e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775510229, "uuid": "4fb1bee4-8745-4b2a-94d2-65062ffc0085", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c198e5b-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775507282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507282, "uuid": "5005e4e5-db51-48e4-b089-19b2dc8884be", "comment": "Malware payload", "value": "a9db608146af515651e8ce6ebbf06f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507282, "uuid": "9f4bea35-e9bc-49fc-bb71-6f91ebea7ccf", "comment": "Malware payload", "value": "de4fa0d705ad5388ec9fa1f8412b215f55e8ace7a804e86e9e52623a294002be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507282, "uuid": "9b50cc7a-6d46-40e5-8350-fce9356e1049", "comment": "Malware payload", "value": "aeeaafe5faf6a6d7ec72684f8c4e16eeb3d6985f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507282, "uuid": "87ade699-b949-4fd5-a87c-f467d2e2f2a1", "comment": "Malware payload", "value": "4f5bc36fec0186f1a12666f80c985c6692b7f19a5aa757f0580ac29ad7ee9be0fc841406fccc830641109489d855562d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507282, "uuid": "c5e46b23-0728-4e92-a1fe-91100ab8c483", "value": "T14E831986BD418B03C5D321F3BBAF41883B1657A9E2EB7243D929AFA123475D70D3B650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507282, "uuid": "69fd984e-f557-4cc6-8b66-23f6629bb6d2", "value": "1536:5sErb3dJT60I8wExvqGctB4Uk3sqy5FxDWCLp0X9Jejq4GltlOLT/RAIEw1hOrhC:xu4g/q9EUwcEd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507282, "uuid": "2e4ebdfa-ef9b-425b-b95b-56cc7335e548", "value": 86348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507282, "uuid": "7f9e3700-a251-49df-b8ad-053e07a8faef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507282, "uuid": "fe2d7a8c-7abe-4a0a-b0a7-177728ff0107", "value": "SecuriteInfo.com.ELF.Downloader-DN.13542216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562728d-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442953, "uuid": "d42c28d1-5a97-405f-96e2-cee9d0269fce", "comment": "Malware payload (Mirai)", "value": "d8cdc0703ad827fd0da7d3affaab376a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442953, "uuid": "b1ce4758-de71-40ad-b6cf-0eb8279efbf4", "comment": "Malware payload (Mirai)", "value": "de5c3e8a758c6c7535e5f11a0593b2a34267b7124e64cdb09112d8b676fab8f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442953, "uuid": "40a901d1-2077-41b5-8e23-e9b3e9c7e4cf", "comment": "Malware payload (Mirai)", "value": "933d48df04ecd1093d15da92a757aa2f46f32057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442953, "uuid": "e5b0ffaa-b612-4e8c-9c29-eacd24c654c4", "comment": "Malware payload (Mirai)", "value": "cf315a14e5f518b5f81f29ded5e23364bed968c13a83664a4b1f77a6f262015e5db7bdaf225e13390c7deed45d389d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442953, "uuid": "9b535aee-c6b6-4acc-9ef3-126160188292", "value": "T115734B21F9391927C0D5A17A21F74B23B5F683CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442953, "uuid": "99e6ca04-0b6e-4386-99f2-3b6b5729560b", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tT9fT:7PQbrL7SYOBR29fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442953, "uuid": "3bccac8c-98dc-44a5-a445-baafa0a2e321", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442953, "uuid": "e652ca96-06d5-4cbf-b999-85d460f0b2b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442953, "uuid": "b707460e-5324-4122-9e9c-f1c6d262790e", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d960e3f-31ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775475555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475555, "uuid": "75c69dd6-0ca9-4fab-9094-e58a856d945b", "comment": "Malware payload", "value": "76ccb231980f3617aaef3390d58a4a2d", "object_relation": "md5", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475555, "uuid": "99aeac0a-fbea-4002-84e3-b4616b7a2248", "comment": "Malware payload", "value": "debb2a0b89cdc47d59c716f9c9cd7f36955fdb0cf29c4c52ca27d62c494af589", "object_relation": "sha256", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475555, "uuid": "b79bd089-96a4-4f52-8cf4-2652f3dcb687", "comment": "Malware payload", "value": "b7f246a580270ec0ec72b2bbf136c8e5c2ded147", "object_relation": "sha1", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475555, "uuid": "567a7eec-beef-4e0c-838e-8949ab05ebfb", "comment": "Malware payload", "value": "7b1da177a00d0a6e6f74029e874b4f2ca0344910b662934ab7c256076ff095923c129593d4a02c10c08320d6caf6b238", "object_relation": "sha3-384", "Tag": [ { "name": "2-27-62-123", "colour": "#EE0D0B", "exportable": true, "hide_tag": false }, { "name": "PJMG3BXJ", "colour": "#726206", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475555, "uuid": "3337bd18-b5fd-4111-b978-fdf4f41dcbc6", "value": "T1F2F3127617580242DE97376661E7772C3D1364DE52D2EA026F0830BEAC4E62F38A86F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475555, "uuid": "a12666fd-484e-436f-832a-fd0946af4a2b", "value": "3072:1ChuVyAcSgkBXZniRBAxRE2b8n4un1k1N9dfXcZQz+YJ2rMW90krjEO:1tX1Fi4mnpnAfndYMMxrjEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475555, "uuid": "acf386f7-7a6b-442a-9ffa-bbdb7da3a3bb", "value": 171325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475555, "uuid": "a5e735dc-b97f-4113-9244-3010b055a47c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475555, "uuid": "6c654982-82ed-488a-9714-61f24bda8483", "value": "629174800.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0164c189-31d7-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775493493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493493, "uuid": "045f9232-4fce-45c6-bf35-a908f271d057", "comment": "Malware payload (GlassWorm)", "value": "bdbfbf555763bfddc8c37eb492ad9974", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493493, "uuid": "77728cec-35a4-4ddb-b65e-13704fcdf7d3", "comment": "Malware payload (GlassWorm)", "value": "df3c034de5ecd4c24798bb8f83e20628eccfc6819ed1611ac6f7576bbc0d3bbf", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493493, "uuid": "db7f29a9-fa8f-4ab2-957f-b28b8376af82", "comment": "Malware payload (GlassWorm)", "value": "b2d895af15ddbcb6f198aaa4b312c965b049e7c5", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775493493, "uuid": "28fb3d50-c81a-45fc-93c0-aee315e87da0", "comment": "Malware payload (GlassWorm)", "value": "dd2bf5c246e0e3ce6bb76a5a5efef64edaf94792c48fcfd1f6b7d3b8532f557988d555139994dc28ce71ab2691cffdc3", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ext_sideloader", "colour": "#5765BD", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false }, { "name": "w_node", "colour": "#C4D305", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493493, "uuid": "d09050e2-cf41-41c6-9fdb-75c439c049d3", "value": "T14B25BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493493, "uuid": "6069b2f3-0476-486d-97a0-ffe1a1c244fe", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493493, "uuid": "c446e8af-edbb-4462-ba8f-d6c4a64d9e44", "value": "24576:d+pqQ2TgOEe0JRh+w+MY5bsY5b5Y5bVm:dHT7EeiRhdYqY7YTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775493493, "uuid": "d67b65b4-c4b7-416e-a972-e6374ee6e542", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775493493, "uuid": "93e0b482-7031-45cb-8d67-16b08e813222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775493493, "uuid": "45250ba5-8a05-49cd-a2ab-8b20f6c9dc9d", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b02757-3202-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775512350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512350, "uuid": "8fc382ff-8749-455c-8aeb-459a4d8a89ac", "comment": "Malware payload", "value": "f09f0e4dd838f1889516a49f62d662a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512350, "uuid": "d13cc178-e0f3-48bf-9c7f-d15a590903ea", "comment": "Malware payload", "value": "dfde26bdef2c3f08de84b7af7883e05be190becdbf472be431c9c56887d729f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512350, "uuid": "a1b295f0-954c-4db4-abf6-ed46b39c90a8", "comment": "Malware payload", "value": "b327404f9678aaca4df2856e48d20b7ac67f241f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775512350, "uuid": "2da72041-2c29-4299-a090-25085962ca5d", "comment": "Malware payload", "value": "a1711967b134571da5f828d7f8a4acf7d54293498c6e64b44635a2252488139614f73da01304190b83a743c3d55974ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512350, "uuid": "f7c33980-1bfb-41e5-990c-f2493abb1c58", "value": "T13DF43A56F8809F62C5D1257AF65F82B8731347B8C3DB720699189B383BD782B4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512350, "uuid": "e77f3f38-1e10-47e1-abbc-844865615ae4", "value": "12288:99TyexN69kLsz02f0tP8Hc+VAMARKUaElgpWWtAOECnwIt29wFis:yexN6iYcqcaAMIPa/iwwItOwFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775512350, "uuid": "e3d87dbc-770a-433d-ba65-eaa313766964", "value": 729232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775512350, "uuid": "0a1bb8c5-871d-4d52-814f-a0bbdab51940", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775512350, "uuid": "5ad9cab7-e6e8-4880-a4d8-d8a095ea7bc9", "value": "clientarm7n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31455759-3205-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775513330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513330, "uuid": "4e61c379-a0bf-4bcd-af56-33c3e2df55fa", "comment": "Malware payload (Mirai)", "value": "725da57b8702010b282778dd4904ee1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513330, "uuid": "413bedcf-014c-4615-8f41-7a2eee1df37d", "comment": "Malware payload (Mirai)", "value": "e01323e7dea84407cd4bad322faa3e2c2d7c2c797d488f0cc29b9cc6e1009176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513330, "uuid": "53afba82-b4b1-4a0a-a632-10555cdc524e", "comment": "Malware payload (Mirai)", "value": "081c7866dbc8b91871e39a90c9c9131cfb95dfe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513330, "uuid": "ac2fc64a-e085-40ab-bbe3-ddfc3b21c032", "comment": "Malware payload (Mirai)", "value": "62005f69306d4cb4e8456c1e41aaede4f3d695e395b54ad053ffa452f137a1cfc86f62f5428054253bdf99f434a2b347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513330, "uuid": "b9f4232d-d571-4d8c-b0e1-9a59b30c0e1e", "value": "T190931963F900DF7BF00BE7B3A1E709057234FBB509535AB676277896AE390E41922B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513330, "uuid": "31b559bf-9872-41a0-a16b-3b254bfd87d3", "value": "1536:OdQefjZgZrbeM3JS3qiJ8aZG+tTQlt27LU9TSTtEaGmX3y0x6u:iQyjZghR3M3qiWWclAlCaGmX3y0x6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513330, "uuid": "a7e85ba5-6d6c-405a-9ee1-d5e7f5845692", "value": 89184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513330, "uuid": "bf446b85-6b06-4281-a990-a130f0267af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513330, "uuid": "30506211-21e7-4587-a430-3cf07db6762c", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5c7244-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775515842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515842, "uuid": "9adf3991-0919-4e62-bc4a-eaa87594afe4", "comment": "Malware payload (Mirai)", "value": "0c821dc6389f7e4b9d1642ac0a656a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515842, "uuid": "bd35a533-7751-4c56-9be6-87a3c01b53b8", "comment": "Malware payload (Mirai)", "value": "e14e33967f846432209b4c630ef30598a133b462fbbe89ca0e9d2e34acc3b333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515842, "uuid": "cacd04fc-2eac-46a3-a42b-cf72bdff594e", "comment": "Malware payload (Mirai)", "value": "19708fc3a1af510e6f66150d7de711d98bef1cc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775515842, "uuid": "2ccf9094-70e3-4519-8314-479e596deb3b", "comment": "Malware payload (Mirai)", "value": "9c00c320f4c050e5ac75e32f2b8be1f2282b906387eda1ffd855be58480f05218098f6c5ace42084df6e2cd7120c844e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515842, "uuid": "45a2025e-a8dd-4a22-b1ff-e6eeb68c3ed0", "value": "T105B3294ABD819B02D4C321FAFAAF414933136BB8D3FA7102DD259F6423CA9970E77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515842, "uuid": "0197f8cd-302b-413c-9d03-8fccfc26e3cc", "value": "3072:hITgNedJyMvjXGBaV9kj3aLIe0hMhFhkv3:k3DGBaV9kj3oIelF6v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775515842, "uuid": "be3ee1ad-9cd7-440b-8729-bfe5a001c9ac", "value": 111352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775515842, "uuid": "e12ee539-fc14-45bb-8c6c-96326ef3ea62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775515842, "uuid": "0aea7fc7-acda-43dc-9629-f3324560bc3f", "value": "SecuriteInfo.com.ELF.Downloader-DN.98533825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d731967-31a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470857, "uuid": "7ce78427-0526-40ca-8b59-7806c61bb326", "comment": "Malware payload (Mirai)", "value": "cc0c00644eb2b4983a740ab6d120e574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470857, "uuid": "9a7cdffd-3fc0-4d31-837e-c99052450724", "comment": "Malware payload (Mirai)", "value": "e2d63838d6802300928b92e26fa732a7de88da42905faba1bf69b360006856c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470857, "uuid": "3ac4afcf-8774-4701-a2fe-a904929650da", "comment": "Malware payload (Mirai)", "value": "e526553f735af9fe5d0bc3c37a2ef21c929cb529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470857, "uuid": "11461bf9-d323-45c5-82d0-8fef2d831ee2", "comment": "Malware payload (Mirai)", "value": "6fc58c9bd0a3bf1bec2d3d789e0d7477d5bf5e06a12863908485f93902167db79a144d9b503271a1456158df4cc483a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470857, "uuid": "fbcf8aa6-9e84-4880-80f0-1aa4c55de0e0", "value": "T15FE34B46FA418A03C4D51775BB9F42493323A765E3DB73068E18BFB43F8AA9E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470857, "uuid": "a681d7a4-7dea-4cf7-bda7-fd6e14bb8a76", "value": "3072:hn+MoVJq/fXxmoAxOYVbR8KX3FSHuLSCvFoF824QLM/9xO7BdmqwPYWVv:h+MoSxmDoYV98KX3FSOLSFe24kM/9ymV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470857, "uuid": "30214c96-7903-44a2-a454-31dc64e1bb14", "value": 154142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470857, "uuid": "ec961c9d-051a-42d4-bcdf-9555008a1ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470857, "uuid": "f1c9a865-aabe-4873-8ebd-ec3a3029f1b2", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407950bf-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442918, "uuid": "0b9c78e9-90e2-4ec9-8005-90c00f056588", "comment": "Malware payload (Mirai)", "value": "e3a6e4df5be62e6477e50920eddf28dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442918, "uuid": "791e6a87-363f-46de-b1dc-298dc1089e3b", "comment": "Malware payload (Mirai)", "value": "e350e406565a49d5fcc84f2edd04691396ba359ee731843868e08e532ed0d290", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442918, "uuid": "b52fc0fd-5949-40ff-a99e-8da4fb04ff2a", "comment": "Malware payload (Mirai)", "value": "92e3b29177c323b44b4871f55e9ca81a53f2945e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442918, "uuid": "430f2293-307d-463d-a53a-fddafaaf04df", "comment": "Malware payload (Mirai)", "value": "1ead57a8ac2d6ffb7f4bda37f71f7e3cbbb0dfb479842fc742a738da23ebfc3a45edd5533f054ab6f1397b7a46e81768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442918, "uuid": "6aa6fddf-a979-4657-8549-c610511c86aa", "value": "T13F53122299037874DB133EBB76F04EC3F60D4B3675D9A438215A6168E6E95222C713CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442918, "uuid": "7d457c11-d929-4b94-abed-2bb78f1cfb34", "value": "1536:O7XduYshWhq/HIEy6Og3Nwz9hAymeLSM5Tfv83KJGTb6R4M:QdpssMPR9w4y1LXTX83K0Tb6Rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442918, "uuid": "0c643140-bce0-48ea-8ef8-ef84da9e5b72", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442918, "uuid": "594869f9-0213-4a3d-8f38-5b1f313610f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442918, "uuid": "84b81bd0-8d8b-4d0a-8a04-3d9c2b5d3558", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8c77e1-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775486073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486073, "uuid": "a50db74d-3d22-469e-accc-07f55509022d", "comment": "Malware payload (StrelaStealer)", "value": "005709dd2ba7f7bb3da265d9bfaf3d09", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486073, "uuid": "81217bcd-4672-4a0c-8ed3-cff33bc5e0b9", "comment": "Malware payload (StrelaStealer)", "value": "e48aae30303baaabdf26a9554bdc9da8d2215b584c14c6a787e027f48fdc610b", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486073, "uuid": "0da53361-47c7-49c9-ae5e-f41b0821a770", "comment": "Malware payload (StrelaStealer)", "value": "0a279ced254e41b1d49fd631490c948e256a211e", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486073, "uuid": "0daa4340-869f-4860-9a4d-899f0f016061", "comment": "Malware payload (StrelaStealer)", "value": "5116e9e8394655d12749e0c3f8791c743caad8fba6cf1b70197eda01082c98c9497f5d2b2431b7d7af9c211ebf187a2b", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486073, "uuid": "f995bb6a-94e8-491a-a9ff-3682b5d17a8d", "value": "T12AB21F3EC885DFF40B6A31D5A56F7916A8580363B4382A4C79CFC1993B3A950CBB11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486073, "uuid": "73e330eb-7d0b-4764-948b-7f6ddad8c3a9", "value": "384:KDLdIWFcpmksTkDqfAcnBCkL+uGhTQdNwxwUwyxI7tPrR4qpOrCJsg0qxGetLurX:KxkBDqfnUNVSqwU0F3oNsQCC4mSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775486073, "uuid": "b3c56ec7-4714-4c79-806d-6ed53161dc6c", "value": 23643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775486073, "uuid": "1aba7e64-eeff-4cab-b4ee-3a4a86c60f38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486073, "uuid": "3f7a910a-a51b-4ce7-bc66-1da44e8cbaf1", "value": "Confirmation slip-025521443553574554#.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd15e60-31f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775506021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506021, "uuid": "457600fd-4bb3-457f-87d3-c316cb823c53", "comment": "Malware payload", "value": "93e7573b1e084c582da26c50723d2a0a", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506021, "uuid": "5c69954f-7339-4e2b-b213-08fe76378989", "comment": "Malware payload", "value": "e516a52f9e1f70f23ab7fd6687e0c4e80a8802d547224e852b3a20864f04204d", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506021, "uuid": "771514d8-a219-4914-91f9-6169bae9aced", "comment": "Malware payload", "value": "1061685716467917d2a74e70bd344026e7a08908", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775506021, "uuid": "1bf6f5f6-3072-4407-8e5b-42a66d2eaa39", "comment": "Malware payload", "value": "4fe6d2707af90e534278d66044fe2e499166de8ac3559d67adbf3ddc96b710831b5a242b121ffe43da7c7a54b98079d9", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506021, "uuid": "4ba59f2b-9e6b-40cd-9eaf-f5010aff40a4", "value": "T10BD5126063FC5210E072CFB689215B45DBFBB4927BB2D3CA0761326C6E6172CDE12B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506021, "uuid": "1edf3a05-aab3-44a2-a640-21c3268d5bd7", "value": "96:Zjiwm1SKr1yNJ212V2pAtWwRCG/1s7CEw4n:Zjd7JHqCEw4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775506021, "uuid": "8317f0be-25e3-4344-80dc-b2983e952c3d", "value": 2780362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775506021, "uuid": "1c84fc6b-99a9-4878-bcc2-ef266ba01fa7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775506021, "uuid": "f8044f47-2834-4c2d-bfac-f65847bcd4e3", "value": "PNG_0012.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c87047-31ae-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775475967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475967, "uuid": "2a7764e4-6ff1-4e85-803f-930e404677cd", "comment": "Malware payload (NetSupport)", "value": "4f8c11ea33dd9bc6f310dec3fb444efb", "object_relation": "md5", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475967, "uuid": "668de6d0-3fee-40a5-a74f-d91d102a2688", "comment": "Malware payload (NetSupport)", "value": "e52071d85604f1f27971a61729e9b283ecbec3f2bc3921c3f1e690423876d9c0", "object_relation": "sha256", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475967, "uuid": "067930c6-5df9-4c14-8d3b-e4dbd39cf16d", "comment": "Malware payload (NetSupport)", "value": "077a075e72ac51c1a836d63763137491fe9d85ea", "object_relation": "sha1", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775475967, "uuid": "509cfd5c-d33e-41b9-b7fb-024c1f224c3b", "comment": "Malware payload (NetSupport)", "value": "13809b82c746dfe8823c5344e18cdac275f1163f3f9d697f100938d5901cf411ddd711053cbe1a1eac501478c6ddeda8", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-144-30", "colour": "#D26763", "exportable": true, "hide_tag": false }, { "name": "fucismarjiaff-com", "colour": "#6E6AA2", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "omarinjakuzzii-com", "colour": "#81BF22", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475967, "uuid": "8987293e-9b8e-46f5-bf21-8befa7c2853a", "value": "T1C2967CB88B84975EBE6E1A07E078571E67F37F26D09271FC5A62370B266FC081639C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475967, "uuid": "99e4fb3a-9795-4196-97cb-19cf9f889404", "value": "49152:0+yh7I1IvGaA1UzZtNgQEoxzhSYI9K7HP42H0RFbl+Kkp1mHxMC:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775475967, "uuid": "e3a5c9ef-718d-475b-b6aa-296268357eb7", "value": 9410685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775475967, "uuid": "85829233-eaf5-477d-a56d-62642263c7b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775475967, "uuid": "45a59066-bd52-43cd-8081-d10e25c79e10", "value": "ffa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb4528d-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463689, "uuid": "43b9e298-afe4-4e08-b967-12044a14cd45", "comment": "Malware payload (Mirai)", "value": "06bc329602bcb7d27d8e3316cbcb7644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463689, "uuid": "3247023c-a77f-43ff-b308-1d10121ca546", "comment": "Malware payload (Mirai)", "value": "e6d221afe5461434e1413dc4998c507f081c27f080a27522f9992b2dac7be6b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463689, "uuid": "7847397e-0a74-4597-aff3-328c2a4758dc", "comment": "Malware payload (Mirai)", "value": "cec9f8d55250c012aaa825b4777e12c36294907a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463689, "uuid": "e364d009-cc2c-4642-bbb1-f317ec88ddf4", "comment": "Malware payload (Mirai)", "value": "b23c4fc8ee3bb0b1e63fcbe00b28dced60cf10ee25d0f57c3adad1d2aef44efc4ef120c329110109008bb36a779975db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463689, "uuid": "25cecac8-41c7-45d1-905a-efa5968a4900", "value": "T10EC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463689, "uuid": "7bc9f552-684b-47f1-bb24-9a2f5162b3a7", "value": "3072:yf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU41qe:yf0tJBR4NSALD7rnCrhei2qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463689, "uuid": "b3f55d01-7980-41a8-9bee-9a926a8b1945", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463689, "uuid": "5d9fbff7-4172-46d6-a5ee-221e49a7b7bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463689, "uuid": "036f5bf0-db08-4c5a-b22a-48324423653c", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1847b9-3210-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775518051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518051, "uuid": "2ee6b225-fa24-4fda-9f74-305237b6c25c", "comment": "Malware payload (Mirai)", "value": "3cbf8e10b3303046d1086285e8336939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518051, "uuid": "37391dfb-c921-41bb-b7f7-3498b15a45b0", "comment": "Malware payload (Mirai)", "value": "e72a46c4f3c66620c53a539e7d0c7f3b9af4b1d1ebd553bf44c3045254b86124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518051, "uuid": "fd66c6cd-a6d4-4819-bf57-b2d6d56a383f", "comment": "Malware payload (Mirai)", "value": "185745548e5a5c040d4dd0e02ba591b57f18319b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518051, "uuid": "24eb4f75-af73-4167-9781-3941586a0334", "comment": "Malware payload (Mirai)", "value": "69665cef1c4b41effb49a28d97061f2c8f3d8ec1259aa9fd2ef524c9713a9ff7a5ab2d3b2bc9b216771b7b42ff4fa42d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518051, "uuid": "783c1e4b-a485-4063-a265-4af47fdd72d1", "value": "T180358D2AB2B3B4BCE007C03447DFCAA15535B47526312D7B36C5DA312E6ADE16369B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518051, "uuid": "578cf458-5096-4601-b23b-6d5eb30a1ba3", "value": "12288:sgcbY1NgmGEvqJW9OpdsHm56ApIqtIjqse3VrbDPi/4ui2xtF71WR+ayCxPVe4HX:lcM1NgBWKW9SRtln2/4eL71WBPVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775518051, "uuid": "1bb5188e-883a-4dbf-add3-697c4d412d38", "value": 1104840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775518051, "uuid": "a0538bb7-0a62-43cd-b84d-ae92f3760cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518051, "uuid": "874d088a-e2b3-4579-a724-0152cc7b7a1e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eabe25-31bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775481587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775481587, "uuid": "d48d186d-a0fd-4c24-b323-8f05598b42b2", "comment": "Malware payload", "value": "9b9fc3e5a9860b93079182564c56268e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775481587, "uuid": "aa939a4e-a119-4dfc-95cb-51c02fb3011a", "comment": "Malware payload", "value": "e7f5e5a651437d4cbf5c7e94ffe1988bc83a0bdd19182a2243731eb8f545dda7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775481587, "uuid": "c1ccfc40-a37c-4600-9857-f1cc9158b43d", "comment": "Malware payload", "value": "c00269ce99a5751050756be2303d1527205b9aa3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775481587, "uuid": "7c5db613-6677-42e8-b016-ac6580f6d844", "comment": "Malware payload", "value": "98270448125333f78b5bff44cbd546651aaf00e5aa02db37f52f1e5f1ba2c21ed548b8d27824cb21e4819a90159b4fdc", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775481587, "uuid": "573c4187-4335-4632-997a-8496ba37eb9c", "value": "T1038633A65B8507B2D04CA77E420BD6013EC385C2639D592FB3D67F1BED0D392896CA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775481587, "uuid": "11dd10ac-c4aa-4e7c-a5a8-9f10dad5716a", "value": "45f0b404d197612cc9f21f62dfcd882b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775481587, "uuid": "189a2148-adf3-448a-b58f-4525887c169e", "value": "196608:3pyRVuNIyf8TMGhYw+T8KsX+bmu/yL8Ha:4d14iY7wpX+bmu/y4Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775481587, "uuid": "26d5051e-a894-4d7a-befa-9a97e8251596", "value": 8552711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775481587, "uuid": "e60a2b6f-d8cc-409a-af46-2542dcd5f0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775481587, "uuid": "774367b5-7962-49b3-b4d1-f7953b6823cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac580c6-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463713, "uuid": "ac2a9eaf-ed67-4c18-90f5-fec95bf2a4b9", "comment": "Malware payload (Gafgyt)", "value": "f487ee887ae02801303972547ceb57db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463713, "uuid": "1ca15504-4a2f-4f93-92b9-d5ddd34f8cdb", "comment": "Malware payload (Gafgyt)", "value": "e83640cd75236a3cc3f7310404e6451a31c351ae0e65b2816f8b50722a6e12c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463713, "uuid": "e32009ca-73d6-40e6-a34a-ec58a5e30a77", "comment": "Malware payload (Gafgyt)", "value": "ab7e3113ee8675ba697571e9a3b7d534875c1805", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463713, "uuid": "28375b44-2912-46d0-92ae-99956050f179", "comment": "Malware payload (Gafgyt)", "value": "bb7412d521b2c98a3e93ad2c1c77ac2786c93bfd58dd4465c190234bbfc81ee9252a28d2d14429e8cf5bd807902ca759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463713, "uuid": "0bfffff4-3629-4c28-8f96-44733bc668c9", "value": "T11543E8D2F501EF66F80ABA3904D74734B671BE224B530A71636B7E668A323C0746BF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463713, "uuid": "6b90279c-efec-47eb-8924-e69af5539114", "value": "1536:q6Sh8OWwqmgAxEKMz8zlbl8B1l5mFavjCC77BV3m2:q6Sh8OBqrAGXSlwb5mI7CAVV3m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463713, "uuid": "f157eb1a-b682-4098-a37e-eb2bfaadbcf4", "value": 59657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463713, "uuid": "45529648-5e8e-45bf-9c9a-c9b564774587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463713, "uuid": "ff1fccec-5899-4ad5-b319-4c8f35478065", "value": "cali.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4f423d-31ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775474697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474697, "uuid": "1ee66259-8018-4758-99e0-39e3995d4301", "comment": "Malware payload (Mirai)", "value": "d575a6a8ec6f1a836067c219b99fddbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474697, "uuid": "ab96ca09-a96f-441f-a5b4-06e2383091b9", "comment": "Malware payload (Mirai)", "value": "e84d5b7d9ff1d785eea06f2e691faf47193bd8e5c3ef210f203a1e329f49fba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474697, "uuid": "f4f3c6d7-2275-4494-9604-998f4726a33a", "comment": "Malware payload (Mirai)", "value": "3cec122192472bf09470bec5282cd9f9b342e4b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775474697, "uuid": "78dd9e33-f09a-4a7c-8c43-df28422ccf27", "comment": "Malware payload (Mirai)", "value": "5b47d67307ed989050bfe68cdb2e5031c56f1683467dda21cad1f5824fb163409a53ea7e5c5a334a3d004a5c9fbd6ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474697, "uuid": "55c22ed9-5e93-456e-9293-4273e97afdf6", "value": "T121A307B41885F2ACE9B450B5F40321E5255206183FEDD2E368C366BBFEB4749716EE0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474697, "uuid": "1c05c310-c831-4375-ba73-f1055bea735f", "value": "1536:vYkGLT4FRTcizGCE3uHLRHiyB4VBIVCCfy0K9FTZZGAW7CJ:OT4FaizhE3kLeuKTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775474697, "uuid": "a8db9759-e7e2-4104-b0eb-740c9a872404", "value": 100220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775474697, "uuid": "1bbaf688-f4a0-4600-bc75-b2f7f66bb7c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775474697, "uuid": "a7bb1367-c2ed-467b-a993-541e33f808e3", "value": "mao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674b428c-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442983, "uuid": "cc69d1b4-06e7-443a-85c7-81bc3f8a7f58", "comment": "Malware payload (Mirai)", "value": "6dce9654f99c8af23ad06eb333334b86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442983, "uuid": "e7c65da6-296a-47d2-9de0-fb9419dc4819", "comment": "Malware payload (Mirai)", "value": "e8a8dba5e235159a2962e0a716d48785faac0e9c9404a390ec4e7448e1e68e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442983, "uuid": "1d4acdf7-4b52-49b0-8e7a-beb57a4ba0e9", "comment": "Malware payload (Mirai)", "value": "d1ca65da93327754aabf37d6c737d7f36249b664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442983, "uuid": "990414e0-eb4b-47ba-94e0-3a421d6e3e84", "comment": "Malware payload (Mirai)", "value": "b1d9cd4faa1b5549df07223208f0aeb9d4c9ac2d25759ee524d2e9144c110d34cf460b0409e52dcd8daf052970ebb195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442983, "uuid": "fc920aa9-c1aa-4903-b621-2b66d27855f7", "value": "T110A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442983, "uuid": "c7bb7185-f384-4e2e-a8a5-43fb8f121145", "value": "1536:yk8NZJjWAaJPScve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBaJazhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442983, "uuid": "713ec8b4-c31b-4a0c-ae68-4f604612957d", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442983, "uuid": "66b131f2-39a4-4e07-aa50-bfae3b07747c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442983, "uuid": "0ee67318-9c73-4ab7-8654-8fc161a7d288", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7b56a9-3206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775514071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514071, "uuid": "6c522075-cab1-4ce9-a0e3-9c9944c5aa07", "comment": "Malware payload", "value": "96c42095a8785f6767de924e558e399e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514071, "uuid": "6a3a4e24-ab4a-4f87-a2f0-cdec80b87311", "comment": "Malware payload", "value": "e8e4808d522e5a8960da08b3aee5b4886591636b218d2dc2b3c369a9b598b7a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514071, "uuid": "1ef044c7-4b3d-4da7-bb71-541de1ed630f", "comment": "Malware payload", "value": "94d8ea0c9d81306508690eec32e0408e5a2d6a52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514071, "uuid": "d606c447-e1dd-4b56-be9f-8e308d61986b", "comment": "Malware payload", "value": "1b699d354cc8b5fb2d31949cda411793f32c5a4b4e4b7ebb58c784837fcb862abb8aae2c48bc4996718754ffe152ded7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514071, "uuid": "a44ce984-3bc5-45e4-a3e1-0b215046a4f0", "value": "T187157E89E7C7D4E1F55300F14A8FDBF21534A2265043F6F6EB4C2AA77432B526E1622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514071, "uuid": "27bfc5a2-0732-46f7-aba1-a72b628e3dfc", "value": "24576:Q1ycs6Lh3mh50o9KF38HDrHhvHwKnfkMAx1GPIm4PiCG:HcsMh3mhHosH/hwKMMAIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514071, "uuid": "9e0f7a02-409d-481b-a2d6-1627cc817b74", "value": 918592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514071, "uuid": "68e7477c-c4b6-440d-bf9f-760525d25357", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514071, "uuid": "4807bef0-2992-4ee9-b3e9-b8d2c187cc4f", "value": "clienti486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02700d07-31df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496931, "uuid": "5971cf09-c55f-4f38-af10-a695dd92fef5", "comment": "Malware payload (Mirai)", "value": "fd14c9094bf81ca3f1eef392f5e83a7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496931, "uuid": "e0e225fd-9123-4cbb-b764-366a9afdb18a", "comment": "Malware payload (Mirai)", "value": "ea56377ef8e645ce67315375daf9ddb24777b4dd03c5207fc9bada35ef2b7f09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496931, "uuid": "765fe38c-a9f0-4cf0-9fd5-331ced7039da", "comment": "Malware payload (Mirai)", "value": "e8819448a204e9188e86cd8aea3f585a9b5c72cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496931, "uuid": "27aa0f32-87db-4906-a6cf-ff76a2c59a54", "comment": "Malware payload (Mirai)", "value": "b045f360e4c28002372f85a61249b9b67a41167f52926ee4d6084e5d260d0dae4f681c13e2bade7c9fcd686c2573cc2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496931, "uuid": "ac3e0631-2aae-4170-b90c-991dc370d698", "value": "T17583E742A313D4F5E84344B001ABEB7B5A70ED321530D95FCB64FEF2AA329E16D17629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496931, "uuid": "66ac3e88-1a6c-47be-b8bb-fb8b13bc198e", "value": "1536:yi3k/w0nnQdoFmoexSAEi6brxqCTLeKl6x3zzU931cJ/oEWb7D+r:yj/bnQaXXwCTLl6SamNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496931, "uuid": "ddc17847-ac26-4471-aed3-9edf9d732c59", "value": 82564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496931, "uuid": "649346de-091d-4814-b4bc-3ce8e47244a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496931, "uuid": "2ae835a2-5645-4566-9d57-c41ea118e814", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e412e5-3206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513685, "uuid": "b516c794-b671-4d3f-bb79-93bb1b8d2d55", "comment": "Malware payload", "value": "d5acedd824efa0178fdee33b1e6fecd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513685, "uuid": "32061055-05fd-4894-8acb-9448ff6a7590", "comment": "Malware payload", "value": "eb806322c4498b321e78d2804facac7e9786cd8641bc8de165381cb8813ffc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513685, "uuid": "6d787748-8779-4530-aee4-3e6418042902", "comment": "Malware payload", "value": "24cd9030852cb76bbca26332695d7d40c29fc35b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513685, "uuid": "e6ef8c36-f656-4b35-be0e-d5adc9f11d4e", "comment": "Malware payload", "value": "9311117b76f1501ea0db5f4782bf7afbff7b719216dfe8a737894718c6f8f5f6cda76577746c278ae40e25d103693ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513685, "uuid": "94cd88fe-f052-43fe-88d1-bd348d5931b2", "value": "T1A0F4AD29F8046B17C49B9274808FE418737AB2441792370A3846DA7D7D827BEAF5F3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513685, "uuid": "02121845-23f7-4308-827b-f5ebb67efa22", "value": "12288:f912HCy+22fEIYDUqykpJmcp8/1dNVG9WcRmC7VSsw56VVnknMlguqfSJP5:l1ECy+22MIYNykpJmk+fNw9WGmCVScSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513685, "uuid": "1a8379f2-fa86-4ccd-bf1a-7e84207c1e1d", "value": 740104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513685, "uuid": "bf4dcb68-06a7-42d4-b636-876eb63dfe21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513685, "uuid": "3e0c1d53-9699-43dd-997b-df5971227ce4", "value": "clientriscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcb5942-31f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775507288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507288, "uuid": "6915eb99-173b-4c2a-9801-52df6f993c39", "comment": "Malware payload", "value": "c3d4b8b5c9ec88da86743dcbb9d4529f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507288, "uuid": "a9cbd21d-ab49-440e-9eac-7fa60d3b58b9", "comment": "Malware payload", "value": "ec47624b6057563fe2d0e72af3367423fc524dec603a8802df9919d547a683c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507288, "uuid": "7bc1d8c4-baef-41c1-93f9-da620a3a4e5e", "comment": "Malware payload", "value": "0e2e15691f520bcf94daf157b5259d60e64f8dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775507288, "uuid": "9ef5078a-3ed4-4f53-a948-870fde9ec60c", "comment": "Malware payload", "value": "c4fbe9192b06f0a36e0f1d7da18b05545e2ed547d8afdafc4bdfa5cd916b2818250a2e2021ec3491c3f5a480cfde9cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507288, "uuid": "ace6b8d2-1627-49fc-bf54-d99f4108b653", "value": "T1A413098AFC818726CAE011B76F1F9289331393A5D2DB7617CC1A4F756A5754B0E3BB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507288, "uuid": "008a1b05-8ed0-4eb8-a9c5-55ab082cabc7", "value": "768:116+TprQ7UeIzk+7+0+J8e6PiFNHWPkke7LhA+5+B+F+Z+O+V+h+Z+W+K+m+BuR0:nuQav+0tTg4kAp0YABdR1B4MxUpVGU/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775507288, "uuid": "7d3c4ff6-180d-4d1f-83ab-1ccd0d335282", "value": 42536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775507288, "uuid": "26d7ef7a-abf3-4dd6-a3ce-ab40810e1b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775507288, "uuid": "f8e10c1e-19b7-4ea5-8fca-dfb1353dad35", "value": "SecuriteInfo.com.ELF.Downloader-DN.29141631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f7b82d-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442907, "uuid": "6970a715-cd67-466c-9e9e-a79395d7e094", "comment": "Malware payload (Mirai)", "value": "3cded8ecbcd0ffc3d71465f6b823bc5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442907, "uuid": "545cc1b2-3e20-4541-bdb6-c4fadf3bdede", "comment": "Malware payload (Mirai)", "value": "eca5a78c6bb93d61b98ce180f1b3877bb640ff13310ee8ecbca7cc2121aa0f0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442907, "uuid": "99cebfe9-15db-48db-9c62-e1b540d78b38", "comment": "Malware payload (Mirai)", "value": "d33951a0ad7347cd8fac8e9492b612dc386c2a11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442907, "uuid": "ba6fb6ee-0c3a-4598-8034-6c1331860853", "comment": "Malware payload (Mirai)", "value": "b04f4eb74d518b2f4ecd66c6c829c519f93e54ad542bc6d16f94b41ee6a6e797213f1e5f006950c880f95daebf7820aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442907, "uuid": "f1c984d4-1616-4f1d-af09-53cc5d28bf51", "value": "T188F2E139C5FDE9BCC03EBA750D0E5742B6C1F8122A65375F0529A26ADEF7C853E12182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442907, "uuid": "79a296bd-09e9-4337-b3b0-03eee2f4ea3a", "value": "768:JwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTIsdvEUx0nZt:gOX80VqVi2otGtzXv49MZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442907, "uuid": "97af3750-f8c7-484a-b849-30f87d60afcb", "value": 36924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442907, "uuid": "91fe89fc-48e9-4e32-bf12-49985f0f40fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442907, "uuid": "88b26723-fc9f-4bd6-8aa2-7451cedbc3f4", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1ad910-31b7-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775479826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479826, "uuid": "708cb17d-13c9-4407-badb-59d8f65945ae", "comment": "Malware payload (DCRat)", "value": "d1f5a5706a22f4289e32b78ec2c54a08", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479826, "uuid": "8ae365b3-1afd-4d89-975b-2f8011bfcee6", "comment": "Malware payload (DCRat)", "value": "ecbbd25448979c877212160fc82b92a1aa2c5cf1f0f525632100a5435138b48e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479826, "uuid": "abea5c2d-05cd-46c0-945a-3681ac88c381", "comment": "Malware payload (DCRat)", "value": "d757a424e82734f1bce89c450638c0c46a75edb0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775479826, "uuid": "5785f70b-33e3-4f65-9547-a10084ffb34f", "comment": "Malware payload (DCRat)", "value": "517138b85d1d9724581624179301cb7a2c4616c938576ff9a3697aa24678cfe31bae68f20f3515ae0f217f55a0cf20e3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479826, "uuid": "00b31527-d232-463c-a58a-eded6afbe1e6", "value": "T18405F801BE44CE11F0191237C2FF494847B0AD516AAAEB1B7DBA376D59123AB7C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479826, "uuid": "48929146-614e-4e4b-9e4e-78c5d8ed4be2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479826, "uuid": "ae285be5-a48a-4034-b1ba-efb927189fbf", "value": "12288:x3pTZEKDt/RHFVDXJMv/mtGPC0ASwpHopAANk3gqjsCWII0Z3WWU1boz2/:fJHFVDXglC0HwdoRObjjWaZxM2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775479826, "uuid": "c026de7e-137a-4957-8ca8-f17dbe172185", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775479826, "uuid": "e47c1b68-f678-48e1-b48f-8c4d86057cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775479826, "uuid": "53daf539-e8b9-4770-b052-780fcf297966", "value": "0ecbbd25448979c877212160fc82b92a1aa2c5cf1f0f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c459e4-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775463647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463647, "uuid": "ae6bf3cb-9c64-4457-ad9e-a7e56cb75e29", "comment": "Malware payload (Gafgyt)", "value": "c698c8465ebff1126c4979f96babcf80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463647, "uuid": "98740b0b-08dd-4b01-8251-52146bc32fb4", "comment": "Malware payload (Gafgyt)", "value": "ee4732df2f600bba6faf9790d822a9ab9f40fe2bf72b0c64917359e12043a820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463647, "uuid": "a9a854de-e207-4539-8155-efed6bbb8666", "comment": "Malware payload (Gafgyt)", "value": "df0ae502372e4939d871fc19065653e43864be16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463647, "uuid": "93395f3f-903a-4abf-a686-dfb6abb199e9", "comment": "Malware payload (Gafgyt)", "value": "28eb9d58fefecf4f0370490923d4f7a21c1835a72e0d00b8a3e174876dca4e7fb4ffc2b8900cd9d373adafb8cec4b187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463647, "uuid": "fc178311-8a14-401a-9b7b-c42312f1c0e2", "value": "T147B2D17E97057EB2E125A07AD2D80B895B7B4FC4A2130C0B35C4EA66CF4209D7C5EAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463647, "uuid": "be0d65c0-fb35-483c-bdec-b0bb6b86bd7c", "value": "768:Crx/ShRVnfH0JrjISgQ52LSJgGlzDpuWeSDIYn:+y8JfISL52LWVEWrDIYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463647, "uuid": "a1ea2161-83be-4059-8b0c-04bc67c4974a", "value": 25428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463647, "uuid": "163e7bfb-bd28-4423-9421-24c9b833d45b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463647, "uuid": "5bed5dfc-d2ee-4568-82c1-4568684b25a8", "value": "cali.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095a00e5-318f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1775462583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462583, "uuid": "6e8d621f-c51b-4261-9267-859613463b08", "comment": "Malware payload (Gafgyt)", "value": "79705c9ab0b03aae6462944fcf224d53", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462583, "uuid": "cfe28080-cb9f-4d73-aa5a-62c9d686c6fe", "comment": "Malware payload (Gafgyt)", "value": "ef2f28b8f20aab6c56ab8bcde6a7e1a0b0ab17c2ec8cee02f3bf369140e8a700", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462583, "uuid": "3afec677-05e0-4db8-be2c-b18523a30fa0", "comment": "Malware payload (Gafgyt)", "value": "afe78b69e8def4806c63f56f85f9ea5e773d3c6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775462583, "uuid": "968d4880-a891-45ca-9d9d-60cc74d3bd75", "comment": "Malware payload (Gafgyt)", "value": "0fe3acde971f6a47336962994582e8c0b45fda4ea3e464b513366704c1bbba2e8c22ded8cc3c25989466e52a8b5d6c99", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462583, "uuid": "94bdbd6e-a884-4348-964e-ce28f3379f9a", "value": "T1274183C760E10770ECB5AA3772669801B9D9D0E626DD5F96DCFC38E9408CEC4389E683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462583, "uuid": "037dd2a1-b745-4284-b0bf-e2d9a46c8d40", "value": "48:1zttYLqnTPj/owXqCGa/zr3b66rserPqVo8:1zHnTPj/owXqCf/zzb66rsqPqV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775462583, "uuid": "ea0a50de-1c50-4147-ac5c-dbd64848dcdc", "value": 2115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775462583, "uuid": "bed423e3-352e-4f77-ad40-195cd3d1cade", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775462583, "uuid": "32f94ed4-a32a-4392-b1b8-0cdd0d1edcbd", "value": "californication.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5748a683-31e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775499650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499650, "uuid": "50f6ed31-f95e-432b-be9a-ca5bfdd9803b", "comment": "Malware payload (Mirai)", "value": "08a1ad08e7a4a23aadfb3a56298c7788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499650, "uuid": "636460ce-10f7-46df-9a13-984d128e107d", "comment": "Malware payload (Mirai)", "value": "efd769599467daafd299dd7f0b9e39d9c3a0b6fe76786da8f527bba62ecc863c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499650, "uuid": "dd900d66-6455-4bea-ba48-111054613255", "comment": "Malware payload (Mirai)", "value": "41bd0a4b1a90d6a32af33269d6940881c13dae2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775499650, "uuid": "bbaafd4f-0f58-4b61-bc54-63ab7231e00e", "comment": "Malware payload (Mirai)", "value": "754672cb4e8b35cf9b1e345379e01d7803322f95484dffc25aa072dd679dd4cbeb7d0439237e1f2aaa3c9e3df8bb5740", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499650, "uuid": "ad14fb70-355a-43df-b3fd-286cba98fd19", "value": "T134830946A313D8B4E94310B002A7FB7A5630EE711530A96FDB54FEF26A339D27D47229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499650, "uuid": "163fd141-2a94-49fa-9ee4-8e99d49824fb", "value": "1536:hArAvRXnrU3AmYlGLe0JmKjdUXwLWq0397ZKl69tzU931c5/obLv3r7yr:hAMJXrUwaRUExy9Yl6oa2bLTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775499650, "uuid": "5926ba4a-f051-4fc4-8cac-6048c4a7ebf5", "value": 82500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775499650, "uuid": "c20c6093-e351-4e7f-a918-f37be6bf0cff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775499650, "uuid": "54dc634b-5c66-459d-9928-b94fb5ec9df8", "value": "SecuriteInfo.com.ELF.Downloader-DN.62645173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00196219-31ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775487908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487908, "uuid": "1b60fcf1-50ed-4044-8fbf-7fc382af4538", "comment": "Malware payload (Mirai)", "value": "4806a550a504c1991566ebe2987b800e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487908, "uuid": "0253a2e3-3d70-472b-9378-0d15fb2ea862", "comment": "Malware payload (Mirai)", "value": "f088b7c8d334ee4ff0800e05c601607ade517f72851cea7a4769a049667420f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487908, "uuid": "50179f61-4aa6-46c0-bf48-96e22a5bebf5", "comment": "Malware payload (Mirai)", "value": "cae87419a9d75a038f76b58bb459bfc86de11a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775487908, "uuid": "4cce48d5-9340-4dc1-a538-6ddcbe0696b3", "comment": "Malware payload (Mirai)", "value": "fc0d12823ed6464ad460efc36035ed16effc254f6d0702c70effa74b0ddb2d05d557802021d55774da97f677ecee230c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487908, "uuid": "3df70911-59a8-4997-97e5-fabf9eb6df96", "value": "T1BDF43A56F8809F62C5D1257AF65F82B8731347B8C3EB720699189B343BD782F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487908, "uuid": "70663190-a5ba-4457-bef4-e130e177cb16", "value": "12288:NSF3Mt9ZWEDOahnr3fjE2D5Uh9BTugpWWtQI+eJ9tSywFiO:A3Mt97JLjnD5o3NSyJ9ttwFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775487908, "uuid": "09f91341-1e63-4b58-83d6-12f480b55ff2", "value": 729300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775487908, "uuid": "86a22496-f16b-41c7-ac6d-03c507f882a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775487908, "uuid": "097aaa2f-3f5a-4b8b-aa0b-8b4a4f174351", "value": "clientarm4n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335c1808-3205-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513334, "uuid": "e92aec9b-8b0b-46a0-8e26-b89868cb4d67", "comment": "Malware payload", "value": "9ec651202747883380efb7e2ae486d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513334, "uuid": "fb37fa98-8c7d-4002-9882-b23fe24f4f92", "comment": "Malware payload", "value": "f0a89ac1fa2de53f5aa6636c60ac111e08bbce7c9daec657769aebf07d1e0617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513334, "uuid": "f94e2706-8bff-4b2a-ad72-7c22c3f15cdb", "comment": "Malware payload", "value": "220e14ea577e2ab7a39a7663cacd1b700aad4c04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513334, "uuid": "45c75650-cf8c-4217-9588-49c3f9bb57c0", "comment": "Malware payload", "value": "4afe4d93861de2c0bea36f414d623e523a6186113187bd4668dc246956656f84496dbbfe71ad1515425a0e60dac5db9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513334, "uuid": "5cc2e63e-8633-4ab1-ba15-19d7b7ae9af0", "value": "T1E0F47D623721DFA1E355D67008F3C6505AF621A20BE240DA72ACC7287E2166D6D5FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513334, "uuid": "59742320-fe2d-42ed-a35c-e65cdb8c0a87", "value": "12288:alsmj7aEuogXX4FwGwYFFQS1EJVfHHXxsJiUfgpgVuFFWbz2pwVxbgq:als8aD4FwGw6FmxsXgFE6wVxbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513334, "uuid": "ce49003b-a51a-4c0f-a5a0-1c5eb92104f9", "value": 762416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513334, "uuid": "a71dd1ae-bf8c-438b-b0a9-a482d1e6b5d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513334, "uuid": "caf16249-6425-4f29-acb3-1ec997db41cf", "value": "sudpmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533dabc5-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442950, "uuid": "64425719-fe2b-4686-a766-2fa013bda2f0", "comment": "Malware payload (Mirai)", "value": "c943166045f886d764328f3f339e9bde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442950, "uuid": "172983c2-fcba-4920-8cbd-3580e2299849", "comment": "Malware payload (Mirai)", "value": "f13c7d5d200b7f2d63154c92fc9a5440c71c79a5cc6edcd84961d788be92cbd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442950, "uuid": "50717fa5-2574-4d05-badc-febe56d37c7e", "comment": "Malware payload (Mirai)", "value": "743ae2ad3c1625374f3285ebbec8e40bb2e6b299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442950, "uuid": "414d13d0-d35f-44b7-8be8-ec9c8180f860", "comment": "Malware payload (Mirai)", "value": "a1d747a25e289602ca2be45f50d6e78a0351c4d507faf103f80178a9f5d0cf6b4d48bcbfb854cf9aa21d0ccebe706bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442950, "uuid": "96a17abc-9f5f-4ebe-8ae0-3e2f863cfa99", "value": "T155831A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442950, "uuid": "69bc229f-c610-464c-8456-46da810ee5eb", "value": "1536:quKG91L4+gWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTbxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442950, "uuid": "12913263-96ed-4b1a-9b93-0b06589326d4", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442950, "uuid": "e429f055-e246-47d6-ae35-b659664adca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442950, "uuid": "4b05d0bb-966c-44b6-add1-43cb7eeec2c0", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a7541e-31de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775496911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496911, "uuid": "d8ccbb7b-4498-4f6d-b831-55470f6a7390", "comment": "Malware payload (Mirai)", "value": "a944e6d86fdf312562ec2b4f8b024ee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496911, "uuid": "17ea9e5b-a8b0-420d-8d5c-ee61adb5ddbc", "comment": "Malware payload (Mirai)", "value": "f1835a4c38417801e075ab281cc2a69eb2ad1f9c3466c0a2365fdf28f7bda3c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496911, "uuid": "ebdb83dc-0a9a-4a99-8650-9bccac5adf70", "comment": "Malware payload (Mirai)", "value": "1f97407e3ed72afd25fcb6cfaf4d006c7560e056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775496911, "uuid": "c3ca75f0-c59b-491f-80ce-c3ac029843f9", "comment": "Malware payload (Mirai)", "value": "1b619c5ffc063129c9d6d6a5525b582ca59677df9bee4b1a7b50b8fed0255cc069d2dbcefbbda891f293cf220e2ddeb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496911, "uuid": "4584e1d1-0146-4e78-b5b8-6864a7d4951d", "value": "T16A631A81FD87CAF6D41714B101FBBA3F9A31FD2A4435C6A6FB516EA5EA235C06203358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496911, "uuid": "3ed7913e-5c8e-48b0-b80c-f516411997b5", "value": "1536:6+Y/LMv3jwnN/cLvCtv+WIK037FlROjVfYkxfE:u/LMv3jwNkLv63037FbOjVwkpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775496911, "uuid": "2c70294e-c558-4278-b821-fa60ce6450c5", "value": 70448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775496911, "uuid": "5b391e43-3317-44aa-a4b1-9ad51fe1c596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775496911, "uuid": "8239c46c-07c6-4013-8438-d13fe6c025e9", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85c961c-31e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775497746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497746, "uuid": "410a9243-72e3-4bbc-ae14-21a5b5c7274a", "comment": "Malware payload", "value": "945ad8fe94017cc8e89966f044587c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497746, "uuid": "3755b993-8f81-4f4e-8ff8-ac5e0569a917", "comment": "Malware payload", "value": "f1c787c718ff0371b83857a495c82acb19fedf6ef07c41b5c6e14db4fe226be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497746, "uuid": "b827c79f-57f1-48c6-a240-4afb01777ea2", "comment": "Malware payload", "value": "917144f19793941dafe2dae6e822ed847e99aac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775497746, "uuid": "ce1ec50e-547c-4971-8fac-6478a527de29", "comment": "Malware payload", "value": "6f2fcdebcbb3ede2e8457075fd4563742341ad51791d0fac9953c633b519cf8990de72f829a16a9c53f9b5b31ca610b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497746, "uuid": "d29f3b8d-8f70-4508-9571-771751dfbfdb", "value": "T1E5567D03F39291EDC02AC0759355A333FA72BC89433576FB6B944A313E56FD06A29B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497746, "uuid": "d6d77481-8a16-48f7-8d3b-f616393192b0", "value": "a5a024fc3f11acfe721776107f7eaa8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497746, "uuid": "27bb0c80-b727-497e-b236-2db284cf8947", "value": "49152:ElF9jzZrr/JLeNdCP5Y6nAF4oTQR+qowM9jIQ4E98EVEqXEd2gV+wfdFt4nt/+we:URdTPK6AeoVHi/D+o9wH9TSVEbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775497746, "uuid": "5fd0d7ff-c8cf-4fc3-950e-95306fcf737e", "value": 6443008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775497746, "uuid": "2623d796-4af5-4de4-9c5b-82da3c91a564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775497746, "uuid": "3a5f2296-43ef-4d73-b059-a28433e308cc", "value": "app1_v1.0.2-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfcacc2-31c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775486077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486077, "uuid": "16f9cb32-a9d2-444a-a4c3-0019b3cbdd04", "comment": "Malware payload", "value": "9b4d8d1946eb5d8709b0d4a0e3b804de", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486077, "uuid": "1f8ba284-04f9-47ec-a80b-3bd7912e5afb", "comment": "Malware payload", "value": "f1c9fd65e72d13d0997a56836394b80c1b507c0f38c2b73931d614dde2e32585", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486077, "uuid": "95718c50-8ab9-4257-a423-0625ff50fc00", "comment": "Malware payload", "value": "cc09eafa3960097b27a8ab8a5d238e876cdd9096", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775486077, "uuid": "52a809b0-91df-4c73-bdcb-2d203596d64e", "comment": "Malware payload", "value": "4ac832adb07a30cec17a2820dbbb15a713ca793620aef40ffe5487f02e8973c1eb7563500d5c333ea7a6f3e08fb4a096", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486077, "uuid": "e2adbc85-7d2d-4d30-8b42-70da6d9ecc19", "value": "T1636633717EA53C6709A4832DB05F6F39AFBC4D53854DE6C6C4A8B0D335439828ABF468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486077, "uuid": "041a195c-3646-4adc-8266-d4a86a4f8de0", "value": "49152:KtCuJJs50TjPLoD15sBZneLKo0ZdA2EXlf5rO5NWqHZJyoDb60vRujHBPir/k41f:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775486077, "uuid": "d7cd1efb-aacb-4a7d-ac86-d048175e9e86", "value": 6785421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775486077, "uuid": "905e5dd7-f7e5-4c9c-8c64-c42babb2f011", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775486077, "uuid": "07e31737-fd2b-41cd-8aa7-f5540163974b", "value": "ReportePL1763-EQZBL597866qztjU8RM_Anex7327.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550a794e-320c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775516397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516397, "uuid": "4015c7f8-fad8-422d-989a-6437166432c5", "comment": "Malware payload", "value": "e0a0eecd0c4fb0ecac73bfd1dd25bdcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516397, "uuid": "ea591219-636c-40ff-9017-b6af974f241a", "comment": "Malware payload", "value": "f2bfda9458d056e284ee7187975f19a6d558545ec4061c0aa828dd06b3607a6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516397, "uuid": "2d0a081f-3b05-4459-9852-1482a960070a", "comment": "Malware payload", "value": "1eaee9c8445683a2163b241ec573594b0edc84fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516397, "uuid": "dc0edfdd-a3f1-45f6-9e1a-98899454e98e", "comment": "Malware payload", "value": "4f3bdc291994b2dce721d5dfe250d66f7436057d42f9017775e1f624b5ddb1e08a32fd23e2f3263839deebf4cde79d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516397, "uuid": "e560d78e-dbf2-41e8-a395-f749b4c6dde6", "value": "T150B54B19BC5C2852D5CE76736F7212C43239BC489F81C33BAA18B77C66F27988B17661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516397, "uuid": "4c5da192-d2c7-4dc7-ba58-e8e01555099f", "value": "24576:Znyvijm653EO1+wL5S0RBE4yojG3DFXPAZ0dwzGwHkkgRW0l6dqp9uFYpPtmsd:Tjm62OYo8oj8FnerWGYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516397, "uuid": "e8ab2d9f-171e-488d-9c2d-d594bec844c6", "value": 2331048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516397, "uuid": "0baef89e-d014-4306-bb1f-e1464047f487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516397, "uuid": "264cfbf6-d7f4-4e97-813d-602451f274fc", "value": "gofuckerv2arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56052eb2-3187-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775459275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459275, "uuid": "422a4fe9-1ac2-4c1d-be36-c0d5b04acfe6", "comment": "Malware payload (Formbook)", "value": "9c27eac2d178f884628ee6191354cec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459275, "uuid": "744be490-6bcf-44d4-b377-1ed72f8f7e5b", "comment": "Malware payload (Formbook)", "value": "f37e88ccac15a8cbf0adc55ff9148f3bcdb2e59051fd87fe459cf3f012901f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459275, "uuid": "cd906da9-78b5-46b2-8ad9-dd9cd8aef10e", "comment": "Malware payload (Formbook)", "value": "e9a1d69a69b61881d7a86f4c9bbe54c6a7c10cdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775459275, "uuid": "d116fdcc-c76c-499c-a526-6c9912b3c3df", "comment": "Malware payload (Formbook)", "value": "db251ed6cc6eb57eacd98d7b2b85730a82e2511bf1d260592402f6024a1b5d4d31991290e90189cc778f7b8aa4186892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459275, "uuid": "0da6afb7-c3de-47fd-88c2-7f43a3cd0ad0", "value": "T15445F145271AEF02C696DBF00D70E3B50BF62D845411D213CEF77EEBBA28B15A944A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459275, "uuid": "f0bef48f-ab57-47d4-a351-47429e0d26cf", "value": "24576:kuiQGE3CYLyXMtz+enKXdELg2zgZwfpKlLFG6WBW/duEzSJJSHw:knQCYLyXMxJXgPZwfpKbes/FqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775459275, "uuid": "a2b643fc-17c9-49f8-8dcb-190ecb80a066", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775459275, "uuid": "1b4956d6-d8e6-4114-8696-0ce5373dcec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775459275, "uuid": "932e70af-e090-46ab-8bf1-806b6eb60d51", "value": "revised Our PO# PO00436030.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a0d701-3191-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775463749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463749, "uuid": "3bcae792-a4ec-424a-b756-aea280631443", "comment": "Malware payload (Mirai)", "value": "89d3f3ce6f654953e2cee1101db8de0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463749, "uuid": "420b196f-0a91-4077-98e2-0559d020165b", "comment": "Malware payload (Mirai)", "value": "f4dc237995e7bec509ddec3aba11b2eee67d28a9decc8342205510473df4b14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463749, "uuid": "ee0ad043-f100-4723-a1ae-4f07703809cc", "comment": "Malware payload (Mirai)", "value": "ee0af29bd6034882da045dcf4d93f2ece4fd4dfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775463749, "uuid": "7eef9d86-1371-4fb7-9b03-c78cab0932ef", "comment": "Malware payload (Mirai)", "value": "f2c0a86814b080ce7e0e602aa6eb97dbe350ccf59bdb51e3128ce62d08b7ba5c21163e4ef61c131a71ba6766ec02c985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463749, "uuid": "efa427cb-f851-47e6-b7f4-991f9ae9ffb1", "value": "T14F633B12B15150FDC48BC1349B6FE92BFD32B8DD1224766F5BD47A712E72E211A0AEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463749, "uuid": "86681683-94fe-42bf-b7f6-bf06b024b792", "value": "1536:hZ08k/io/3XDd0bD9r6sm6heTt+oKULEIsYlor:hTZo/DdCFxeT8jIsYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775463749, "uuid": "6360233a-45ef-4911-ba52-5c0f042d2b4e", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775463749, "uuid": "a510c160-fbf9-4146-bcd7-05b730bf020a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775463749, "uuid": "4b38bcca-b0fd-4b19-868f-28bdd6e607f7", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edf8b43-31fd-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1775509944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509944, "uuid": "4dfe975b-0c3a-4517-ae06-8ee827b3625c", "comment": "Malware payload (DattoRMM)", "value": "a8a8e555456c1e2c22181e9b32149a49", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509944, "uuid": "6b80e7c3-1246-4a31-b837-93897a6d5b51", "comment": "Malware payload (DattoRMM)", "value": "f587e060e36b388d3eb025d1523355e16abef29d3b6cae018a4cc706c31d13f6", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509944, "uuid": "188da80c-dcb4-4ef0-9d8a-4a29c8435354", "comment": "Malware payload (DattoRMM)", "value": "ebd94081db1d8cfb986a753b5e8f72b076820ebd", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775509944, "uuid": "ffde9caa-3527-40f3-a91e-de4560a84bb7", "comment": "Malware payload (DattoRMM)", "value": "e6f9a1194c4c509f110b7c3ecdfc72fccee47ce852f97004b879b0869356a95a88491c93736aae87ab97a1382a1b8c7e", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509944, "uuid": "b09baf1f-ba18-4fd7-bf20-b89c62affbd8", "value": "T115B63347D9778DF0CA330B3890D2196B3205980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509944, "uuid": "22e15caf-491c-4e7f-8552-8abca21a6bda", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509944, "uuid": "3991f73c-7610-41c5-b70e-8ce693b58dd7", "value": "196608:6aZk+wpP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2k:QnMmzZFw5S9pE7Asjp29qIT0jarlZr8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775509944, "uuid": "8f9dadb7-4df7-404b-9a01-f1793c7934ff", "value": 11054336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775509944, "uuid": "e156ac81-3a67-4cc5-82c9-befdb44206f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775509944, "uuid": "5da21915-0e20-4236-bc19-29853feafddf", "value": "eCard_Access_VIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06706d01-3206-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775513688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513688, "uuid": "05416c7d-a208-4673-b1fd-6119aea71132", "comment": "Malware payload", "value": "9ec8514a5ffb7f50278aee2110a7825f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513688, "uuid": "5869bc68-ba82-4180-a4bf-d292fc3ac9c5", "comment": "Malware payload", "value": "f621e79743bdfedc6c5762e2839799930d1b1464f7864bc7db8f40746e4fcc85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513688, "uuid": "aa8bcc8d-9a19-48c2-a2f2-ad84f021765e", "comment": "Malware payload", "value": "c68c7f885a9be9bc9120aa07d262dde323078869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513688, "uuid": "0b1c2389-d8e3-43ab-be6d-4e6805db2d0f", "comment": "Malware payload", "value": "c4839e481af8f75dbba0b98a9637a5be5ed90f107e351ca35703dd1ce9ed8159dacb349c65a8f4c02e681f75d9222ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513688, "uuid": "f706ea05-0fa5-49ac-a30c-4a2f3224e959", "value": "T1DB056C233721DF65D355D67005F3C6509AE520A21FE2908AB26CC3287E2165E6E6FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513688, "uuid": "b4b080ce-7efd-400e-af05-3420675b19c4", "value": "12288:jyTxErsWgKmYGG3eJndvfu+VXA4AXGCLvy6Jl/OYXqgpbLMnzjNkT9skxJjuw6:jyTkgQV3+e4AXGSvL/OYXzazSBvxJjud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513688, "uuid": "16e5ba65-2db9-4037-a20c-cb59dd321ff2", "value": 836052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513688, "uuid": "6928e206-1a5d-423b-b2b2-93c6d42096bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513688, "uuid": "32026d2b-e1b2-4a84-8a86-3b149c47de0d", "value": "clientmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb2b376-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473111, "uuid": "d0a9e1e9-9d9b-4d61-9d13-284ad0670993", "comment": "Malware payload (Mirai)", "value": "2446f5f899d7de7046648b89fdfc6606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473111, "uuid": "51044849-81b7-4a34-8d8b-0e2326081886", "comment": "Malware payload (Mirai)", "value": "f65913e8c72670f4d31ed01c2531807590d79800090a6c7ce7c4f1906fdf083f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473111, "uuid": "cae58284-a3df-4a7a-8cf4-a8c4e8c6dae6", "comment": "Malware payload (Mirai)", "value": "5a63e818f4146968d1c4ee7792fad5d50fc6b8d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473111, "uuid": "9779d948-09eb-48d2-a2f3-330abf0ffd27", "comment": "Malware payload (Mirai)", "value": "90f4da002948fa5065325495d126a9c43798ac95f29ea93c5b2e17dac02a20a1baf4287f56593706d96806a636ea0ef4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473111, "uuid": "620b908c-4e8b-4bea-a5e5-1640e91db51a", "value": "T120330113B714BDA3DE761D39A2F94D8A3148025ED0ECA82235C859B162D315BFBD54E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473111, "uuid": "d702a586-29bd-4fd0-8a5d-06f120add9bd", "value": "768:JfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbZlQJMNZ9q3UEL2qEK5J6OAsNTGjf2tN:KPtQjiZVcykHRDZfML15J6RN2tA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473111, "uuid": "97029804-4245-4668-9ddd-6bc8cee97ae6", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473111, "uuid": "6e03edf8-84e4-4914-a966-d862721ec689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473111, "uuid": "f400205b-9c20-4e1f-9bd8-94dde878e178", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d75a6b6-315d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775441222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441222, "uuid": "875434b2-4a25-4ac2-8a6b-79e3a69c19a6", "comment": "Malware payload (Mirai)", "value": "0ec3b6f3b70cee2bf462c070edd309c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441222, "uuid": "4eb0ae46-0a59-4ccb-8080-91e28f91c1ef", "comment": "Malware payload (Mirai)", "value": "f6ab13b153866061e2af0b2f9e6485e515b387062a8e3b5dfcc8b939c95b3cf8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441222, "uuid": "d6e496a6-b406-44ac-9125-520d00e66d63", "comment": "Malware payload (Mirai)", "value": "3b189db468e43299976776005fee3daf9e6e9fb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775441222, "uuid": "fdd1ac5b-2729-4836-b427-8d90bc7b9d37", "comment": "Malware payload (Mirai)", "value": "43a324e05f64fda499fff2737448f88cc74ce2438b61d430413b467e76c011a84ed550610fd1faa384cdfbe891c40a83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441222, "uuid": "ded16df3-a323-45e9-a1d2-57add1fbb8e2", "value": "T11AE43906F8808F62C5D12676F75F8268732747B9D3EBB20699185B343BD792F0B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441222, "uuid": "9ebb825e-9fd5-45d6-8fa4-151cd2155247", "value": "12288:fFPPxrfi3U0DcZ6h5KF1F4+m/pUkdHL2MDPTE+8prPxS2VZELOsF:Bpi3U0Z3KLF/m/ikd1gbHV6LOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775441222, "uuid": "5d650f75-a442-453f-b456-4626e925265d", "value": 660800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775441222, "uuid": "9ee7a3b2-c264-4478-a41b-93dfcfcc82a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775441222, "uuid": "f2d21398-c29c-4922-8bdc-c8f916dfbf25", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574e5247-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442957, "uuid": "03d8679d-0b46-4861-969a-df7a33d6f1ad", "comment": "Malware payload (Mirai)", "value": "b04647aa893846d41641ad55e4c9ff29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442957, "uuid": "c6fc5d3d-9f45-421a-bb81-6fef5fcad9a2", "comment": "Malware payload (Mirai)", "value": "f7c22d510d84035e55a05890583f23c94196e8b881cc50827e1cac6f26c0d07f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442957, "uuid": "fa1ff0ee-43ff-4287-a7ec-c5ab722c717d", "comment": "Malware payload (Mirai)", "value": "d79d3470b0468acebbe60d2d5bbdce944b0ba11f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442957, "uuid": "880c3ed0-64aa-4395-9ed2-d8e6062862c7", "comment": "Malware payload (Mirai)", "value": "6003906df60128f7aac8f784f50bdb127e67425aa6375439d0467670af40e50f7a73e62b384c533abb033f7528266629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442957, "uuid": "d4cfd4bf-74a0-4e6b-853b-a1d8c8960a79", "value": "T188430262F65AD8E0E6D1647BF98FC649229F4FFDDCE19DA48D65201030870A8AEE0187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442957, "uuid": "9fad35c3-49cb-4cb6-8ec5-a0ace00860b4", "value": "1536:bLhCda1Ilnpz8OKsLrUCwpXohQSyLW7YBbST2yDOgSR:bl+pQKLdGYhtyLWNyyalR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442957, "uuid": "5483c16f-39df-4ca7-bc51-fbcaed9e5405", "value": 60088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442957, "uuid": "74a463e1-b075-4a58-92ef-365d20ad9978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442957, "uuid": "07f324a2-bd6a-457d-ae34-94ea8edb18b8", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab3e57d-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442936, "uuid": "02631311-bdd1-454c-9686-ea4f3e5184d7", "comment": "Malware payload (Mirai)", "value": "b00d7a396535194d224fe6f072429dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442936, "uuid": "e20f8a49-f253-4f44-892f-35d4898cdd55", "comment": "Malware payload (Mirai)", "value": "fa6ef1538debc1e3b38b73a538ca3d56ab56a654a9600cc5e6c90b3dac147d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442936, "uuid": "2cf2ebf4-9f23-4ebf-b58b-6a1b707fe1f3", "comment": "Malware payload (Mirai)", "value": "6484a05c86839d9aca2a3be52b50e43b2ef0056e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442936, "uuid": "082eea24-d6c8-4eac-8480-02652cf230d6", "comment": "Malware payload (Mirai)", "value": "88e20d1b0d7c400228a6cfbf7504aceb54c36c7f0d2a4cff31ec517141b05b5e7fca48bc1357ce78103817f29b5f9807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442936, "uuid": "f7dab462-fa66-4cae-9fa7-a543bd20e240", "value": "T11DF33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442936, "uuid": "af55a5c0-c8ac-4583-b749-1e2fd9919e26", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjGHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OGHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442936, "uuid": "9da1903b-8496-4554-a998-db0c3b0ef9c4", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442936, "uuid": "949a6e55-1c3a-4d1d-b980-a9f489b26125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442936, "uuid": "72720b65-ea15-4658-b04e-66cf93691422", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d505821a-31f8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775508022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508022, "uuid": "2dcefeb0-fce3-4815-9bd8-a2bca18dd30d", "comment": "Malware payload (RemcosRAT)", "value": "0eb6e0bc102a6c0b8aadcef7b72a77ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508022, "uuid": "ea345182-9f3d-45b7-90c9-898508066d46", "comment": "Malware payload (RemcosRAT)", "value": "fad38aff8a369937c5cb5029cba603c2322db0ebbc6adc21fcc92f1ac42c0877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508022, "uuid": "d23ca18f-b4c3-4d24-97e0-948bd9564aef", "comment": "Malware payload (RemcosRAT)", "value": "1de7e0a44fcd6755b3e61e57a4a3b78a7a3cd738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775508022, "uuid": "1176e68d-ba8f-49e4-ba82-6317a8488e65", "comment": "Malware payload (RemcosRAT)", "value": "5b18954fdfe7021cfe9b15f15bd754720771ee755c62e2b7df75bd21fef9f56897a00801ba8c95a9f7e9c5e6277faebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508022, "uuid": "01643dfe-ead2-4af0-8e20-c4af2b015528", "value": "T1D4B4AE02BAD1C072D57514300D2AF776EAB8BD202836497B73DA1D5BFE31190B63A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508022, "uuid": "b0bd8517-35c9-45c2-89c7-82f86adc01dd", "value": "7e09c6adc2f4ec4d02bb7dee2976ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508022, "uuid": "5b8c549d-cf70-47e8-a950-79643cc75acb", "value": "12288:0X7tPMK8ctGe4Dzl4h2QnuPs/Z50cvtQl:uX8ctGeQQnuyZpQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775508022, "uuid": "50f1e61d-efe7-45d0-b7a0-d8cb60dd24f5", "value": 513597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775508022, "uuid": "72638b46-3006-435b-89e2-4ab75ac367bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775508022, "uuid": "582008dc-a7b2-4c6b-9d16-56d2b1922c43", "value": "fad38aff8a369937c5cb5029cba603c2322db0ebbc6ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4835982c-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "da12666a-ed36-498f-a6b0-8af71fb080b9", "comment": "Malware payload (Mirai)", "value": "263372dd63d9b6d51f91a5d1544970bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "35b3881c-1f02-4e4f-9a55-e875e6d61067", "comment": "Malware payload (Mirai)", "value": "faf7e9847aa32eb899ec5c182d2260cbc22321e4681848e86fce93584758c4ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "9b23d67a-41e2-446c-91b0-62d0b7422052", "comment": "Malware payload (Mirai)", "value": "1f78401183f4030c8402b7efd84886f4aee9fc5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442931, "uuid": "f6c0a645-978e-4693-9399-ed3aea5deef1", "comment": "Malware payload (Mirai)", "value": "45cf6c7d53e9c21bb614149a38524a8a7fee9b6409513f479370b07df49010ca9869dbc2891711c9ad2064625d87a20b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "467e998b-1e22-47eb-aad6-12f355751a0c", "value": "T1ABA3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B767674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "8d7da561-1329-4b49-bbad-c96a866b41e1", "value": "1536:LvGefaZSdtoq4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdQ59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442931, "uuid": "59df9cb7-0085-40b7-93db-cb2b3334d160", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442931, "uuid": "3a4e28bb-711d-4eea-aa87-9e477a6c45c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442931, "uuid": "315b7319-bfcb-49f4-a4a8-173757c7b713", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee09f9e7-31a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775471986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471986, "uuid": "9f4f71f8-cf60-42e6-9dff-187c22c06e65", "comment": "Malware payload (Mirai)", "value": "b1af58c923f4205a18bc15179625358b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471986, "uuid": "956675a3-0463-477d-b6e1-f9b9d7291c8a", "comment": "Malware payload (Mirai)", "value": "fafc2152e9f17e9aa6014b10c18aa58b31ba2e7c125dc31530a7fef4878d80eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471986, "uuid": "34378a9a-b634-4474-a225-f1af67299168", "comment": "Malware payload (Mirai)", "value": "9980bbc904ff2fc79bef3a93120d2bb2cf804358", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775471986, "uuid": "2a420736-1b2a-4d38-86f8-26add5d91503", "comment": "Malware payload (Mirai)", "value": "2b258ecc2e0d48710bad22098edffcf4105e122cb93b7a5a78864a6427ed5e4c3d1061a00ba60ed0cce24432083229c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471986, "uuid": "0dd818a4-4728-4046-b3cb-42b90aa77b2e", "value": "T170732B85F9CB81F5C91B487090E6F23FCB31D9668170996DEF995F31DA77A02A2132C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471986, "uuid": "1b4e1a03-438e-4967-a567-63151a4ca7d8", "value": "1536:Ab8vIjJtrsF5yp6kmVur5G/x19KedHEvqqk6u689:Ab8QjDrg5yp6kmMrE/b9vevqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775471986, "uuid": "a5ed451c-f07e-4cf4-b2f1-fabef427d33c", "value": 74324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775471986, "uuid": "1114028f-d599-4ad0-bb87-80c8244b8c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775471986, "uuid": "8b5921c3-67d6-4cef-925a-3a3c4e993b30", "value": "mao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151d3521-3208-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775514572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514572, "uuid": "385763cf-40b8-4e96-ae3c-7eff0e70d05c", "comment": "Malware payload (Mirai)", "value": "62e24a3c0ea753d3ba3e5cf0d1da1b16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514572, "uuid": "ef17f98d-3ccf-4abe-be5c-c5322d670ad2", "comment": "Malware payload (Mirai)", "value": "fbc7dc46b542d8f61fdb815a5eadb3938dd763922e93d3d333dd727b3b821d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514572, "uuid": "f56c9549-f28e-45ed-8028-f81410608961", "comment": "Malware payload (Mirai)", "value": "5a4706f463e6e8e3300c58ef77352fcdf2572a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514572, "uuid": "ebe39e4d-70e4-45b8-bfc5-703c1cf32b0d", "comment": "Malware payload (Mirai)", "value": "99de9a32352b0f4e19521ac3e96774e288e9a588bef5ccd09100826c90b4e0c91580531ea2f59b71228419e9412d40a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514572, "uuid": "266d633f-1796-42c8-8d82-f8786d059887", "value": "T157B3294ABD819B02D4C321FAFAAF414933136BB8D3FA7112CD259F6423CA9970E77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514572, "uuid": "dec9ab13-4c6c-450b-ad36-9f5f39880e26", "value": "3072:U+TO/WXhKnxTtZaT9kj3GNLIegrUxSskn3:vKXZaT9kj3GtIe/Spn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514572, "uuid": "32df4e6f-70c0-47cc-8e42-22cef5a2f2b8", "value": 111352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514572, "uuid": "8d16dbb6-0413-499e-b3c8-8549363ef902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514572, "uuid": "5b01d74b-c1c2-4dae-a04a-b403f97e688f", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72073d5d-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775443001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443001, "uuid": "3cf9a352-1fbc-4fc8-ae15-e7fb30d62ee0", "comment": "Malware payload (Mirai)", "value": "dbfc6059821176704c0e941979ff7cb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443001, "uuid": "4d0c9982-622e-49bd-bbf0-127c565b8352", "comment": "Malware payload (Mirai)", "value": "fbe79d637bb0f45d8d133cb8431e0721e23a44ade6c796a01d54a4fdf97c34a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443001, "uuid": "297a7846-9837-4044-89e2-d2e60973a031", "comment": "Malware payload (Mirai)", "value": "32e2f93b2c9a98ad950953a57de34ebf8e5174cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775443001, "uuid": "21a22d9f-c150-4e1b-8025-42ea41d91094", "comment": "Malware payload (Mirai)", "value": "4d8e080aff26d5730ac248f51fe5a52550e489cb84029d56caf99b0022cfbb2f779150facb91c8c2f0e1fea176a4b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443001, "uuid": "d3764cbd-2df7-45ff-b001-75ee9bf40993", "value": "T1E713199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443001, "uuid": "442c1b7f-bd74-4d72-9d6f-eac5d27a7eb0", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwsoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775443001, "uuid": "2f601647-5172-46f8-b223-961f3ed05cbf", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775443001, "uuid": "02e31d61-77ac-435d-94cb-f81768defb27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775443001, "uuid": "f5f18bb7-6bdc-475d-89c7-af777f0f1865", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c07e1cb-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470372, "uuid": "3b0583d4-4bda-41f9-abef-aff2e33235eb", "comment": "Malware payload (Mirai)", "value": "7cb9d837a4bdc1c29f33c915adb178c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470372, "uuid": "80cbb983-c53a-4dbd-8fc9-c7ccf99cd383", "comment": "Malware payload (Mirai)", "value": "fc50bf0946eec1adc3e325eed052e8a96c0d49373fa2bb3c2c56a713e83e72ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470372, "uuid": "0f902c5e-7817-4276-87c5-66aeeb5b49db", "comment": "Malware payload (Mirai)", "value": "75c51139bfc0215769d01696fd7f27a97b6900ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470372, "uuid": "e781eee3-56f9-4b12-a798-369ad72e1354", "comment": "Malware payload (Mirai)", "value": "c0a1c64955624374ec30a5fe59b7c8b04c7c077296c3b116a9018ade33efb9884a90fc97f4b20581e3399877669b292a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470372, "uuid": "49433034-6434-4b08-b021-19230589211c", "value": "T179C2C0721AEF39B0C2A430BAEC7886D7511F4AB965F16521324056A1DEE200362BA8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470372, "uuid": "f972bec4-293e-4fab-a39b-65b41ab0c164", "value": "384:8WXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9chH+hymdGUop56:pjKX9vt6GqA3Q0jzV7EUyUq9e+s3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470372, "uuid": "2e919d89-51e5-4c77-9f18-946fd1b1a35a", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470372, "uuid": "c2d90cef-d8c5-40f9-b08f-59d0edf3851a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470372, "uuid": "3783acf2-4305-4c7b-a466-e9af5068962b", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d4d301-31b1-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1775477252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477252, "uuid": "2965e75c-8e1b-48bc-9c59-6637c072d942", "comment": "Malware payload (VioletWorm)", "value": "4e950740bf977e9c89d48cd323c3c0b2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477252, "uuid": "cc56d1cb-ad21-4164-95aa-f62de615b7c2", "comment": "Malware payload (VioletWorm)", "value": "fc8f755ff72624e30236dd2c3d1cda3183dd563db05cd5675ef123dddeb72ac8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477252, "uuid": "399bc5d0-0d3f-4990-8569-b63e7511d7d2", "comment": "Malware payload (VioletWorm)", "value": "8ea7671befe3312793227cce100c4c64c93f8c2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775477252, "uuid": "90099fb3-fcfa-4a95-851b-881150e26b17", "comment": "Malware payload (VioletWorm)", "value": "fce75ec0c3bbf79c5807c72e8e27842519fe72da50967817c667c7dd2075fb25832f727b97973e7cf8ad052336650271", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477252, "uuid": "22c24361-d648-48c7-b2b6-91fdbf69aeb8", "value": "T1D2C6AF4B82C73A9742D350B47B3929B9077FE8638A50C6BF2EDB004C444FF5D98B9666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477252, "uuid": "5ae84678-61ce-4025-8cc4-673b46a13e72", "value": "3072:RllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllN:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775477252, "uuid": "1805cf3f-b318-46cd-aa8f-b22f3e1de0dd", "value": 12362011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775477252, "uuid": "6153f5ab-1c5c-4abb-b5eb-dc7d99b4e373", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775477252, "uuid": "fdf65fb0-d186-46b9-9ac3-1628eab78527", "value": "YTLDYC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27326ec5-31a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775470364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470364, "uuid": "65caac01-f00e-46c5-8538-8bfd7b884193", "comment": "Malware payload (Mirai)", "value": "dd890740b91b2c47c356187145d7f671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470364, "uuid": "befcdc3b-8d23-4085-a8e3-ce57756f573a", "comment": "Malware payload (Mirai)", "value": "fc9bc615e35ce0b9131b78edb048857a545caa49f9a301cf3aa93aa21f206db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470364, "uuid": "f3bb9730-756c-4a99-88af-80c686afa96d", "comment": "Malware payload (Mirai)", "value": "a33da329f0540302c848bb155ebe8ef2569aa85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775470364, "uuid": "cd23556f-dd5f-4778-b3d5-e6b205247d32", "comment": "Malware payload (Mirai)", "value": "c96ff68b7c1ba70e6fdac628be3f63d8a95d5eb72c1525f690c4b80344de9dbbaddc6f4fcd01b9686c989310f8a7187c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470364, "uuid": "021949e9-6f87-4549-b2e6-403a8039d044", "value": "T1ACD2E17C7B0148D7CA6AA1744EE50B262D608F72F1525C077699EAD7BB0A8AC3CA5DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470364, "uuid": "dbf8cf41-2f6c-4619-a68d-95116bfe367e", "value": "768:I4ylAtv6pqLJM0RXaxGyUbXtheU/SmbJgGlzDpbuR1Jo:DMBqTRXa+Zhr/BRVJuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775470364, "uuid": "0227c9f9-b94b-456b-a608-2e8ed419c0ae", "value": 28900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775470364, "uuid": "c8fd2da3-3fad-4e30-b8b2-6700b288736f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775470364, "uuid": "00d9cabe-2e23-479c-a807-3935e1c8b63b", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f5e2d5-3212-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775518900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518900, "uuid": "a5fe00f2-b598-47c7-abc0-b654b349ef18", "comment": "Malware payload", "value": "cd34eac21060e9419d20bf865287c26d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518900, "uuid": "66a26534-9340-4532-8690-6ceb2aa8252d", "comment": "Malware payload", "value": "fcdadba2371f64d2649da9b06723c43cfde3cf14e00728af040bf732ed15e5bc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518900, "uuid": "22637f82-fc89-4602-ac7a-c1ef455719eb", "comment": "Malware payload", "value": "40a50743de00fab129c214eaaff7e54dd8993144", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775518900, "uuid": "66ef675d-3c6d-4f1b-b458-1959bcc9107c", "comment": "Malware payload", "value": "9903273346757b727550b28efb374d4349cd4b1cee66b7a16f4c0f758c9e0710c3ead5b9fe2c0f0c267b550127c92cf3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518900, "uuid": "1176d3a5-c325-46be-bdcb-1734114d886b", "value": "T1B06733DF884E1D46DCBFCA7184BCD60A64BA3FA65977596B1460B3A7BAF33C46070009", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518900, "uuid": "dff6d545-2e67-42f3-b78e-f4caa37e4c72", "value": "786432:sZKlnXutY5jmfqBrqM/IfInxrjXd0OzyVAPft4f096:mKlXMY9miIUhRjDxF4fk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775518900, "uuid": "8c531e19-d1cc-4237-8cb6-e9c1d4a25d85", "value": 30134272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775518900, "uuid": "32eb717c-544f-48bc-aeef-5a467e21f7f3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775518900, "uuid": "4cdf6d50-de56-4d55-9313-3277478e0b84", "value": "PixelPatrol.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37fd7b0-31ae-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775476236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476236, "uuid": "69d96f9e-3034-4045-ad2d-1b686f94b01b", "comment": "Malware payload (ValleyRAT)", "value": "2f16be03c052cd57450b5e35e584c17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476236, "uuid": "64b93c43-c791-4dee-b16e-2e65af9f31a7", "comment": "Malware payload (ValleyRAT)", "value": "fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476236, "uuid": "6882fa92-e2bd-45ec-bbe6-2c44d2a38375", "comment": "Malware payload (ValleyRAT)", "value": "be0c8d9fdad18ef9087c5881913d6c0bdbfdfcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775476236, "uuid": "3bf123ec-5c25-4733-8625-e4878c8b7fe1", "comment": "Malware payload (ValleyRAT)", "value": "a2c36797ad79ba406ab67e3e049ff95ae593e9f669ec52cedce929b3c7375e38d4de7957837d50610e7cf40c6dddf6b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476236, "uuid": "ec382601-a614-4073-babe-251f8b751172", "value": "T169262311BAF4FAB1D82416362D9243B205382DF5FE2167EB5FDA356A16344C24E21FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476236, "uuid": "b6d341ec-d825-4790-a933-c75cd782775e", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476236, "uuid": "076014cd-a5ca-4029-a3f6-c98f3d782a1e", "value": "98304:0V/jxI32sKznk/ZUa6ntzGRb0eh//IvlVixsIG7GqCC04tzAUnQGWaC/TJ:0VyGBnkxmtzGRAkov3Us/7GqnxAUQ7/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775476236, "uuid": "2a085842-1120-45e7-b160-cb638264c98b", "value": 4778878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775476236, "uuid": "9344d8a3-034b-49e3-a00f-73f2155b2393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775476236, "uuid": "058a6f83-35bc-44dd-9be8-8ac74835c102", "value": "2F16BE03C052CD57450B5E35E584C17B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632be43c-3161-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775442977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442977, "uuid": "e3736744-1242-4ae2-9506-42e42d241ebf", "comment": "Malware payload (Mirai)", "value": "b73b27debbd34b67bb3c68154da89ee1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442977, "uuid": "c19fce5b-9195-4b61-ad34-ff6c5d76732b", "comment": "Malware payload (Mirai)", "value": "fd6336d1c95edb8afe2dc9166a10d8fd0d3ffb4dd6ab627bc93c806bf9c121c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442977, "uuid": "03e487fe-3dc7-4c96-a079-0df0ae37ad46", "comment": "Malware payload (Mirai)", "value": "f43b6f3049c051eaa988c0140418eceb6d7224fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775442977, "uuid": "8c95d5f4-139d-4cee-a3dd-5d1974ef486c", "comment": "Malware payload (Mirai)", "value": "7f998f86015ba865b8c66f360cc34fc15c03f0a33e84ef363c3705d2c18593036e311653438bb086cb36a11c7c359416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442977, "uuid": "26c872b4-04aa-4132-81bb-e9226e19f7f1", "value": "T12603E03C4A0904F5D57EC17FE2AC83A0663607D96945CE522210F6A7A70E8BC74E2AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442977, "uuid": "f239f394-6d6e-41d7-b063-b7ec9f0fc2cd", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5sT4UZqtHJgGlzDpbuR1JY:q9xJZZNKNFjBfRUMGkUZqHVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775442977, "uuid": "78b34a38-d71a-4e98-b4b4-b1c008eb6e82", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775442977, "uuid": "1e1e3888-cd54-457e-a277-18133feb6b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775442977, "uuid": "cc01d5a1-65bb-4d94-8e63-3d70b633d510", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11057b55-3208-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775514565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514565, "uuid": "ba775e4f-38a7-4fe5-a91b-8aa74545d988", "comment": "Malware payload (Mirai)", "value": "757e47f5e78f5d583b1cb27b73a89332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514565, "uuid": "6bde3470-8a17-43fb-9529-28b12fce2fab", "comment": "Malware payload (Mirai)", "value": "fd78ce0c92cc5a7d42272d6a41eed008e2640ace349a9c25238d152cbd33dfec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514565, "uuid": "a25316f2-c7f5-4107-8e3b-c90dbcf47ffa", "comment": "Malware payload (Mirai)", "value": "b9936fc1a8b5179acabdafb502702d091ab1d04a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775514565, "uuid": "72a0240b-b9b4-4cc9-b116-75f71adf5b00", "comment": "Malware payload (Mirai)", "value": "7cabee8d24183f684091b752384e79e13f754bca043168e5ce044a2639306a1987eeb0b5bc55aafac2ac6a6700bc1b08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514565, "uuid": "67328366-0d6c-4589-961b-6cd5c4e5b162", "value": "T147734B13EE2A4F4AD54764F062F18E791713FCB649271EF6B522EAE48203DE871067B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514565, "uuid": "d5d5562c-f9b7-46d4-aed9-fd6ed36c26dc", "value": "1536:AXdeGOEUIZapMaKJBFE2YtDWkQYCqubK0J:AXde7EZZSM9JrYtDWkQYaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775514565, "uuid": "bf5f08f0-b568-48de-94c8-d05e8263a0c6", "value": 74416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775514565, "uuid": "a5094ca8-8c42-47d2-8c18-16e687591cb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775514565, "uuid": "0b032986-5c6d-4d2a-be91-1000ad1b7edc", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a52139-31a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775473155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473155, "uuid": "27094d68-4475-4b81-aded-46410b11641f", "comment": "Malware payload (Mirai)", "value": "782a518706465fa88350eb7f01fcae07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473155, "uuid": "61d7b62c-6075-49a9-ae52-26531bf7c602", "comment": "Malware payload (Mirai)", "value": "fdfb91ab732fad73abe01b9f8d9af02dd160d8a2caf8efd7ac7fcbe3088f4e49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473155, "uuid": "60f55b0b-cb55-442a-a53c-f416a00dc9ca", "comment": "Malware payload (Mirai)", "value": "952e04da5ad056a15fbc4dd69b8c191554b6e763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775473155, "uuid": "5598015b-706c-4d56-9922-bd03facb1129", "comment": "Malware payload (Mirai)", "value": "9d3e17362d7ba40289e95c3a46adf39424a7554ba31d360b5df5071686321508d7c94b575c84c8da2f486f2672476c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473155, "uuid": "bc2f473d-ed0f-424a-81df-72d9c86a8dd4", "value": "T11FE32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473155, "uuid": "e2cf3380-cbce-44c4-bfac-9368ab29d1d0", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzEX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduG3X0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775473155, "uuid": "74a41c66-dbce-417e-8179-7785e323eac9", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775473155, "uuid": "083ec17f-9505-405e-86a7-76345a24730f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775473155, "uuid": "1f90112a-f049-4fe0-972c-1e6791672ea5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00173e94-3206-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775513677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513677, "uuid": "51ab0b45-ccf5-4fae-8687-683c2e311b0b", "comment": "Malware payload (Mirai)", "value": "3d49c0e17251669ab648b769c937784b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513677, "uuid": "df5ecc7e-8309-46b6-b027-f18f9c8c0a9d", "comment": "Malware payload (Mirai)", "value": "ff09ecee295083b3782d8d4685d81075fa28c5f5a50bc79f9ea8c1e1692e5ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513677, "uuid": "2a630333-da21-45a5-b167-3f058bb28966", "comment": "Malware payload (Mirai)", "value": "778b2be5f6e77a21f30975b8a7ea82c1427a8c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775513677, "uuid": "354ba6c4-d9f6-447e-b941-2f24e14c2f8c", "comment": "Malware payload (Mirai)", "value": "da86bc8005c4bbb015b11357441338735b3f7d5d4080b3d664162349e2610feed4926281605c1ef57d014bcb4ea3f63d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513677, "uuid": "7456aa98-1075-4ad6-9abd-76a9a5f844cd", "value": "T117632A866B43DAB3E55311B402BBBB365A30FE3B0831D997D3607DB39A219E1611739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513677, "uuid": "4226c122-9273-4ab4-b52d-7648f578f2c3", "value": "1536:wmCDPWJAme4zoZ+174l6TMOLunIHIFLX5BFe/zM:LC9meA174POynI0LX5beg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775513677, "uuid": "9d86b0a9-6c3f-4377-998f-fdbce6d0ea38", "value": 69888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775513677, "uuid": "2026db00-e908-4913-ade0-a1f48d9b97c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775513677, "uuid": "38aa40ae-71ca-4526-8f42-8c790faea90c", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d994f8-320b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775516121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516121, "uuid": "8feb3323-603d-4354-a15b-43e6ebfd4a81", "comment": "Malware payload (njrat)", "value": "129df3c4dcaae4c1860a334be50f2ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516121, "uuid": "2cd6a9b6-f7b2-4aea-be35-21531afe5201", "comment": "Malware payload (njrat)", "value": "ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516121, "uuid": "a57c334e-9dcd-44e0-a3e7-5504cd2387d1", "comment": "Malware payload (njrat)", "value": "4cda77bc5d5c136c4a5a19122fd378b045cc7dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775516121, "uuid": "0042e4a0-a952-446b-82af-4a2380ab6d7b", "comment": "Malware payload (njrat)", "value": "634851e5fd8215dec2b0dbba2e427f37533bd391d57d2a3736fcf5fd2dd655ac60c003d2c10e2e46387431f168141db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516121, "uuid": "aafad291-adb2-4a63-a545-7faa5625c0d7", "value": "T198032A4D7FE18568C4FD197B06B2D022077AE04B6D23D90E8FE664AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516121, "uuid": "b435348e-63e2-4585-97b2-b846a0e6de1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516121, "uuid": "f927c137-dac0-4a23-85d0-e0246a953343", "value": "768:NjrzsKADtOHiR4akrkQMtFs8rM+rMRa8NuQ4t:Njr6tVS4QMtaP+gRJN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775516121, "uuid": "9b58dbc1-f80f-44a6-8bbd-5522b3e1b0ff", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775516121, "uuid": "ddc6a4d6-bfd4-43f0-b36b-afae7e3e352d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775516121, "uuid": "e62f4861-d03f-4c64-8207-efcf50810031", "value": "129df3c4dcaae4c1860a334be50f2ed3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }