{ "Event": { "published": true, "date": "2026-07-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-19", "timestamp": 1784505781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0a4b5334-e55c-4ec2-998b-7e6e67c7a2a6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e098f0-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489657, "uuid": "db14a31c-2c5f-4cee-ab70-ade089f2904d", "comment": "Malware payload", "value": "a27bee0cbf9e6915d6bc722a865266fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489657, "uuid": "80779928-91e0-4d3f-a386-1c5ca1e63896", "comment": "Malware payload", "value": "0001809b16c9caf85c2d8459d9931e61375ffa9068f0fae19092021b3d41b930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489657, "uuid": "4b227afe-18cf-4df2-b480-289e430f1206", "comment": "Malware payload", "value": "42a268f8ec3156379625a77c082a4270e8a5bf2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489657, "uuid": "a7e2619b-302a-4b34-9081-000b74fc63e5", "comment": "Malware payload", "value": "a57da17403f590effad67b3de15d4efa4ad4494b48c34aa2591ef90b9594defdf1f317faa378f15545856f9c62276c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489657, "uuid": "4e6335ae-d69d-4a17-b53d-0d6fe1d8f64e", "value": "T1FFC3E746FD418F13C5C721F7FBDE42987B166B6DD6FA3202A924BFA037464D60A36212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489657, "uuid": "68ce8641-d446-4163-bf8c-92880ef6bfef", "value": "1536:1uz0uf00VgIQu8qaM4VVRqs7dxswEFDfgME+HozHUfolKuAwywpWndNImgqnpAOm:M0yTDQu34JqspxsoMUz0DpT87z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489657, "uuid": "6fc62a04-190d-46f4-b39d-593e10e5585a", "value": 122576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489657, "uuid": "d8df4774-701b-47ef-9621-68a358973153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489657, "uuid": "3021fa2d-7485-4c20-91d0-2873afd2da8e", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5331b7-83a1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784486448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486448, "uuid": "7122b7fc-3957-4dde-bd51-73d5b75da19b", "comment": "Malware payload", "value": "06543f416af443253719a0fe9fc17951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486448, "uuid": "e925f61e-103a-4413-bcb2-a16d25285d1b", "comment": "Malware payload", "value": "00e4d6eef2089f774e0b1369eabe9df9696005cb2415eebe3eb1496a1aed8a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486448, "uuid": "79222ca3-9909-4b21-af30-a84c15c174bb", "comment": "Malware payload", "value": "ad76e92c83c16edfdc799b1ddf6ac755f51438d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486448, "uuid": "ca9a6a7c-134c-43f3-ba3f-8455321f3e89", "comment": "Malware payload", "value": "03681605a3d14dba0c11df4a255998d308b57dc17ab8b4d92f1de581d1485f62a58a9c9def6ca430c5ade6fcb71c6709", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486448, "uuid": "dcdb3321-b605-4aa5-a171-9b98b2b92505", "value": "T1D4F3C6066F519EB7C86FDC3306F58A0124CDF46725A4377A36B0DA6CB91A58B05E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486448, "uuid": "0526e43d-50e0-4192-9c82-04db07115e8c", "value": "1536:6ff5C+rnnN+35NiZdqlb0ZUnVyQjoKYeLZ093p7PF7yH2RTc2/IokN9xjGwv6oFJ:6fhC+zNEN6UYmyN7ylUyzbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486448, "uuid": "282ae556-63ef-4def-809e-8dce4d6da716", "value": 172304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486448, "uuid": "47af2895-cb40-49dd-8424-b4297a5c6d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486448, "uuid": "d8b22c88-78bc-4ed2-86c1-d5e1cab74865", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e139e-839a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784483529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483529, "uuid": "ace397f8-5379-4ba5-ad69-c5ff6c815a5a", "comment": "Malware payload (Efimer)", "value": "e445923a1525fcdd748e47a893c6b441", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483529, "uuid": "653d2ce8-82a5-46ae-9c8f-87ada8c591dd", "comment": "Malware payload (Efimer)", "value": "03e40798b193db7de556657be34522abb0a4bb6f74b2e71bb4b4af44dab6aa40", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483529, "uuid": "7c92ecf7-313f-4333-9660-d6cb6b2816f5", "comment": "Malware payload (Efimer)", "value": "5c6836216951542c83460cf7d60b6c5dffc38606", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483529, "uuid": "276ab9a1-2798-4de1-8a61-6b9260edfb39", "comment": "Malware payload (Efimer)", "value": "0a3f6965fa8c9d0a507cbe210a6aec91809158f58f28b8c04da72ba9bd7f72aa5af0cf38f4f9df7740f5fd07bfe12912", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483529, "uuid": "3859a3fa-1c7d-42fc-adaa-e2f185a0ef68", "value": "T1E7E6332CB5E042FEDA27813DDDE1A244DAA270B54335C5EB1B6C8761AD472E08D3D72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483529, "uuid": "20329d9c-60f2-49f2-86fe-a11d44989fd0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483529, "uuid": "967e1406-db8d-4c41-a7fe-c00b2830bd4b", "value": "393216:UkQ1ksmCf8wuF0i4hYYDXMCHWUjX4cuI3/PGTAI:UkQ1iFnKXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483529, "uuid": "c60052e9-f60f-4d25-bd03-6c1a51d02709", "value": 14315411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483529, "uuid": "2ba45235-91cb-49e1-9b7d-313f37884239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483529, "uuid": "5ce83d36-8d02-459d-925a-7691d4ab1e00", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bead1792-837d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471151, "uuid": "276d2e9d-d55a-4421-b26b-3b7a9432f2e3", "comment": "Malware payload (Mirai)", "value": "b34611c67ace6c32c32d44efaa7fb65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471151, "uuid": "10086522-d337-442d-8a4a-38d364cdeef1", "comment": "Malware payload (Mirai)", "value": "0447b20576efb9b14cabc98ee5ea2a6ea9ef417dac962c2e3722ac364cd7245f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471151, "uuid": "d8abe4d2-19a1-42a6-83a3-d72de788d0cb", "comment": "Malware payload (Mirai)", "value": "863575dea27bd7e3f543bd8be77b64edae7feed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471151, "uuid": "03eaa234-d063-47b4-b630-b94e0aca7bcf", "comment": "Malware payload (Mirai)", "value": "d61f1027af6ddc0325f8578048db369f742f4aa2b466cdac4baa1a9ad176977baadfffb06a9340b4391cb5eade7f078f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471151, "uuid": "92b91e9b-0789-41e4-ab56-f858233fe6cc", "value": "T15D3302841D7DF691F74935B9EABB83430A92DDB5C2A93AF1304C3929479105FF3A91C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471151, "uuid": "dc0c83ca-c0fb-4ac2-851a-c43ac2ed3e4c", "value": "768:J+0HTjQRSHT4k1KQB0sLCf64+GxOEbC4v54to3+fgQl2MX6W2/rTcKmVriissHpe:USQRSxKQBkf5BOEbJ54tEuxX528f7f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471151, "uuid": "10551ee3-589c-4648-a01d-bedf04523e39", "value": 53736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471151, "uuid": "129b2d5f-03b3-4cdd-9a95-b439f1414051", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471151, "uuid": "f9522b78-1c67-4d0a-8f60-feef1f4ddbdb", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482aad71-833c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784443035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443035, "uuid": "0ff417ce-452e-4788-9c48-240c563eb26d", "comment": "Malware payload (Mirai)", "value": "e4360bfbc3ded2449283748d69a9915e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443035, "uuid": "bf1d0722-360d-4630-bc8d-da3b229bcf65", "comment": "Malware payload (Mirai)", "value": "049eec47f9eeb59798b212ba4124ff65698b6c32cab8bc408d632feb5c79d0e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443035, "uuid": "5b1c660c-05e2-44c6-8363-de6facae6adb", "comment": "Malware payload (Mirai)", "value": "f8bd33e5d2e59e8dbf30ad06242b33d1e4f48049", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443035, "uuid": "4794e41d-91b0-4718-bf91-5196410860b1", "comment": "Malware payload (Mirai)", "value": "a8cb8d2e68174ee526429c258ac27c91e3bd536b665644f9a524b1280ffdc1761a83efbc6b54eebd13dec670993185fd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443035, "uuid": "cce5618a-9970-4559-b192-97d4ec7bb282", "value": "T141016FCDE150D50050A9D46D25975094FC70C3C7164B8B74BF6CA8799BA8E18F06AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443035, "uuid": "c3163728-3179-43bb-a4a5-8b70339cd618", "value": "24:kXCKysE2hi0ziQvZohaz1iQkMYTY1XzFy2JKX:e9Qp+MsJix/QDFy2IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784443035, "uuid": "74368777-2458-479a-a0bc-d1605454c6c5", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784443035, "uuid": "4884b321-6da5-4109-8ac0-fa9a03f74eda", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443035, "uuid": "5dee567b-f82f-4917-b7e3-88cd50dd1247", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0517256-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494374, "uuid": "acc18e83-15ed-4fee-8320-8cd615920072", "comment": "Malware payload (Mirai)", "value": "641fc943620495af9a430e4c57595594", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494374, "uuid": "4c5b6d40-dd8d-41b5-b793-aacefed6381a", "comment": "Malware payload (Mirai)", "value": "04be806b0e00c09196d872100820e5b231486f4f5f9cc14420b3d48006c44d58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494374, "uuid": "55e48a72-6bdc-46eb-97ec-3d30846ca5a3", "comment": "Malware payload (Mirai)", "value": "f3322064223efeb67752a8955223072debe9535a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494374, "uuid": "ac8cf0e1-7c71-49de-ac23-33b25896abcd", "comment": "Malware payload (Mirai)", "value": "15c982d3780bf2b7a0b380d40b4371607708d48bd2447ae06c9bfe8181a9ff09ce8ba19fe125eac79f49c1a96a750934", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494374, "uuid": "2c9e2a88-cc99-460c-a175-2dff8dafee7f", "value": "T1F193BF62D82D2C58D1A549B4A0B4FE7A9B23D85059932FF3439EC6769047EDCF60E3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494374, "uuid": "3be5a6c2-80ca-48b8-9096-a75b723859db", "value": "1536:9Z/0p91yt1siUWNxRHGiIKyWtJ9pRm7Cxf6dLVxvW:7sp90IiUWHlGivyYpRm7Y8pxvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494374, "uuid": "93cb3001-ec08-4cb8-a63d-f46ff6162570", "value": 96880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494374, "uuid": "689170d2-6146-4057-ba74-20415030d8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494374, "uuid": "b2bd254b-b779-4c27-9b75-349f9d5b5f7e", "value": "ohshit.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c1ef58-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490038, "uuid": "67966b43-971b-4320-b19a-ab094449c7bb", "comment": "Malware payload (Mirai)", "value": "1b4b8763a42083bd436dc5817f5f63fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490038, "uuid": "a5961d88-32be-4796-b7ff-66c427614dc3", "comment": "Malware payload (Mirai)", "value": "05e8cf3550157bfce5f15947f680f638d1f07bea34cda51c8197f38f3e909419", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490038, "uuid": "c20e5388-5088-41c2-b21d-0ce4546f9e7f", "comment": "Malware payload (Mirai)", "value": "b5382cdbc355a0ec87b8f7c4abcb774740bc9e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490038, "uuid": "ad3fd20c-c06c-4ff5-ab1c-aa664bb56435", "comment": "Malware payload (Mirai)", "value": "7761b237a489c8c6e7ad5732e8397e9759a1c04de4cf5860b84755929785d4b23ece4695b0e22cd81c0873c89f65a332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490038, "uuid": "9cb54a43-c71b-4662-9f78-951df83b9b4a", "value": "T1E34302459056A7A1C9F02D37F9694132032679BBE3E4F7B723048A24E7D799B93B03E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490038, "uuid": "dcfc9320-cf6d-497f-bb7b-57acca8e0929", "value": "1536:EOiIWWyZwlfXunZE3bSYdk7Pm0QPP/LfK:LHfXBbZdgPm0sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490038, "uuid": "4965b5fd-2301-4e1b-9878-70f5ea05ac3d", "value": 55496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490038, "uuid": "4de372a8-aa9f-410c-8f63-6faeae54b8b9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490038, "uuid": "e066e910-7c31-4d73-8a60-8636a600a90d", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e88981-83ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490808, "uuid": "9ec60ce2-67cb-44a4-958b-0d17cd81e49d", "comment": "Malware payload (Mirai)", "value": "08227b5571908a69850ac1f39415d9e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490808, "uuid": "93ba1c80-45ac-4e08-9039-965e65877c57", "comment": "Malware payload (Mirai)", "value": "05ec121122c48c83b1c559aa405e0939a921d5d3db0d608a12ae82dafab3945a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490808, "uuid": "1cc70eee-bf51-4022-b69d-68f2344282c3", "comment": "Malware payload (Mirai)", "value": "0b4b8b2c9fc81014e18cb8bd66d153ab1ec034b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490808, "uuid": "537f607a-6895-4f8c-83fd-a3638d5ddf56", "comment": "Malware payload (Mirai)", "value": "43418b083374cb9d7c460a2b16cdad6cb668e7bffa29f68f0548b43982c54c6c3cc3ae26f6c1afdc3c8bbc0714eceb4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490808, "uuid": "636b1f75-8b34-4e76-9757-95af5fd16bf9", "value": "T1514302536B0BADF2E238703EDC9C93531E0E2678F6F53315AC1C126DDA456922B75748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490808, "uuid": "6add4663-7968-46c0-b683-3facf9691b41", "value": "1536:bBcScOfmXTN6nOUCX8fi+m0gGq/xWT2V6kfl:lc9jNghCOi+m0gfxWT2VVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490808, "uuid": "ab4d04fc-8eb4-45fa-ad3a-7b25035305ad", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490808, "uuid": "c6c520dc-4c81-4387-aaaf-37244c2495ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490808, "uuid": "aaa5ed8b-4877-481c-98e1-95a322b1a4c9", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101160ce-8380-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784472147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472147, "uuid": "d37c2dd9-9326-46d0-be19-f0cb186d534b", "comment": "Malware payload", "value": "ba0eb595f2842f09f6ee28781fc0f51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472147, "uuid": "d53c4fa9-e6ed-4f28-9a5a-ccd20d58682e", "comment": "Malware payload", "value": "06e3950cfa439625ead51e1c47c4ebe9e1762910c91ee77687f85dbe02d3f437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472147, "uuid": "f2ede4de-228f-4720-9149-4ebe944f93dd", "comment": "Malware payload", "value": "c23a1ca5a32d31896ef3d05894620a88081bdc24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472147, "uuid": "d8f4ddb1-896b-4134-8864-0aa3627e240d", "comment": "Malware payload", "value": "cc96233eeff52723cc6104274e689b84f8f2d5305fee4b752b6e6b7b1491641551b738a45aafcb687091524492586a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472147, "uuid": "5c021928-abfb-4ea9-ad03-af2a620ba540", "value": "T17916235CD3A405F9E127E278CD461945E732BC0897A1EACF43A5ADA60F333D09E39B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472147, "uuid": "91d3cfec-6666-4f90-a0e5-7a3b99f8f1d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472147, "uuid": "9f367dec-51a1-455b-afea-1658f73cfbaf", "value": "98304:RKAc8jQoAvOVT7QcwiInaNFNh4zmC4r+jU872bU+f5d5iBBkNw:RdWq7qilthEGkUtNfH5iBWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784472147, "uuid": "aedabeda-d926-4209-a755-02980db27f09", "value": 4359168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784472147, "uuid": "588a5906-2817-4bdf-a699-0609c86b689a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472147, "uuid": "4a4d346d-b233-4f8a-a92f-9668c507df59", "value": "e24f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4656a399-837e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471379, "uuid": "66e5d545-b649-4567-adca-b9955c04d57a", "comment": "Malware payload (Mirai)", "value": "2c8fff8fa0d24dbc5a537c0bbe88ae39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471379, "uuid": "0d97a800-c9bb-44b2-801d-cbb025f60238", "comment": "Malware payload (Mirai)", "value": "07e2eca37d83df539f2f000955008c37e91c4734bc6091cdfb1ea6188cd929f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471379, "uuid": "bd09daaa-dbea-4099-ad15-700a6b37976e", "comment": "Malware payload (Mirai)", "value": "6a9e749620c2af1a8648f246d377600d9eb78c67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471379, "uuid": "7f18c0e3-1c22-47eb-a94a-1601a844d206", "comment": "Malware payload (Mirai)", "value": "172e9209d830f13f2b43b4591378b9cfc09e6cce4fe8b6f14f5be4e0b9bc0a7573f9109027519a619107f1cafcec548f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471379, "uuid": "fa63d8fd-1bc5-4fcb-aa82-38d2667c2a65", "value": "T10FA3F606BB650FF7DC6FCD3706A90B0225CC651B22B93B767674C928B50B65B0AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471379, "uuid": "4d8a8df3-31c3-4a39-8749-b1d17d0186bf", "value": "1536:2vGefaZSdB7KCKul4ySODV/yxpZNodZS5Ftb9lQvts/A5gB:2OefaZSdQ8V/Kp5J4vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471379, "uuid": "972a09f1-dbf2-45ce-82a6-6344514215f5", "value": 97832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471379, "uuid": "d5ae70fb-620e-468f-812b-f0cd9aa1a3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471379, "uuid": "8d92e711-92ef-4782-bc48-6039e9f46881", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9f6b79-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494472, "uuid": "4003aff9-5b76-42dd-ac74-b430b1899260", "comment": "Malware payload (Mirai)", "value": "c850eaba5a1e5ca53b353f1b860143ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494472, "uuid": "71c0709d-e45c-4575-926d-e47809f5f03a", "comment": "Malware payload (Mirai)", "value": "09307cc74b603de4f3f39f5da80c74eb725921f55afdea5fce6b3196c15b810a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494472, "uuid": "95a28c8e-07f6-4d3d-9a73-99cacc275ad1", "comment": "Malware payload (Mirai)", "value": "2287c0c3091ca34f90c21597da7bf80cbfb74569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494472, "uuid": "3d0453ac-3a97-4383-965b-23d49798b47e", "comment": "Malware payload (Mirai)", "value": "4b4381d475adfad0785e152130e24715b552801fb6c5d6416f38b5d42cbea6957b8c51a9e0658059222ad814ea162aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494472, "uuid": "da49c3c1-0185-42bc-8533-034896fc0bd7", "value": "T1D3A3E90ABF611DBBD81BDD3705AD0B0234CCA617716837793638D528BB8A54B8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494472, "uuid": "3d87811a-2db4-431d-8ef8-1d6d94cc8eb9", "value": "1536:Zs1iNYd1RmfBXc6fBAFlDuqauZZSk40vM+a0z69ogdDgC3Oa6CMFo:TW1RmJX5fCFl6iSz9H0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494472, "uuid": "40afcf85-c66b-467e-b110-76513c3baacc", "value": 101492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494472, "uuid": "acf59131-5c30-4f77-a546-3866293ab9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494472, "uuid": "883215c5-5de1-41f5-9351-1e368edb371b", "value": "Clq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2c69ee-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784479017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479017, "uuid": "4b7106dd-0d36-4ac6-969e-86ef2792b63f", "comment": "Malware payload (Mirai)", "value": "795f3e3e530b2c8049e235a130107700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479017, "uuid": "38d39658-c3a9-48a7-b440-c7b46c167438", "comment": "Malware payload (Mirai)", "value": "099003391c6e4521a33edb2fa515ca5d100d3c47fd5c47ad0b507d31a9827179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479017, "uuid": "bd28a946-0628-429a-858c-4ed49d016404", "comment": "Malware payload (Mirai)", "value": "0282a6b4aa32fbee6550bcde1fa90152c7096e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479017, "uuid": "bc8442d0-e196-4e47-b9ac-774db17c6dd0", "comment": "Malware payload (Mirai)", "value": "f3ef886f42937eef567ddf2376f004b1765a01fb8597c0ebcc28872b0f8b7124bd1b46af17d8ab699175a886b21e965b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479017, "uuid": "c6400941-1ae3-4b91-9c31-db0172581587", "value": "T178A3E649F9429F01D4D731FAFB8F425472536BA8E3F97101EA205F6123CAADB0F66612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479017, "uuid": "4de14bec-8bb1-4242-a124-fbd26b6c992d", "value": "3072:Wimzm5pGjL+9YHa8gTpI5gWB2apnqirYeO:Wi9/ML+9Ya8gTehqirYeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479017, "uuid": "6bd9ee11-22e4-4c33-beb9-8ed58bfcfc52", "value": 105908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479017, "uuid": "60e00373-b185-4683-837f-4b7b0e68fdac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479017, "uuid": "79a2dd76-d306-4d3d-8b58-f6a716379e1a", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b8e8e1-8359-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784455747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455747, "uuid": "64dfedbd-8e14-4d09-8b56-e0ab5d1656ef", "comment": "Malware payload (SilentNet)", "value": "983a814e076694e8b2e2aae56367fd73", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455747, "uuid": "32680252-4313-4dfe-9c0e-aef80b90cfef", "comment": "Malware payload (SilentNet)", "value": "0a154cf463993f837cb494df4aa857ebc86314593fda5be274d882ac3ef0f7e0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455747, "uuid": "8fb37972-dbb4-4671-b04c-7cd1d3d354e1", "comment": "Malware payload (SilentNet)", "value": "8e3db5f7a88ea69285373735d92751918958edd2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455747, "uuid": "de09b298-dd7c-4eb1-9b52-7b538359c213", "comment": "Malware payload (SilentNet)", "value": "4e4e0a8a249dc3a828ad2b71863505fbdd80a7be5640d03b05ffe900d752fad7c94f167bc98a3dbc0cc169e343b88aa5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455747, "uuid": "3ccacbcd-d0f0-4856-b1b5-e4cdf46769e2", "value": "T1E2A3020657982D4FCE561EBD8E47DAE12C761CB09909F2BB2722080D186ECDB9F70DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455747, "uuid": "0148960d-9708-4df9-98c1-67d736646ad8", "value": "1536:nE928cRwFNqvUAGcJznQ1xx7XFHk0tsE5UZdLWAbMjCX7JUWIZ1Z4cZFFp:n+Gvz1JLQ9Xu0WkiLWApLJUtl3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784455747, "uuid": "b4525a26-0b0f-488b-98dd-6d8a71a2ee73", "value": 104175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784455747, "uuid": "032fb6c9-f687-4f5e-b27f-da241b4f1f80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455747, "uuid": "0eff7adc-cf11-437f-b7f1-cd4f316fd3da", "value": "duper-fabric-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bdd54a-83cd-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784505407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505407, "uuid": "1844649d-880f-4491-af41-792160e0e7f6", "comment": "Malware payload", "value": "ddd47cf8db5a8e32ed4e8a588c126ed3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505407, "uuid": "6b03d04b-1b4b-4f50-9724-36ad1152b97a", "comment": "Malware payload", "value": "0a39e484b65980b577ad59bc3e5a634c900784ea54b8b6e2ff1200e9a5957511", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505407, "uuid": "4b6e9f2c-645f-4f55-b1ad-eed27f86b0f4", "comment": "Malware payload", "value": "b007edeb98be39a9f83a6f5ae3662cdb9adf2f45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505407, "uuid": "d9a426ae-4179-4fd4-9690-989f83ac1df4", "comment": "Malware payload", "value": "4f6bf9b4831ca88a3095bd4579c85421b8dbbf0198ec3b2c26b4c0bfdfb48d88a92882ce1b12e7bc8be7822b181e6c90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505407, "uuid": "203d399e-68bd-4428-b5eb-233d30aa26c5", "value": "T1F933F16BAE89EB81CB585C36E67B5FC22B0A0DB5C2717463F504904C11AB66017FEB87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505407, "uuid": "42351804-bef0-4089-bcc4-fb4d79ba35d9", "value": "1536:4hOsRdBzty9xZLEnIdGmjySEDEKJqhzusLdfiE:4hJRddkvZYn0GmjmQKgtugr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505407, "uuid": "69912ada-2e60-44f5-9678-71b71355deca", "value": 54436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505407, "uuid": "b797582a-8cc6-47c4-b50d-53c232ee4ecb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505407, "uuid": "349b8fc8-838d-4e99-9866-d1b390b7219b", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1717d4d4-8359-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784455408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455408, "uuid": "56f6b207-4228-433e-ab77-e7cad177bee5", "comment": "Malware payload", "value": "0b78238a4cf4f6c16fb71b99b32904e9", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455408, "uuid": "c8145232-4db4-4a15-90b9-0d158d2788c0", "comment": "Malware payload", "value": "0a948edaca936444e970cba95ac5f65e63283506c38dd718e217354366482e9f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455408, "uuid": "364e7444-7e00-4f07-80c8-7a8a38869613", "comment": "Malware payload", "value": "8558469eefdb920d8bb8723750354a9b10e684e6", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455408, "uuid": "1a679038-2cb7-4e88-9a3a-3db1033f3df2", "comment": "Malware payload", "value": "46c1a8932f6dd7421ba09ab3fa580139a667f8533f8176c1d8f0d71fd24b6746c698f1a93e4ff69f18e1e2e5812eeb8d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455408, "uuid": "97dd4bbc-334c-4d1d-9347-f6c784f53ade", "value": "T1F075B01AA3A401FCD077C2B4CE57960BEBB2B44A1334A6DF57D09D962F23A715A3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455408, "uuid": "430d0f93-32de-495a-bbfd-201b71ecdfff", "value": "94e1c85e15805e1e413bdf491fdaa09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455408, "uuid": "9d5cd5fe-8912-41f6-9a58-4026af69d52d", "value": "49152:1oyWFJs0UztTKmUDr9J0bxIjDrMdnAbF7J:eFy0U8YxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784455408, "uuid": "1f946d74-104d-4d9c-a612-22662a94d555", "value": 1682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784455408, "uuid": "7af9a5c6-c946-468b-8ca5-e7465aa02e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455408, "uuid": "a3cf39b7-44cd-4fa7-8ea3-e7b20c1069dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca827ed7-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484915, "uuid": "bc924a70-8d65-4f23-bead-3156a7c1e302", "comment": "Malware payload (Mirai)", "value": "a369363908e979b5e4abfca40a4eac4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484915, "uuid": "073f1b85-2588-40e1-a772-1b742dfa1f38", "comment": "Malware payload (Mirai)", "value": "0aa485506ebf9f1fb8c3931f0834875f1284776e86ef6d7d34e381df68f1d9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484915, "uuid": "5b1533a6-17af-4d82-a30e-a650c9a01d6f", "comment": "Malware payload (Mirai)", "value": "e50f54c2861001764d73a8c7c24f69c96343d0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484915, "uuid": "20cb5206-14dc-485b-9575-9f6ea19ff1ac", "comment": "Malware payload (Mirai)", "value": "ec040006224e74582256ff7f60924bf15140958d6d745a41f247483f18244b0a0db8b1dccc8b02b02cc1330639dc5200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484915, "uuid": "524927eb-0954-4b24-954e-6e1e5dec1967", "value": "T1F0B36B21B9B91A2BCAE4657611F36736F1F6438B20A88B1F7D720D4DBF246D022177B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484915, "uuid": "23eca5bb-aef4-4446-b3b6-80e8ce288fe5", "value": "1536:UYOLh+CBUkrYS4IghrRfgXE7tCKf7qUwwRRMXotKro95vyJtUea7tHJEDrHy3c:N0kFgX6LXROYgroPcUeDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484915, "uuid": "13b58bcd-881f-46a8-bae4-742397d140c8", "value": 109044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484915, "uuid": "ecb043f4-3f1e-45ba-a7d7-6d523690a602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484915, "uuid": "ea06eedb-05e9-4520-bf9e-778110b62f4b", "value": "ohshit.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9955a978-8360-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784458633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458633, "uuid": "37930ba2-ba8f-40d3-a762-aa72c4a54e93", "comment": "Malware payload (Vidar)", "value": "ad4920c9cf849560fbca81cd4d7fda02", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458633, "uuid": "1887dce6-6aa3-41bd-aaf3-6e14ccdb1279", "comment": "Malware payload (Vidar)", "value": "0b146d1a160eabdb33bda538ca39ef33d42c047d85237150b905595f8ea4ac07", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458633, "uuid": "61c65be0-aa26-4713-a8ec-2789e22bccde", "comment": "Malware payload (Vidar)", "value": "54d051130f657274370171826963b104f5d7e7c0", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458633, "uuid": "9a9db8cf-d538-4ad0-be8c-9b6cb691695b", "comment": "Malware payload (Vidar)", "value": "f833061bae67181549320a8b828456c97e92bcadd70b021d78d2c78045a7ff27c61af5d1b9eb7e69264d72eb4b2f4ae5", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458633, "uuid": "f4768cf8-191f-4849-9f6a-4b3481a64f96", "value": "T1C4F7338087984715C1CB5FFD617B1AF3AD371CA0A329B06F46928432F5A986BDADC14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458633, "uuid": "29d4b8da-b223-4be7-8858-bcb6991d0161", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458633, "uuid": "fad63aea-e94d-4b1a-815b-4973488ea78f", "value": "1572864:9Ldk2reUcuGFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7i7:9226VaABZVPArg/bXeB7i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784458633, "uuid": "70c53c30-b19c-44fe-aa60-f199007ec324", "value": 74669850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784458633, "uuid": "5e8a6b26-05dc-4f99-89b4-e61c1990b9ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458633, "uuid": "e4809dac-5124-4357-aab7-f903d717577e", "value": "Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8236a810-8357-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784454729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454729, "uuid": "ec539ea9-27f1-4282-a8c9-630f093cd68c", "comment": "Malware payload (Efimer)", "value": "e6125aef803cce8d2f8736dd06f149e8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454729, "uuid": "1a85d376-b5fd-49c6-a7b6-5ae3fd041bcc", "comment": "Malware payload (Efimer)", "value": "0b3909c751791bffcc94a63dca896b368a54006dd5a38dcb379ee5b2ef5943aa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454729, "uuid": "4f51d018-df01-433a-96d3-20236596dd4e", "comment": "Malware payload (Efimer)", "value": "df11fb1b236e01ce03989bb06e6a249f8a1493d2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454729, "uuid": "fec6274b-1bcd-4629-b4de-400b21a6ff65", "comment": "Malware payload (Efimer)", "value": "cb5a0fd5d391b12c30c601623918f3b2ca8521d8e4b86e28703bd96aabe6acb2e2d4abb4952a5fd9d61b1f9efac60f8e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454729, "uuid": "25962c86-8ee3-4e8b-ac7b-13f2103a040d", "value": "T182E63319B6E011ADF9B39039BDF24184E5B538B547B1C6EB6BA8C3947E231E08C3D617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454729, "uuid": "2838fb16-c1e8-4926-b8f1-1132bc5fb0e8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454729, "uuid": "5c542959-84a0-4a48-82a8-37a41bfb8151", "value": "393216:wjw2pq3Xpq5ltsZ0/j3XxA/tlhXMCHWUjXKcuI3/PGTAI:sXeq/G2/j3BA/tlhXMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784454729, "uuid": "f5faae3e-08a7-4789-961d-d916199e4462", "value": 14323987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784454729, "uuid": "892a3df2-a977-484a-b3bf-8cfac648cf83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454729, "uuid": "10217ea8-0d55-4a6d-ab78-612f08ee6ca4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e412a02c-835f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784458329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458329, "uuid": "6764a2b2-e4c4-4b87-8202-ffa80a3c6175", "comment": "Malware payload (Efimer)", "value": "62bdd39a6657fe8469cdd660774b9d76", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458329, "uuid": "8a919738-8097-4885-86f0-b93bf0ab096d", "comment": "Malware payload (Efimer)", "value": "0b83f1a79157083ef09c9d1e34ae6e15bf8602aa19b41b560c62d2f4435a729b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458329, "uuid": "5db69cbb-d84b-4b14-9d77-fcf19a3ed9a8", "comment": "Malware payload (Efimer)", "value": "48c6f38dd03c82025ad314eeabf5d53b4968e1fc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458329, "uuid": "a3619703-cad2-46dd-a694-181e9a1130ff", "comment": "Malware payload (Efimer)", "value": "4a67bcc53370871a0bb83d716b7d32b827f0d05ccf4a2e908153cf215394f9eab8ac95002289b8c14bd2cc388281f774", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458329, "uuid": "a8d611ac-c3c4-410d-a9f7-5d4ef4993496", "value": "T152E63348B5E012EEE9E7837CF9D106A4E178B0720B75CACB57648BB16F570E0893C667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458329, "uuid": "1e64c2a9-3058-4c20-a8e7-47dcd1e33c80", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458329, "uuid": "ed346d6c-ab64-4f2b-8b93-04a1104f4ffb", "value": "393216:EkSHjeTWJlQHYbAV5nzRgTXMCHWUjXxcuI3/PGTAI:E7j9JcY0V5lgTXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784458329, "uuid": "bd9a4157-edff-472a-ab69-f79317f6f2aa", "value": 14306745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784458329, "uuid": "c7ba025d-ffcf-4765-a5c8-cd09f82de1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458329, "uuid": "c0aa3fbe-0af4-426d-aa9b-8434a6ed57df", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cbec49-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494376, "uuid": "bb40ada5-535b-4fd6-bc9d-a4df5ba822f1", "comment": "Malware payload", "value": "06f6739f59c6e710dc4c672e84b21f24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494376, "uuid": "53895a31-9940-43c9-a536-b037e17fa0ed", "comment": "Malware payload", "value": "0bdcc47c28ade98fc7debd9edc1ed3234d7713a2c1ecf302ee25bba3a68d1ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494376, "uuid": "3634ed87-29b9-4531-bd5d-c168c431395f", "comment": "Malware payload", "value": "22d128dbd3a168f7cd9a0c5f82a779c069acd5bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494376, "uuid": "4eb938d7-5917-434b-bb7f-1352f30f20f8", "comment": "Malware payload", "value": "b1bdf254af9fe4e72fc855cd5bd5283458faa91fc928e00340d7cf30c8a0360d86ecf3334f262f5ae45c935a92adf458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494376, "uuid": "fbf8c664-82db-450a-b7d8-96f0c5f1cd8c", "value": "T19DA3A64E2F219F6CF3A9823487B78F34A69D23D123D1C684D2ACD5052E7434E591F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494376, "uuid": "acbbc77a-bc6a-4df1-9f2a-86bb936190ea", "value": "1536:+3yhBc/d1UA/yHND2pPnusNFdOcM5LoZdZwEXmP6M4ruXH+QODo01jOanwtf8J:J2UA/yHND2p2pcTZdZiyMDepoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494376, "uuid": "64f8caeb-c70a-4677-851d-445d060c7bd9", "value": 101492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494376, "uuid": "0b6f8dbb-ff21-4f16-aadb-e124a9281fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494376, "uuid": "90f81fca-0460-4921-8409-6f319ef174ba", "value": "HR2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10c407a-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494375, "uuid": "4de1f1e3-4b8c-45d2-a1fd-b634fbdf57a9", "comment": "Malware payload (Mirai)", "value": "3b4f795027c5a2fd74039e34db014b7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494375, "uuid": "e34ddfc5-40c3-4b53-a04f-d25d8d72ea17", "comment": "Malware payload (Mirai)", "value": "0c492e770bb053f9fb9f83e0a71f6ba096368dfe94adefab2fecee5dd3c9cf1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494375, "uuid": "353d28fd-4b99-410b-9cbb-00df5cce5da2", "comment": "Malware payload (Mirai)", "value": "09ebdce28e7b402fac68236cc055446907ed04fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494375, "uuid": "ffbd60e9-fe25-4d64-b462-ccc3457d02c1", "comment": "Malware payload (Mirai)", "value": "fdbe4aab7d632f9638cd0bf0462ed2546ad5cde8c3166ca30faf01d413a166497bd8d4e3ba5777c26a1c8222ae053ac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494375, "uuid": "2f77e7fe-2b1f-482d-aa94-6a130610fbe6", "value": "T1BD63F82BB9418F1AD5C1127AFF1E534D331327B8E3DEB213EE142B65278B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494375, "uuid": "262b3314-29db-45d1-8d25-00e0436bc094", "value": "1536:Onn+O+kY+v6WKArOj80gnIZleizDq3VqHbBZASIiI9XyrYDYrOa2F:tO+kBiyr88c9/QqHbDq9XyrY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494375, "uuid": "de44b8ea-968b-4de3-b582-88980905c263", "value": 71540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494375, "uuid": "2a53f4dc-ba92-45e3-a1ab-3e692805da2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494375, "uuid": "3d449320-a2c9-4b4c-8b0c-d22cbc2b67a6", "value": "DS2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19eac229-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784479035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479035, "uuid": "2ec7ed36-0ba9-47e9-b0fa-56afa988aa52", "comment": "Malware payload (Mirai)", "value": "a84453ed09c55dcbfe87a87813678787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479035, "uuid": "301f4771-2a38-4d8a-b437-2577ae61c570", "comment": "Malware payload (Mirai)", "value": "0cc04fbf0c3c6b33914852fba88eee6f375a0230d19ca573447af21702bc01ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479035, "uuid": "81ba2b1e-9b5a-496c-9e96-e705300b850c", "comment": "Malware payload (Mirai)", "value": "c9cf52baed9effeb625454c01d0c4fb25a058eb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479035, "uuid": "1a197a50-27d9-4986-9f1c-aa67228198cf", "comment": "Malware payload (Mirai)", "value": "30aede2a924b4dc5127dcbe93a3e311f3da2516aba5a3994846089af8ddc3f73db5ff3d53f96e109bf5e39d6d6041bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479035, "uuid": "e2c4c6b3-2569-47b3-b55f-28529c327312", "value": "T149A3E786BB83DFB3E94314F112B75B314A32FC3A6C26DA81D3397CA589551D0A61A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479035, "uuid": "45752a7b-f88f-4824-8fb2-70448ff69222", "value": "1536:zHu++H0ttoEZBbZl1nfjv8Us89wqlMJ3/Qasi6mIF:rX9toCBVl1fjZs82H41JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479035, "uuid": "639b0c2c-bf8e-4580-acce-f1ed5afca8c8", "value": 99512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479035, "uuid": "8ceebbe0-cff0-4def-a30a-b3d04b44bf56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479035, "uuid": "0f49bd61-dd79-438a-86ee-7fa7b722cc93", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d553319-83ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784490745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490745, "uuid": "4f7f7897-b831-4dc3-9c25-a504be21adb4", "comment": "Malware payload (Efimer)", "value": "a9f0d6ae7abbc10cef051bb3f7f1ef8c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490745, "uuid": "eed51f0a-3287-4ad5-8eb5-9fa3962003cb", "comment": "Malware payload (Efimer)", "value": "0cdd5a35bbd98308f6e7ca3b152d71726bf2bbee289304151a93eb2f22a2dcb9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490745, "uuid": "9fc823c1-9ec8-4f29-912b-71340142ceb5", "comment": "Malware payload (Efimer)", "value": "03474715ab20a6f866f359105e78b297ba6e81e2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490745, "uuid": "5f29f5e8-e7f2-43ee-a6c9-abbbb22f9b62", "comment": "Malware payload (Efimer)", "value": "d41bc958bd7391ad1d207ced1b5eff3025195e853e7c4a4a5a31f07f097ee0de0486e4b05b7cca791b9107475747f6e4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490745, "uuid": "1f847816-e8ca-49c3-bab0-d27c7669a09b", "value": "T199E63308EEE012EFDB738139BDE111E5E568F0F60B71CA9F83A486966F471D04639A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490745, "uuid": "175b9551-8cfc-4908-bb21-7c85476813d5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490745, "uuid": "4d5041a9-c9f9-4f64-bc5a-ac8b51654fac", "value": "393216:0v2oorA4LY9VOsX6zH81CXMCHWUjXwcuI3/PGTAI:0+U4U9VOsXSHSCXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490745, "uuid": "1d82f434-1abc-44a7-91c3-a8df27ec4fc2", "value": 14290472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490745, "uuid": "65a8bae4-e67a-41c3-a47f-9d0ef3f0bca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490745, "uuid": "4b7928f8-7e1c-46ac-a39c-77c179b0caf7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa58296b-83a4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488002, "uuid": "262236b0-c27b-42a8-a154-5a892ce02414", "comment": "Malware payload (Mirai)", "value": "6e73908b6ae8c0a5677e50303bd64826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488002, "uuid": "38e2abab-c751-4244-a5e7-d36442100400", "comment": "Malware payload (Mirai)", "value": "0d0596860b38ea73e4edd6f9f3139f266f66e8738368991764357f00bafb6631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488002, "uuid": "3aba7a08-8594-4107-a649-f804df94edb0", "comment": "Malware payload (Mirai)", "value": "48913dfe4ed8a8ed46c64d6fd9fd15a017b1a7f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488002, "uuid": "83f91d51-6500-4991-8786-fcb7b407a617", "comment": "Malware payload (Mirai)", "value": "5b1e3646e135afef3f0330ecb788684978734e6ec80dbbb87a0bea341a0cc0fec934d52ed104cc123ab4be0e672774bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488002, "uuid": "9df4ee77-c03f-40d8-8751-fde1f6f404a9", "value": "T183831226F03B05F8FC7162F84C17875372576B0FA9BA76899184A47E0B388D48E5E329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488002, "uuid": "c30679f6-a9de-46bc-8207-9bd39e7f6999", "value": "1536:YSyjVRBxTsMqNpZnRM3yuu7Rh3YQFSr70jq/3E9Ta3Z0KGjbQaeQe:Y5/BxTsMApNf/3rSfmR03SKwbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488002, "uuid": "aa9ae9fa-e34a-4b51-9b9e-db2320dc377d", "value": 83156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488002, "uuid": "43a22470-519e-48bf-81dd-e63da036c958", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488002, "uuid": "ced9a084-2c7c-43b0-a2e5-41755dd9605d", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6922230e-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784486040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486040, "uuid": "d2bb88d0-a167-4452-a7ad-fc550d14964f", "comment": "Malware payload", "value": "173d3556eca858f817a136216154a66e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486040, "uuid": "eaf0b79c-c2f0-4e45-ac5b-f3efd48e976f", "comment": "Malware payload", "value": "0d059ffb15664c6b5411ec5c646cff16b27c92a8582bee8eb551311d75077a4e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486040, "uuid": "3d22cc63-66c1-4add-bef2-493d40ad5f5a", "comment": "Malware payload", "value": "389f8499214d655cadfdc387841ed485a0f7c890", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486040, "uuid": "fe7cc265-22c7-4f66-a410-ffcebdb0f6b2", "comment": "Malware payload", "value": "309ae1b750a40fdcecaf635663a7b51d46408c5a9fbc27452b69ce58bc9cc64a323b20a62f4503db8b4e846d736634ad", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486040, "uuid": "09b5d95e-e315-4fff-8479-9d3af346b6c9", "value": "T107235C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486040, "uuid": "2d20c984-9c11-4ce3-966a-fd545f812732", "value": "768:z+Y9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:z+Fcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486040, "uuid": "40e6a620-097a-4344-a01d-e32a195f76e5", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486040, "uuid": "6233c65a-8288-4937-9a22-b177be7da61e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486040, "uuid": "9e0831c2-1b8b-469f-ab13-fbed7c482910", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5483ed18-833f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784444344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444344, "uuid": "851b66b7-657f-47a4-a230-f853ddda703c", "comment": "Malware payload", "value": "2d8cdbb8c96356a88a82083349056c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444344, "uuid": "d7d1d61e-7794-40b5-b2ba-31b83ed811d9", "comment": "Malware payload", "value": "0d216fc2a03e7cb3d4702b3a1a58bf5dddb41bc900410c413cf117904f409036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444344, "uuid": "d69fff09-47be-4cb5-a54b-74f2d1979733", "comment": "Malware payload", "value": "fdc1326294ec77f103aabf471acbdc7894f919ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444344, "uuid": "c7559ca6-060f-47b8-a56d-586043b62a22", "comment": "Malware payload", "value": "4e3e563e54eaff42519efca9e224563ee661900848ff755ec0b3c5ad709766c1a97dda55a66ad73604e6399667ff8ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444344, "uuid": "6b00961b-b866-4833-8a45-f35565306bf3", "value": "T183A3A61A2E619F6CF3A9C23487B78B34A7AC63D123D1C684D1ACD5012E7434E591F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444344, "uuid": "96bf023f-6ceb-4221-8939-3d6db3946078", "value": "1536:bhu7BcNjUlO4/tU3BVPGASNFdOcELoZDZGE5CP9M4rkVPPKOJsh9C6+3:ENlO4/tU3BVxDcNZDZq1ML31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444344, "uuid": "0d1a3ab6-d2e9-4c0f-a8b7-3594c55b907a", "value": 100996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444344, "uuid": "5291010a-040f-4c49-ab10-d0b7073ab000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444344, "uuid": "e89847a1-7090-4349-a933-4decd1734d83", "value": "0GE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765c4aa3-8305-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784419490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419490, "uuid": "700aa795-00d1-4a09-8bb9-e9a9b21d5fca", "comment": "Malware payload", "value": "e22ca5abd32db9b7561ef1b158efbbbd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419490, "uuid": "a06de11e-9753-47fd-9a07-41e84869086f", "comment": "Malware payload", "value": "0df61c7d4a7b90b9e859c8ade8abbdf2bafd395b5d05ad7d8807284ccedb82f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419490, "uuid": "a67efe58-6d06-464b-92c0-600e505b1d55", "comment": "Malware payload", "value": "b9871cc2ba0684e50ef7a3c7ece4875a23804eb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419490, "uuid": "be944744-1b7f-40b0-a69b-2fe7e3838de9", "comment": "Malware payload", "value": "0f344543ecdbf2ea6cc6c7cdf74e797402172cbcb638ba2467c618d3f6a02c327ed14a9baadef9a71efa3db2a9d15104", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419490, "uuid": "4646c9f7-22c6-419e-9492-d76acaf9f434", "value": "T15201CECAE250DA10405EC91D33965594B871C3C7064B0BB87F9C943DAB9CE10F066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419490, "uuid": "d752573b-1b79-4368-9de6-b15549a54726", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka9Cmn1CGBC8hBFCEwXC//ENauD:kXCKysE2hi0ziQvZoha9h9rjFKXm/G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784419490, "uuid": "44e2d5fa-53e0-482a-8e65-7cc1e9d9b2a3", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784419490, "uuid": "a96d7159-d48a-4fc4-84cf-101bdee5e39b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419490, "uuid": "f44d1c71-0017-43b8-b00b-b6d9a4b1c256", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38618011-8339-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784441720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441720, "uuid": "6b702717-e5a3-4930-922c-f792db505c2a", "comment": "Malware payload (Mirai)", "value": "13205d008587b97df6340458dec3e0dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441720, "uuid": "358d740a-95ba-44fc-87c5-8e05bcdcad65", "comment": "Malware payload (Mirai)", "value": "102dee5a7ea1f8a79c74afb8c7914301f8073fd59c8142aa7cbf98490e854ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441720, "uuid": "41572722-21b9-42c5-974c-0229859d3760", "comment": "Malware payload (Mirai)", "value": "334d6999b72bdf5724600aea7a030d31cfbea3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441720, "uuid": "4e05cf9d-1536-4448-a839-2fc72b051ff2", "comment": "Malware payload (Mirai)", "value": "aaf55319a073e2eb0b74777ad523ead555916f6640ca7e3f20badaa2db9052477205b2364a85776fa87113087581043b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441720, "uuid": "95d12a3e-c6b4-48af-82d9-e0f2b91331ea", "value": "T116257D5AF2F374FCC067C030435BDB62A835F46911226E7B25C4DA352D66EA01B2AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441720, "uuid": "3f3e1dd1-2e4e-476c-9f87-77f24945f528", "value": "12288:1tchmVdshYLTTE2ilOpqPHnlJ/qZ2myOZqsO0j5k:1tchmVdscTTE2ilRHlIZXM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784441720, "uuid": "28f56acd-02cb-4563-8baa-377882b0acf4", "value": 1050408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784441720, "uuid": "64205811-ef7a-4fee-b921-5d321cde142d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441720, "uuid": "ca5504cf-8237-45de-b6f5-74fe271974fc", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838ad9ae-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467187, "uuid": "a39605ab-9d9c-4cbd-89ef-2dbbe7f50cf3", "comment": "Malware payload (Mirai)", "value": "164511c326871e64245a8ef99eec45fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467187, "uuid": "add4ca9e-9792-4faa-90be-53ba53ad104a", "comment": "Malware payload (Mirai)", "value": "103b71619581d38bf30496c6b7812390cd6639a8ef632f0f2b6072f70439ecf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467187, "uuid": "c16f1e6a-3642-420e-a0e2-c40fff836761", "comment": "Malware payload (Mirai)", "value": "77ee6191cca09b4e8b2040efee2c9a12b54b2c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467187, "uuid": "834479e8-d0de-461a-838d-b5a145f15bd9", "comment": "Malware payload (Mirai)", "value": "14e9ff308108d0371bea3388497c1e74a73aa60e9a588fe6a3454990d37be3c02da57cc0cc36f390df36cf77f8b96036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467187, "uuid": "a80683b7-a639-4622-a532-c06d0c4500fe", "value": "T17A732991BD815713C6D112BBFB5E028E372663A8D2EF72039D226F21378785B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467187, "uuid": "33282f65-17f3-40af-a438-23381ea264ea", "value": "1536:HKBJMji8058nDeFV/lr60Y7W10sxBdvws/AH:HKBq2V/lBqWLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467187, "uuid": "e634403a-b607-490c-96ed-39dae252bafa", "value": 75488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467187, "uuid": "ee2dba8f-67e9-4ce5-92b1-1c98f9f2b523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467187, "uuid": "df954ec8-31b4-427c-a9f8-ec2f877968cd", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028fa19c-83ae-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784491881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491881, "uuid": "bf36df4c-4ead-47e8-a25f-aa28f9b2c47b", "comment": "Malware payload", "value": "dac5b6a05b800fcb96b8db5ebc054a10", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491881, "uuid": "5916f5fd-07ed-47cd-bd97-5d6c0f8c6486", "comment": "Malware payload", "value": "112b937fa19a366ea8c7a404d6ed21a3814410fb210358c907e1fd580616cd76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491881, "uuid": "e13efa27-4069-4e64-902f-61e0770dccb4", "comment": "Malware payload", "value": "1d9294920d25708a22bddd7c377b9192a3a4a170", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491881, "uuid": "8bb6bd94-759c-4202-b971-4558f6d9db84", "comment": "Malware payload", "value": "95a8549a2aef9038a8669d17738d7b34b821484e485e36ec65ca708e43d5aae0607a2f29ad299ae638a0f1c6db12411f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491881, "uuid": "a0dbc72b-3b31-43db-b0ba-d8e7f80520bc", "value": "T1F2C27D956A867C44BEC94A3E4CBD2B0D6DF5C3D1224942AC3D8A3C71DC16FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491881, "uuid": "4f79e6b7-d821-4811-8539-08c181abe6c5", "value": "768:d8vCB+25j6es8RB9FYpMSUpi+20qUpi+20YQX:d8l25J3d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491881, "uuid": "0137b91f-0fed-4dc6-9755-f8d9172f7f0f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491881, "uuid": "c54188fa-328b-4e2c-9032-765b37241442", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491881, "uuid": "95d7e10f-42fb-41ad-8acc-16af6c03b40f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df85857-83b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784493216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493216, "uuid": "53b988f3-e8af-4890-900d-b619d7133601", "comment": "Malware payload (Mirai)", "value": "b9408e1d570914cbad6db377f5c77619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493216, "uuid": "d9c18d13-c6bd-42eb-8b63-ab818e7625ce", "comment": "Malware payload (Mirai)", "value": "11ce110d1a9b0b3aeb13e1827fb66fce905504a8ec4239c32dfabd66cf34bdb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493216, "uuid": "484d3cb1-db96-4aec-96e2-2781ccb4ebc5", "comment": "Malware payload (Mirai)", "value": "c46d95aa7b947c7bb8bef37783f0cf10b8d40986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493216, "uuid": "e82faba4-3b93-44ed-a99d-096eef2a3396", "comment": "Malware payload (Mirai)", "value": "182a577bb300c3697fa5a91f8a36ce25e73c6cf00e45f2e9b551fe5dd7cb35faee746220ababd8729138e8c80080008e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493216, "uuid": "ee4321a2-d5d2-415b-a6ca-3b24a481698e", "value": "T15C043A49AE742BFBC06FCE30052E930725DD944FA2F6B779A278CD4C399A24859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493216, "uuid": "67418f4a-bce8-4914-b286-0a9bbc267630", "value": "3072:QqAMFEFVT7fkzX/YF1pSGfkfSz+AIOD15PGwgVR9Du3M1D2BJ:/AiOVT7fkzXAF1pSGfkfSz+AIODuwgVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493216, "uuid": "ef1f05d2-7a9b-4ad7-9188-ea6c8fe6c818", "value": 177952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493216, "uuid": "c6d8a0a2-b868-45e9-a401-fe6e3fe699aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493216, "uuid": "7a610ea5-44f0-4a50-b7cb-268499d536a9", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c298de-839b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784483973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483973, "uuid": "9ae258d7-b9f5-4b05-ad4b-4f64a55c43f8", "comment": "Malware payload (Mirai)", "value": "08be50a31b62e389101a3812f5616f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483973, "uuid": "c346cef9-8ef2-4dd7-afc0-751423c9796e", "comment": "Malware payload (Mirai)", "value": "13ba055c879310fd32984fe90549f1f8897c6bfd1183b07270ad9e8ff323aec2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483973, "uuid": "0785cac4-f166-4502-814f-452762bba514", "comment": "Malware payload (Mirai)", "value": "7102f57c539c23924d10b1964183e22e8386150b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483973, "uuid": "3e5ce12e-3b5a-4693-9c23-61cffc8c4e90", "comment": "Malware payload (Mirai)", "value": "a3cee5b4b7d5c10e00a7c3f67f3ad614cc2f8a047b0184cf31603b05e19cafd9cbdac8ac020211d13ce8bc66fbd31258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483973, "uuid": "7ccd9b2c-daa6-4677-8066-474a51116345", "value": "T18DE3075AF8819F11D4D626BAFA5E528D331327ACE3EE7102DD249F2533CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483973, "uuid": "a047914c-1369-4243-b4c8-4b511024af2c", "value": "3072:ynzA7+e615Qj8Yxoj2OFjCL7vJ7MZvk6r4QvEaBFzzKICLElnhA84KagON5nbS:yzA7+e+Kj8Yui97vJgvklAEaBFzzKICY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483973, "uuid": "e85552d7-770d-4211-8f52-9d20dcc1cee9", "value": 157204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483973, "uuid": "51f55120-efb3-45a3-96f1-aaa37f8f95a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483973, "uuid": "2e3e5343-e7f8-46b4-a6b7-e624fdd59068", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d1c585-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494328, "uuid": "8b0ee59b-5afa-498b-8e6e-7c565c72c588", "comment": "Malware payload", "value": "4274d39ac551568b4a69f3e9fbeb924f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494328, "uuid": "ae18167e-780c-4256-9f85-7d2f8e812813", "comment": "Malware payload", "value": "15338bf6a6532b40fc9a882e20d6a1b9308d16b160166d31c98e0a1b637eecce", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494328, "uuid": "cd8b2dc1-faff-42cc-be26-c4ccdb0911b8", "comment": "Malware payload", "value": "b0491f05aa503c8de1f5b8d74f5a92dbb8ca4149", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494328, "uuid": "31a3689a-1c17-4892-8654-2551f852e92c", "comment": "Malware payload", "value": "fb78d52c8acb0dc8d7a90b2c94dde6bd477de67f95e24238c119b9b4af2d48b7278594b3b8706e34e0fcbec0df7cfbc3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494328, "uuid": "f1e70eb5-5a5e-4f8f-bf3c-49dc01c266d2", "value": "T1F6E6331CAAD422EBE9F34138DD92B583FAB8B4350731CE9F079443B56D5B1A14C3E64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494328, "uuid": "7a54b336-03bd-4d95-aaa6-f57d217758d8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494328, "uuid": "36c2baf9-d0ca-434c-8b32-275439f44486", "value": "393216:Mf440JnLb/kkZRhyjMvqEXMCHWUjXkcuI3/PGTAI:MfMLb/tP3XMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494328, "uuid": "7b8ccf00-666c-4fbe-b7a5-3ab9580a3382", "value": 14300702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494328, "uuid": "e341d4fc-7663-48c3-b785-b005ef13fcfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494328, "uuid": "1e79ee05-4094-4e84-be75-6d075da8e909", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf6f881-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494663, "uuid": "968abec2-efae-4210-b9b9-5e7710df9c27", "comment": "Malware payload (Mirai)", "value": "1a9aeb8c87bc3fbac90aed0137493042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494663, "uuid": "5f6035f8-6b33-4d7c-9d19-299b1a1b622e", "comment": "Malware payload (Mirai)", "value": "15650ae8164edda17f1051f4d5b4d0a5fd394953c469c4189b0cf1d451715b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494663, "uuid": "7658d42a-ec13-454f-9721-37bab0dd2a36", "comment": "Malware payload (Mirai)", "value": "7f1761f639c40103c4b8acd3598f2873da9c35ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494663, "uuid": "a10a69af-0f28-4a34-8b9e-bae137ae62ce", "comment": "Malware payload (Mirai)", "value": "f575db416f3411080b733c41274680427b312527b9bc3d60039241b43b2aaa3bfed8a7fa483212d6fe8ded1f86b650cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494663, "uuid": "f6647372-be8a-442f-af23-17b337e1918b", "value": "T18E147E00FF181953D1931DB45A3F0776E379D88358B8E119190EBB560733EBB9A87B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494663, "uuid": "4981aa8a-ba07-4618-aacc-2af5c17db686", "value": "6144:FtEcw4XK9Y0tdUh+oE/AICicRQdv2497gWZ:88+UzhixjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494663, "uuid": "c8aec779-b239-4f9c-881c-60aacbbb3c9e", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494663, "uuid": "85733c28-6e49-4693-b2a4-cf194e706c1f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494663, "uuid": "4605fbba-b782-46bc-b13e-3f413c818d02", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc527b7-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445271, "uuid": "3a9a78ee-ebb1-42aa-9bcb-c5dd108ea683", "comment": "Malware payload", "value": "653928cdf0512c462723c46b8b0cc69b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445271, "uuid": "8a5c39d8-bda0-4833-af56-b332ee2ec5e8", "comment": "Malware payload", "value": "157dcb521adc7226e4739391a479eca2c921b84d1e368f22a53ba3c36d3c723b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445271, "uuid": "bf8b4c52-12ee-49d8-8306-f54424196b6e", "comment": "Malware payload", "value": "c149cffea5d2adfdcf7511bb6f7ad20fbf9bd83c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445271, "uuid": "e1d6dc5a-6005-48ff-98fa-9bb798483967", "comment": "Malware payload", "value": "deb6584b47230cf9c6b554486328c80f4ed5b04ff88827f805b6b3c9f561782e6ed51a204e5a952f0cc8d5104f3897b4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445271, "uuid": "7710570f-db8f-4585-8aab-04d4761bb201", "value": "T18FB092201461527ECF4FCE1AA2A5D2214C2A3422636582A27AA0861879445A9D217949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445271, "uuid": "0f739b7c-d7d4-4e63-92ac-e12b8ec14bdc", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIF5dIMCHn:s8GFGMFI1R3Ks8zsO0cKREHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445271, "uuid": "0ecef683-eb74-4270-a10c-c9e29ef8cdf5", "value": 117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445271, "uuid": "fa6e4518-5d28-4c06-9936-9da19f5c50ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445271, "uuid": "6c99d7a3-aee3-47ba-8c6a-56ddc8fa85de", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aaf85c-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784485719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485719, "uuid": "e1b4602b-5b62-4e68-a83b-b77ff6b198e0", "comment": "Malware payload", "value": "bb66ca2c11075d26073c2feed048dd9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485719, "uuid": "615cb777-36a5-42e2-b627-912081197606", "comment": "Malware payload", "value": "15d07eeca0b2341c10bb5e467647799628cb275be166a5bbcb6481943afa5184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485719, "uuid": "78ae1fd0-1423-4b76-9d0c-5bd44075ce6d", "comment": "Malware payload", "value": "09a5b3f8a1db1d6352b617b8ef8aa5389b93768a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485719, "uuid": "b39e66eb-1bf6-4053-829c-328d87dc4b2e", "comment": "Malware payload", "value": "58738363dc521cff63476ee6e4b0b1b064ab674391fe1877e40f9b04e1987005d0cf8195d4b105106842ea21b5b9c3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485719, "uuid": "680a260e-61bd-40eb-a71c-e7520d64aeb5", "value": "T1B7356C5AF2F374FCC067C030435BDB62A835F46911226E7B25C4DA352D66EB02B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485719, "uuid": "8235dc68-b5b3-46da-92a5-61e8660f1fa9", "value": "12288:XtBElmbMg4NRYvDSaMeJPx9r1EC37ymykoV3/goKNSJX4cM5k:X3ElOMg4NQSaMeJPzr+WgVg77c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485719, "uuid": "91490e4c-d98b-4ee3-a7c7-51ce9644de6e", "value": 1058760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485719, "uuid": "399ac830-223d-474b-a1c6-8a26c4d820d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485719, "uuid": "25032c50-189e-4ecc-9543-475cddd72bcd", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5755e06f-835f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784458093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458093, "uuid": "6be20ea1-d8ad-4a9b-a56e-ece4594778bc", "comment": "Malware payload", "value": "2a9ab08874efe4ab02102cfd63d2335d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458093, "uuid": "9e14fc1e-e4e1-4cc8-b078-70e8f47a5c99", "comment": "Malware payload", "value": "1701f8b919c0a64295e661f5717cfe6df3c938bb6a8689b8f56c683f84b96532", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458093, "uuid": "cc138d67-7079-45f9-8df3-22ee01643f8a", "comment": "Malware payload", "value": "6f494a1c077efce773f80fd90951cd4b90fe7baa", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458093, "uuid": "97db95a4-2536-4c02-a970-b26fd4bb1a99", "comment": "Malware payload", "value": "cc81e4185f15402a6724688deb7d482ad9844120d266101431c0e900cb2a2f79aae61f7ffc77f7c08f288e94ec9e9af5", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458093, "uuid": "051a3f22-65bc-4121-a317-fe09804c2364", "value": "T11BF7338093558615D1CB6FFC617F0EF3AE275DE0B21AA0AB06938932F59987BC58C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458093, "uuid": "e8be5295-9ce1-44ca-bc49-fcb2f1253f75", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458093, "uuid": "cb8f5210-c8f0-442c-bf08-f9a45368489f", "value": "1572864:5LdkqmBIPXeFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7z7:52qhuaABZVPArg/bXeB7z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784458093, "uuid": "99efa498-654c-4f91-b3f6-6a2fd6fbde16", "value": 73168955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784458093, "uuid": "e87fb8a9-bb59-4bcc-bed9-e9248ecd69a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458093, "uuid": "a5b789ff-6013-41ca-960f-f8bca3466849", "value": "Release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7491d71f-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490354, "uuid": "6261d731-339a-4f7f-8cb9-292a78d849c3", "comment": "Malware payload (Mirai)", "value": "5e00288c01a3a1109cbf19f611e10b9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490354, "uuid": "daa56dab-bab3-4ecf-a8da-76e02d71c72a", "comment": "Malware payload (Mirai)", "value": "18a64f5824961beb0fa8383cf479488895bd3f72cff82e1953eeac5aef0391fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490354, "uuid": "ea055d52-a26f-4909-b6df-c549874f5281", "comment": "Malware payload (Mirai)", "value": "a2fb3b1f916bff84ee0c663a92144f2526af6f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490354, "uuid": "5c3b6258-baa4-4860-a60c-3e4f7ded4eef", "comment": "Malware payload (Mirai)", "value": "b93b2b40217380af811a44fc4eda5a9a921a2e3fa2368f18ce4da846d720873eaede91a8f7916037bb1fbbf2c19256fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490354, "uuid": "a2adcec2-7a59-4289-9d8c-3a1ba3eb4576", "value": "T12E530212E12A2735C1AFA67C0CCF34811AA1C366B6D0B4676B9C4C62A489F34FC8C69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490354, "uuid": "752888dc-a44f-4f10-aa00-b442c1628656", "value": "1536:gqe7LMMRsIOPXnjuNIgD8DbpQMt/nouy8DMP:ILMtIuzgIgYDbp9tvoutDMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490354, "uuid": "1a7ad48b-830b-443a-af10-3759bd0c3a1f", "value": 61068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490354, "uuid": "4299cc7d-62aa-4cd6-b87c-0b457650d379", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490354, "uuid": "4c3c7be4-548f-478c-9a84-92d4286ad052", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082f5873-83b1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784493179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493179, "uuid": "91c25d56-a967-41bf-8e21-7d594eb42959", "comment": "Malware payload (Mirai)", "value": "bb1ea193286506241e83848f1fed6172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493179, "uuid": "c14bc19c-bacf-44e6-946d-d9a36d6da4c7", "comment": "Malware payload (Mirai)", "value": "195fe7c703d6fef572f1a6d7441898488c5483db820a7feb0c2d622d1c4e4b2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493179, "uuid": "543c37bb-508b-4669-bfe3-b83708972cc4", "comment": "Malware payload (Mirai)", "value": "519754338e8a3b835a92a606cabb803a2490ad85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493179, "uuid": "ee38dfb1-4365-47d9-8180-2de8a0e58cb6", "comment": "Malware payload (Mirai)", "value": "7fdd2eba27cb39f48c8f7fd593b60b4076e4d969b907cd88990a27fe987a0bf04fb1d209480be1142a75d7c7d69257d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493179, "uuid": "f694593b-c5e8-4cc8-a2d4-c79cbef92fbd", "value": "T14B8302BECDB16AB8D703847463264CB74A15D10E6B16DB6E06045E913E54CFB13CAB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493179, "uuid": "705e6c95-895d-4304-b619-f15688b13f95", "value": "1536:g05uppGT9EAEZuzPyvavYYOX5iaidf6qJXvnt424Iqv/22UTStnS0wyX6JyKY0/I:mpGJErZuzPyCPOX5iaidf6KPt424XH2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493179, "uuid": "653bae9f-14a7-46c8-a9f0-35d0e820fec2", "value": 82452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493179, "uuid": "afa08f8a-d461-4f12-abaa-23e63d6355bc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493179, "uuid": "641e17b1-c7a7-4e3e-8433-0d9e8a02334c", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3547bb17-8324-11f1-ac3b-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1784432696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784432696, "uuid": "d83e2ddb-7c17-48e3-92e6-adf851fff17f", "comment": "Malware payload (MaskGramStealer)", "value": "5dd58790c78d382d696cdfbca55f832d", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784432696, "uuid": "9081fd2d-9626-4ade-80ad-c043603ee399", "comment": "Malware payload (MaskGramStealer)", "value": "19ee106f5490826e09271022d24b27a0586a48c5c9db4a55a63320bafcbb8342", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784432696, "uuid": "62045d6c-a0e5-4a5b-a181-6e5026c4ee84", "comment": "Malware payload (MaskGramStealer)", "value": "67d86cf4d4c8a064647dc468c18344541affdaea", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784432696, "uuid": "4a567fd0-e40c-4100-8737-370d759d163e", "comment": "Malware payload (MaskGramStealer)", "value": "3dc17b4413a78ee8fc693c9be9fe6f717367fe6c93be9b96fa09bfa73938bfc345ba564f8112a16ebdbc8378499263fa", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784432696, "uuid": "f792a8f7-661e-4507-b32d-e167edcb21f0", "value": "T171144A1BD5D540EDEC19C6388A9AE237A4B3F85A1936B64F6BA0DF111F90B30B719F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784432696, "uuid": "513114c7-9b99-4b9a-b2d9-73663a34177e", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784432696, "uuid": "271619ad-fe80-4fd0-b91b-f4e1644d4530", "value": "3072:sVwyAZJRnwkyq/ekljAOFELjwfC/AJ9LKhM9XAyS6CHDd7tNVkR7ykugct:3y4VKOyLsK/i/9Qjz7tNu8gct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784432696, "uuid": "d8df7209-701f-48c7-8ce1-a3f6d37a7c06", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784432696, "uuid": "cc060daf-1bc4-4b82-b329-22861bb13861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784432696, "uuid": "328ce9b1-7309-44f9-9226-6261d61d1823", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafaf7f4-8383-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784473722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473722, "uuid": "ab47f657-b45e-4217-aacd-0fafcc14dd0c", "comment": "Malware payload (Vidar)", "value": "25d4dc97838941c18f5d3bc3f4333536", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473722, "uuid": "460d677d-536f-4d85-ae2e-3ef9fa103907", "comment": "Malware payload (Vidar)", "value": "1a5f5770795c3a74604d0c801d931c42c2f03b958c457f81cd283322f6009791", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473722, "uuid": "1cca7e81-eb44-4873-873f-686b87525153", "comment": "Malware payload (Vidar)", "value": "d3425f56a413c7f36c3e021a61c017901d25a5b7", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473722, "uuid": "142bd7f2-fa56-40bd-b277-92a7c6d75b19", "comment": "Malware payload (Vidar)", "value": "db5d7cc5deaa051a88a915d23036f418b20b3e408f918460e838734863e573a1edfe7eddc0b47f0d84e194afe06c0a38", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473722, "uuid": "d86d039b-62be-43cc-8c7a-d494fa065be4", "value": "T1E5068D17ECA148E6C099A732C8B7914AB735BC091B3223D73E90BB382E767C15D75B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473722, "uuid": "0ffcb956-4907-470c-a0d2-f71bdc44de1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473722, "uuid": "cda3b1db-f7de-421e-af54-0635b9c72169", "value": "49152:rX9IrUf63unqXbXr7VnM0qbFytItKA6KLCYUjWSN/oDQ8:rEGSWhytwbLCvnSDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784473722, "uuid": "a3f24738-270a-453b-b41f-99ff59b7c90a", "value": 3716952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784473722, "uuid": "cb4b4b01-b655-433e-bb57-9d72325b75e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473722, "uuid": "56292d29-9c24-4f3d-86b3-05650a96bee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51277135-834f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Okiru)", "timestamp": 1784451211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451211, "uuid": "672ca8c1-2283-4caf-99b4-199f49500e84", "comment": "Malware payload (Okiru)", "value": "8a0eec98f86179c20b2da7a19fdad017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451211, "uuid": "08da5475-b86c-4d65-bf84-20020069b3dd", "comment": "Malware payload (Okiru)", "value": "1dc2367d36d0761e95721337b1edc05259b19ff58383f799d6802bf338c1e9ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451211, "uuid": "25477d8b-82e2-4f12-973d-be0779a95f0f", "comment": "Malware payload (Okiru)", "value": "aba433eb95aaac5cb93884ea5404974003b9dbff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451211, "uuid": "95111cbf-0c52-411d-820c-1129d9bb4521", "comment": "Malware payload (Okiru)", "value": "b7ff2e9ba1a2556ff095c903c7474e799b2bf4220ac4b7bea6436a3238b75167843e2dee7cf21669a29cc4a1732efd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451211, "uuid": "abafebcc-32ea-4208-8711-6c793c7c29fd", "value": "T1C5257D5AF2B370FCC167C030435BDB62A835F46511226E7B25C4DA352E66EA01B2AF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451211, "uuid": "20387a3f-05b1-4a57-acbf-9c828aa3c68a", "value": "12288:MvQuC7DolVpYPcvOsXA7iwFg+kZ2BbBmyr2zIvg0S5k:M4uC7DolVgcvOsXA77g1S1El0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784451211, "uuid": "2d206b06-cfe5-47ec-8131-4b257399925e", "value": 1050408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784451211, "uuid": "51689972-1da8-4c35-9e0f-3ba3196fa858", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451211, "uuid": "b3df9e08-89eb-4f5e-a428-c7e2e0d0f86d", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b244a0fc-83b1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784493464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493464, "uuid": "cbc1ad95-5e74-495e-ac8e-311dcb3e545d", "comment": "Malware payload (Mirai)", "value": "f95323e5771710c707f6e3b50245d4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493464, "uuid": "0aa4aee7-e7ce-4dd7-a2cf-48fdbf18c5bc", "comment": "Malware payload (Mirai)", "value": "1e55ecd233043bea9f7b1850cb560acf58d10d0fea04c097b54ef0488aaefe4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493464, "uuid": "27e5f06a-48f7-487d-810b-bf8f7c21fe70", "comment": "Malware payload (Mirai)", "value": "df2a4a5e357a4031940349ad741188b04aeef27e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493464, "uuid": "0ec0b144-779e-4a84-a7c7-64466fb058cc", "comment": "Malware payload (Mirai)", "value": "56594411db0e744c818e7ea5801400134b9046eb08075e7498758ac3d04cde993317d51ebeb848bde80c90168e52ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493464, "uuid": "b993b121-cfe5-4fef-a0b1-3a4d89292298", "value": "T13FD3AEC7B79B14A5C49342F047CB7B9D2D932111CF9BA4E63E1E653B09BE0EB16063A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493464, "uuid": "a16d8392-ae5c-4cae-9c31-dc1217a9cdbc", "value": "3072:1rp1XnZswoqzileXQgt+HanFpEwBMdonvzG8qF4:13nTGleXSMpTvzbqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493464, "uuid": "8d704c55-4d04-4791-8da0-f06eb18e6a89", "value": 140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493464, "uuid": "64c01868-31e3-4ffa-b842-2cb9f7383dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493464, "uuid": "d45c8c84-3df8-4f7c-98fa-c81c6ae2e5a7", "value": "ohshit.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe2067a-834e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784451074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451074, "uuid": "75b50320-31a3-43a7-9db2-4ec8a5be8342", "comment": "Malware payload", "value": "3720d7f15181bfff196de27a81f080d0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451074, "uuid": "e4db6259-b1dd-49f0-8fc4-91e0325f5154", "comment": "Malware payload", "value": "1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451074, "uuid": "0f3740b1-694c-4dca-a6cb-f8d9c016a898", "comment": "Malware payload", "value": "dd402a3ff43f69bddfaaa3bb1fb26cbeb5b0b353", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451074, "uuid": "d77815af-12ce-4ba7-9bf0-6dab176cb1c6", "comment": "Malware payload", "value": "b5c2a3042880dd3f13f03e58bae81bde040cf747347f860d382b5abfdfe93255dc60dcbe594fd4dce20833dfed2cb571", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451074, "uuid": "0d71ba13-3271-4f3e-85dd-ba502dc0d688", "value": "T1BC534F3AD630FC91C75D327086661D9A21A86D56D7B30E64DB093DFE3D32780EF26688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451074, "uuid": "34293c51-393c-4fc9-b6f6-a36f058edc81", "value": "768:8P1hnNGAkeWMDCOGM3jShfS0huDfObgdvXpJtXwGlGbp3Q8W2VWr2hfS0h:2/NGxoDRx3280hubOoXPl8pAb280h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784451074, "uuid": "34b5d2b3-21f7-4bf7-a0ce-2072242426cc", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784451074, "uuid": "7d08594a-1227-4fb9-b39d-ce4acce2b62e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451074, "uuid": "68c463f1-1b1a-48a8-bc82-a08ea1282982", "value": "SecuriteInfo.com.Other.Malware-gen.55432982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb69bf07-8314-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784426049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426049, "uuid": "4409abc9-3dfa-4765-80d2-8516636c91ec", "comment": "Malware payload", "value": "e956959f8969e2cf24aee7da08cc24a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426049, "uuid": "9c405474-12b1-4807-920f-798d474fe97a", "comment": "Malware payload", "value": "205fec0325df0ef40fdccdffd525cd3a27f26c8a37eff09ab4e1341f32963f56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426049, "uuid": "1370e569-b3f6-4f20-9713-155e49beb45a", "comment": "Malware payload", "value": "363cc0344d9bc18cd8d96a120da06ba0505508a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426049, "uuid": "a39e6106-e7dd-48bc-b17b-e886df4c13fc", "comment": "Malware payload", "value": "063ad3e073d3c8609ea15682c8742668423032cc87b9c5c7aa50263bddfd537796467f9b7f1631baeb6bb1476f929d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426049, "uuid": "9f213550-b275-4b34-a333-c5d8486789db", "value": "T1290633C5B718C1D284134DBBC8E4BDFF4A04BBC9943041E96068AF796A3C6296DF8ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426049, "uuid": "70a4590a-4be7-4285-8736-af2abf4b5fd6", "value": "98304:lNmXygLrhylpVSo+QPlSQbCYRylv4GNKI0c7Ooyz:lwpXo+8DbNRyl3KIh/yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784426049, "uuid": "9b74a232-95c5-497f-bd17-ef5503e3f85f", "value": 3903916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784426049, "uuid": "53755c99-d4ee-4998-9e88-c1a2ac9b069e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426049, "uuid": "c1658e4a-593c-4430-abda-56ddf5a70d4f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbfaf4c-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484763, "uuid": "d25da266-55ab-47e4-96cd-87ba993a4599", "comment": "Malware payload (Mirai)", "value": "86798fe6797282e85fee93ceb5c0bc46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484763, "uuid": "1b2d077b-8dc9-4fde-985a-a52a6f253537", "comment": "Malware payload (Mirai)", "value": "22c63729f11246f5e0eccfb6815c58366b7acd1a27173850f4ab09267817e2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484763, "uuid": "7d4ac914-db36-4190-a5d6-1e1b2a9e2707", "comment": "Malware payload (Mirai)", "value": "b07cecdfe30c9ecf2f4894d81b8d784854ba0fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484763, "uuid": "2a325f8f-cff8-4d4b-9692-9a3a69a9bd2b", "comment": "Malware payload (Mirai)", "value": "b25384ce06075b52e50fa11abdacacf4560c9b066c327e86d492861c12044287db1a5bad68ccbebdf3237958391a3460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484763, "uuid": "36e4c980-21b7-45fd-ae14-8c457237c2b6", "value": "T1BFA34B01731C0A53D1671EB02E3F77E693AED9E121E4BB492A0EE64541B2DF3158AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484763, "uuid": "34001bec-bcf5-4b17-a355-71d21dd833e2", "value": "1536:iLnew8uZFQ/634S3Ck8jf1648Hp+H8VlJpCBQXi8AVsl9:unF8uZbo18O8zJb+Va9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484763, "uuid": "5c0b72b3-14d4-4b0d-9a19-9790f6947341", "value": 104064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484763, "uuid": "e2825729-bf5b-45c9-a916-fa0a4b55b2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484763, "uuid": "b049b88a-d873-4c05-8d5f-88f662dd382a", "value": "ohshit.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171ddb81-836a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784462710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462710, "uuid": "34714cc3-92f8-4934-a758-11ca8987da8b", "comment": "Malware payload (Mirai)", "value": "4fe72d337e59b8cb9ccd243c901bdaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462710, "uuid": "1fc8b058-2267-4c52-adeb-5654ed9763ec", "comment": "Malware payload (Mirai)", "value": "23315993c5c7df358f6d9082d74d72774b613310ebafd0272f5efdf04d3ce9a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462710, "uuid": "536a7e7a-a338-4471-9fdd-c3ef3334f767", "comment": "Malware payload (Mirai)", "value": "adbde5d2e8727f2b9d5107a87d9253d7f17ff917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462710, "uuid": "08b5005b-226e-4665-946e-a5bcd5f07325", "comment": "Malware payload (Mirai)", "value": "7bf1831c602188d9b9430320a6fca0741cb42304611cec1b126fb244065f6f696c66b72a1ad13874978d495665b77703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462710, "uuid": "d5f8e02e-9879-4929-bf13-b88906d8d37c", "value": "T101546C11FB080453C6821DF4997B07AAE31F99A15CA9E11C5A1DBF6F1B329B292C73C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462710, "uuid": "079d8f1c-1526-4304-aadc-8b77f237f0ad", "value": "6144:3LYjFf0Q/k4rbc8l5XBuSSSS/sTDRhLlQOsuLJvnrlSiBEMuyXDiHf:3LYjhThl5ck9uopNdDiHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784462710, "uuid": "d303056c-9fad-401a-80c7-1c3e5030e7b3", "value": 290192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784462710, "uuid": "36b065d3-78dd-40f8-875c-04f99f5f9fcc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462710, "uuid": "6bea04a0-2683-42de-a347-1d28af65543e", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1979dc-8343-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445966, "uuid": "7dd05e1e-5701-4753-8a89-ac3c82f97e49", "comment": "Malware payload", "value": "98f7ad3ce4f5eeaf4d34c059e7dbc2a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445966, "uuid": "d39a4aab-223c-4e61-a900-c96eee5b0ae7", "comment": "Malware payload", "value": "233bbf027793e88ee6d548f2b18e5e2e29c9943bee6c50ed6c1160ac9d68c39a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445966, "uuid": "685f8870-294c-4ca3-9ff3-ee40f064e1ab", "comment": "Malware payload", "value": "075fff490f5644913968a57c78328eb0ee72837a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445966, "uuid": "20e314de-631e-4e98-b106-60623f2367f8", "comment": "Malware payload", "value": "b72cee896fd31af756c12e34e0cd4106f4f67e782973ec11b5008757b3b57bb4191b0e82f58fc9de8cbb9a62486f8ae8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445966, "uuid": "1088459c-2df4-48b9-8bae-4222b5297351", "value": "T19DC28D96AA867C44BDC98A3E4CBD2B0D6DF5C3D1324952AC3D4B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445966, "uuid": "4dce739c-1c2b-4c1e-8b7a-32bf796b2e82", "value": "768:Zc8vCB+25j6es8R/9FYpMSUpi+20qUpi+20YQX:W8l25JJd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445966, "uuid": "b957f41a-4ece-4113-b4b3-975c6fa5ae5a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445966, "uuid": "089eb886-de23-4bb6-b333-080813dde186", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445966, "uuid": "5550acb2-3764-41b2-9158-b6767b08a407", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2cc5e7-83b1-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784493565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493565, "uuid": "f573d799-7bc9-43b1-981b-73097695fe10", "comment": "Malware payload", "value": "4cec4fd2e91486102f6c55b68d58ed4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493565, "uuid": "c38466a9-687e-4edb-aaae-69e1a85afa2b", "comment": "Malware payload", "value": "23a3e7fc7099fd75f7bfb7c0ca426278f1d8b26af8e90fd9c861409b99e5b39e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493565, "uuid": "12e966b2-0b48-4395-b199-2bcf513112be", "comment": "Malware payload", "value": "3201bed9e60fe97bd9e491b40a66cbccc776c7af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493565, "uuid": "caadccca-de31-4b63-82db-1d750c24b2b6", "comment": "Malware payload", "value": "43a0deebe54bea675646a481c97af5ba2331b0f1fb153f12bf98b36ad3f140ae26e3443caacd9cb98edee119a3f1c4c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493565, "uuid": "1e5da5a1-b9d3-4c6a-8ac0-e335f049981e", "value": "T11FB32882BB43DFB3E84310F102B75B254B31FC3A8836DA95E3797DB58A461D0A616378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493565, "uuid": "8738df3f-bb43-404b-934b-1ee075150ac5", "value": "1536:MU2kUTYgRE/GcErPWM8pcv6kNrMjXimbREhGWEgziBF5:MU2k1/GTCzpefr/gWwF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493565, "uuid": "6bd3189e-7dcc-42d8-92cd-8b5502b06b0c", "value": 110184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493565, "uuid": "3ce27788-0ca5-43be-9e6e-5203fd652d63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493565, "uuid": "0df82331-1047-4406-bf6f-ad09221f08a4", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90db72c-8394-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784481128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481128, "uuid": "70bab45d-c793-4edb-a0a8-b317cd03ddbf", "comment": "Malware payload", "value": "009019ec8cf65192f600ef546c96b66f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481128, "uuid": "a7c739e3-aa13-4b52-b4ec-2ce3fb573ee2", "comment": "Malware payload", "value": "23dc32bb9108bab987f480651c64830f4fb78235e67821a25db976aa8ab96347", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481128, "uuid": "d5ce8a9f-c0a7-4c56-929b-aff500d3afb0", "comment": "Malware payload", "value": "59c219fa4bc4a1459e213bb4804fd29c886bef48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481128, "uuid": "62aea2ad-d928-47c9-b492-54f44432a8a6", "comment": "Malware payload", "value": "8318f5af25cf03cd24e0d4393a77565f6e2bb58a9782b833e8fcc6614b55734dbfef9220749b36058db4e9f711fd5662", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481128, "uuid": "2af35aee-4c1e-4a11-a8a2-67079a84801d", "value": "T153A733EC7DF6C5F9C58555B88F2BB2C923B77FF400724A1613C4A7C928D2B6860A6253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481128, "uuid": "42ee54bc-6d12-4ccb-9df4-07505848c6d0", "value": "a53d4e853d461b845fa91452869c0ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481128, "uuid": "9e0b33e8-5cfa-4484-b7ae-919ce780eaa8", "value": "786432:FJwKB2jEM3w5ciA60fnO5ER3JugXll/N+ZYfSYFbS3NQ4PWMzFEc8ngSALb:FRKm5Xr0fnjR3Jug1l/N+ZmSeshZERna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784481128, "uuid": "68bdab86-fdb4-4da1-bbee-d41f7497ff95", "value": 46656772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784481128, "uuid": "e4d52375-f6c7-4f8d-bf30-8c34d9ab8e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481128, "uuid": "ebbdc600-0d58-490c-afdc-4ab5bd0370bd", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739c189f-8314-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784425928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425928, "uuid": "974772d5-0e48-4a5a-a053-9cea37477dc7", "comment": "Malware payload (Efimer)", "value": "f5ea5bca915287fad3ee08c00a789b0a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425928, "uuid": "f188fabd-233c-44d7-8fe9-fe6f9c49a423", "comment": "Malware payload (Efimer)", "value": "23e44f9545eccc2fa95f563995118008826e64ead3844a6ecc6b50592a55dd37", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425928, "uuid": "8146fc9c-13de-42cd-ba66-883e3eb7d042", "comment": "Malware payload (Efimer)", "value": "e44b851814bc7466d2b6b450a0d3596baa67e6d1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425928, "uuid": "703aaeec-9025-4096-ab13-8243b760d4f3", "comment": "Malware payload (Efimer)", "value": "d084d7a3f89e38ffc07a4e9e0cbdc9b2f0cbe4f6031cf5c9222dbc18552baaf399fabd399fa32ad94a9c36df24df061f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425928, "uuid": "22932b14-6f0f-4ea0-851a-b68105ca53a2", "value": "T1C5E6338476E111FEE667513CEAE141B5E5A6B8A24733CAC70BB8C362AE433D4483D747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425928, "uuid": "9a51fd5f-2130-467d-9bc1-556d4c72c93f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425928, "uuid": "6e36df3b-ed92-4723-974f-79983ddc9d71", "value": "393216:LZmChaz1kjPcBbJp+It4lrXMCHWUjXXcuI3/PGTAI:LlazDeIt4lrXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784425928, "uuid": "3f7cfa2a-028b-477e-aece-9a145395191d", "value": 14292491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784425928, "uuid": "347844ba-a342-4217-9cc2-4b8f3573bf64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425928, "uuid": "bf496346-ca45-49ae-943f-5141d4652a15", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c4f516-8365-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784460803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460803, "uuid": "67b4ca29-b57f-43cb-9958-eac80700caeb", "comment": "Malware payload (SilentNet)", "value": "08f46128b2040f439055e09a740fd64c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460803, "uuid": "a10fd20d-1e41-4f01-8780-d0d8dd240919", "comment": "Malware payload (SilentNet)", "value": "2410eac69aa7e41fad702ff7fab2d155a1f401775f8f4037b002989e0d08dbdc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460803, "uuid": "e2754e12-b627-42e9-a56f-2bbbfe3c105e", "comment": "Malware payload (SilentNet)", "value": "2b8510a040a35a19b3d4219b1bfe39914db25f19", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460803, "uuid": "4918cadb-76e3-45c8-9aa7-283a027694f1", "comment": "Malware payload (SilentNet)", "value": "813578a4d1958265e08e652a439d419127099390369a77303e4c31b91ecbeccd5acc8f548449c81b4f7c4918e87361e2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460803, "uuid": "62da4f75-9bfd-4ae6-9b53-b5df13c2dc84", "value": "T1C893127A1D03570BCA64D8B13C2DE6DDFA4D171DA30D39977572AB4A1A48D03A10CFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460803, "uuid": "c17667c0-fda6-4d84-95ca-1041306079f3", "value": "1536:ZdclicST7JRD9NhElyrcmXwS0EvaRNfU7f3SUHxo5rpEYpW23ziEZ:ZyJ2f/hE4Q8wlEvaRG7/SOx+rp1EEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784460803, "uuid": "8af6849c-cfbc-41e9-ba25-f8c2860e355e", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784460803, "uuid": "96508992-1490-4c91-98de-9fb0dd4e52db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460803, "uuid": "c38386fe-0599-4899-a9f9-fe413c3712bc", "value": "Third-Person-Nametags-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b689590d-8371-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784465984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465984, "uuid": "dc01f2f2-2b83-49f1-b857-f626fdda1afd", "comment": "Malware payload", "value": "3f23210d02d97c3b6bdfe538d55751e7", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465984, "uuid": "b219a631-42f4-431c-90e1-d12e5931bb62", "comment": "Malware payload", "value": "24e32ef97f026275a324082142b1f7a7ddd0b07c0eaccb6974efcd8b422324c1", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465984, "uuid": "fbb5def9-2434-41ab-bdd2-b3a8b3966017", "comment": "Malware payload", "value": "9a385717ddb6d8eb6df103cd85c6d90afb6cf3d7", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465984, "uuid": "5cbf3a87-84ef-440f-94ea-d8167e641792", "comment": "Malware payload", "value": "887f351ec2306e79faa2e78d30ca20b8427043cf915c34c33149df6911c2293ed4c6529c796447242a60103b41ff35b9", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465984, "uuid": "1e66c7ac-b02c-409d-9f2a-24bace3017c8", "value": "T1A57523217BE00914D4BAB3B0ADE652876671BDA0AF33BACF1111774D5F32492B13A71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465984, "uuid": "008ca431-d7bb-4439-af86-7a5b3215bc0b", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465984, "uuid": "d4545f7c-ebce-4602-8e59-192f4d9005a1", "value": "24576:r4WLym7KZMO33BLn5M4hCx28UOS0rDQJ+pLeTTqFYA0zDPr045Oa5PgFvnUy+ivl:zLyPMO33VhmvUd7gyqFYRDZOaIFUninN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465984, "uuid": "ada7edba-4b3f-4abd-a027-4b5a084bbc50", "value": 1559120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465984, "uuid": "96530159-98b8-4221-8360-de471777e0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465984, "uuid": "44e521a4-ea9c-455d-be02-3a30c167f719", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050220fb-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489308, "uuid": "afc04dd7-cc1f-4ea8-8dfe-432f94b0c587", "comment": "Malware payload (Mirai)", "value": "8d03001f492c2dc0f00c8c83a10e8a7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489308, "uuid": "1ffb2a5a-caeb-42e0-8500-61272cab5911", "comment": "Malware payload (Mirai)", "value": "257b7cc31d4a970651645aa76eb9e881843dad44554678e72bdafd60886fbe63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489308, "uuid": "79fb0fad-7b1c-4407-b8c8-f982ea3ff9c4", "comment": "Malware payload (Mirai)", "value": "dde1f2607967cbb2d247d572430bbfceb6cb4474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489308, "uuid": "2c6afe44-1bf4-41d5-b5cc-dab1af1baabf", "comment": "Malware payload (Mirai)", "value": "cb2509cc85b82913bb8ce77fe97d4697db686caf2cb2a7d75539cde9bfc389ac57bd3989a68c5e4773f48630e3418eed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489308, "uuid": "8723ef11-f8d2-47ac-9854-099413534a23", "value": "T13A8312E76A56C0BDD6C164248C73953BCD5FD71C678C3B1000C49BEAFA9F8E681316AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489308, "uuid": "f643065a-6604-4027-bed2-24d087b906d2", "value": "1536:nX3uVgN3kCIlZFTJs2b51a/3OxKegpEnjDCNRloJWmZsV3P4vPavQ41F0M3X:nuaNdiTJsgagKegcjDiAshP4vivdF0YX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489308, "uuid": "c939a601-8493-47b5-97aa-1f6683892214", "value": 82312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489308, "uuid": "d4aeb57e-aa0f-46ab-a217-e21a997d0103", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489308, "uuid": "a0f4bf54-e699-4762-88f2-6a9561dc00d3", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94e0f4a-839a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784483678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483678, "uuid": "9e739860-2c65-40b4-a8d1-d5c171eb3649", "comment": "Malware payload", "value": "f35e022b7fab4464530191466c3d3652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483678, "uuid": "02ed048f-62da-46f8-a805-3e6104607269", "comment": "Malware payload", "value": "2604c9f9c4a740538b1ec0c58ecaa702a0a65047ccb843f54debbd00170574da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483678, "uuid": "e435189b-d775-4a0e-bd9c-596bd2aeda16", "comment": "Malware payload", "value": "cc5aa8691e4afcd952f9b4198536757b9808068e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483678, "uuid": "6a3fd153-8748-4847-815a-47419fa77c37", "comment": "Malware payload", "value": "c7c3498b2570310a1df48a35fb7c2fa0e412246d7bdc24d69ba645294c99a727e8d2be07fb1f531f1ed067e32cd6c646", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483678, "uuid": "b932dcff-7b29-480f-9fe2-6488d36077d9", "value": "T1FFB30602770D4E03D1133EF03B7B2BE0979FFD5629A4A680742EBEC992719F25145EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483678, "uuid": "dfde9dc9-c342-4605-9821-3e82a4d02977", "value": "1536:Yxi3/PP/xxWCWMg3iapzSt9ljjq6YQvAqNlwS56JdnbnouqPu1u+:Y4//xxHUpOljAsErmp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483678, "uuid": "9942eba8-6957-4cbb-9b34-f910cda6042f", "value": 117384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483678, "uuid": "e67b17c6-59f2-4ca6-8c5c-a19b0d0c42b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483678, "uuid": "c8362cba-79b5-4c88-8e48-184b35d23088", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b464cc-839c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484451, "uuid": "82c2dc11-fa19-40da-b1c7-4989ca2af975", "comment": "Malware payload (Mirai)", "value": "4434a6ea55ee8d8d83e0e016328d3fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484451, "uuid": "fd63c8c4-41cb-49ae-b152-e117746d24e9", "comment": "Malware payload (Mirai)", "value": "26899c5ba1f44e1cc0dcc9d8d0ecf835d63821e8614b6fb1e20bc3984445961e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484451, "uuid": "15ca1227-cda2-47c3-96fd-81cf92897e43", "comment": "Malware payload (Mirai)", "value": "f3b45fca4d7fad2165418cdcc96af2b0ea0719e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484451, "uuid": "f0ab6171-a74a-45ab-a4c2-cb8d0ef56b60", "comment": "Malware payload (Mirai)", "value": "572a5dcb83e63d370a3ce7bffee46f7e809b2ae644080df19c3c2f1b321843bb155213c5753018c5ffb9f29bd3fc929e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484451, "uuid": "01b806a6-76bc-4cd3-83ab-eb12c3613279", "value": "T1BFC37CC2B10D7EEEE4932E3D820617176E1C9A519C83811150B6FA472EB76E32F369C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484451, "uuid": "7890277d-7207-4a4b-a75a-42318b6a83e1", "value": "3072:ujrOHJrfPPnDCXrBoPPAgUaFvEi5duQLLjyocr:arOnPGVoPPVXvEizuQXvcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484451, "uuid": "babad4e9-7402-48da-bef2-99a27ae48d98", "value": 125268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484451, "uuid": "2b459480-54f8-4d79-9a17-c446daffcebc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484451, "uuid": "11e8be6f-27c4-487e-9797-54bb1df391a3", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b321ca-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784479032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479032, "uuid": "84a56108-cfef-4dc4-9a0a-fced531aa6dc", "comment": "Malware payload (Mirai)", "value": "ce24fd88f409c670ec12c372b1318df8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479032, "uuid": "a479f893-38f3-4eda-97ee-aa0818cca4a4", "comment": "Malware payload (Mirai)", "value": "275b9450462c7661b71d61bdf4186f279c932c7651cba7818a04215ee3f0844f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479032, "uuid": "c4e81458-9903-425a-b013-ad1412aff0d5", "comment": "Malware payload (Mirai)", "value": "0b422fade894eb38aaf3608e5beb033968b56116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479032, "uuid": "ab1bd853-f7ef-43f8-b9b3-8e6c1f6cf7b3", "comment": "Malware payload (Mirai)", "value": "661b2cc392e0402b3ae3013a1615d54723f2fe88398be564bcfc261abee8264fc930eb0727acd68fd1343e736dd9e408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479032, "uuid": "cc5d24df-a626-4d50-899e-51d995c42604", "value": "T178D3E5D3FE01DEB7F40BE37648A30815B530BFA60D525A73726338AAD9390D91467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479032, "uuid": "707db018-3e4d-4457-869c-fdda4ce6716a", "value": "3072:aK+Nb/rZG5qIfh7QtC9w5VvjbitLNy7AxyAkSfed:sZG5ThWCqyL0gyAYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479032, "uuid": "705d6a14-a3bc-4a7e-8d9f-bb46f4fb1856", "value": 137400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479032, "uuid": "9f702908-dd8b-4f9d-82a4-757dbbc82f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479032, "uuid": "f83936df-97cd-4e07-a832-d8ed768e5639", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06084961-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485874, "uuid": "34d5a726-b4d3-4dd0-a450-aabbf731478d", "comment": "Malware payload (Mirai)", "value": "be116c9d99bd3299e0615c9be6737910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485874, "uuid": "3739811a-2096-4eb2-90d2-554957739cb4", "comment": "Malware payload (Mirai)", "value": "286fe92a07c436d799a411a447e519ef53b557f5819dabde14bf7774780ea7a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485874, "uuid": "06a63bc9-64ee-4b9a-ae8d-f0a5d2ba129f", "comment": "Malware payload (Mirai)", "value": "07274f1217e583401abbf94efd4e036b81743e87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485874, "uuid": "9534f7fc-2aae-401c-b97d-fb5f6548076f", "comment": "Malware payload (Mirai)", "value": "06380b59fe3f28e412c013910ebd0cf36d79bf5e452c139ce07df97fb997fb200418ff6c5355f0f8b77b7eacaf4de610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485874, "uuid": "a4bd0cd9-031f-4a96-a8a7-475e3af0f032", "value": "T13D937CC1EB43D4F9EC560AB1003BB7178B32D9354539FB8AD7A52D32AD23A009A1B75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485874, "uuid": "b1596401-b212-47cc-a23c-1f567272d527", "value": "1536:Neyej8/CJQG8Xx1Sqz1/nmKJY3YFA1Kd6P/pJKSvvzmrN8:Y8/CxIVnmwY3L1G6J0Ss8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485874, "uuid": "b3064709-bd85-47b2-bfe2-29b22366dc68", "value": 95568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485874, "uuid": "9422d542-5bda-48f2-b029-c9c813b8726b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485874, "uuid": "1298011a-a2a0-4f81-8e12-3574710dba03", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c702586-83be-11f1-be1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1784499011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499011, "uuid": "6f72306f-3795-4a94-b9e2-37f540b6e433", "comment": "Malware payload (Phorpiex)", "value": "b0c4fe17a83df1621ce3db824684bb55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499011, "uuid": "a848fd41-b594-4343-874c-1bcd88ea7a9e", "comment": "Malware payload (Phorpiex)", "value": "2ac492ce3b66a7979ceba5f26c594f0a69698d19b2ffdb56ac8b741dc30f8e5e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499011, "uuid": "1bfee3c8-2303-45df-a31d-af68aa2460fa", "comment": "Malware payload (Phorpiex)", "value": "5a8031f3c9ff3c65ebaa0aa60f9e59feba83c71c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499011, "uuid": "addc14f8-5a6b-4a82-9dcf-74faa8d5b27b", "comment": "Malware payload (Phorpiex)", "value": "34b28d7e671e777654731d2e74f43b9bc010c6379ee677b8fe72a8ef9699cdadcf1ca6461652c27ba998006dfc95397a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499011, "uuid": "b22b41fb-32b5-4683-b5b8-85f4ea07ce25", "value": "T1C1728D07EE959212E3E44CB401719B5F067F587333A6A2DFF373660A6F747504920AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499011, "uuid": "f1f9569a-8f4d-4a76-99d3-a5146b5f4075", "value": "d619fbf0a108fb3ff7113afe795582e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499011, "uuid": "6912bcbc-02fa-434f-bfd3-c7cf29f1f32c", "value": "384:KV88In4z+hDTXJMQWSc7BLs1QuCm6Ee9nlAnXX5GMLWV:I8Tny+hvaQENs1Qum3O7LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784499011, "uuid": "c99ca49e-7ae4-4e51-8bcc-3bf3f7e6b15d", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784499011, "uuid": "c424388c-0c78-4014-b700-a0363d114f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499011, "uuid": "df322020-7efb-4337-8c64-7e8859546676", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9817756-8345-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784447171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447171, "uuid": "05a9ea99-ad49-4d8c-864f-04f326630d9b", "comment": "Malware payload", "value": "e8551386a735cb898fb588928932b847", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447171, "uuid": "542fce45-827b-49e0-832d-f64f23e5bcf2", "comment": "Malware payload", "value": "2c0bd15e92263801edab875cd6cebda8f245d026dd1f56e85c4545fa91245f49", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447171, "uuid": "e5b441ee-ca08-4bfd-bbb9-b0c5eb0156f6", "comment": "Malware payload", "value": "42c2fb2a9b36d9db1cafb2c4d1b0cd6c3a1f6ad9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447171, "uuid": "b59566b7-3ef3-48e2-bd04-d8ec23bf68cb", "comment": "Malware payload", "value": "3f6e81d17400256249bb038cc92ff75d36f2f822f42ec3630f7941445533b2fea3a756b6f3d466fffaa07e0ec1e7d6e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447171, "uuid": "49bb3253-d844-4c3b-82f6-800e3f99e4d7", "value": "T148235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADDA10961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447171, "uuid": "3ae2021b-1311-4cb5-bf0c-15a5ee3a6d6a", "value": "768:rHFWzZx529GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jkz5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784447171, "uuid": "73a66c12-5298-41e3-9844-e856717b80d7", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784447171, "uuid": "26ca8733-fb08-4700-ad6b-a401020a7fe4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447171, "uuid": "abb65a79-30fd-4ac6-85c6-39855a04b562", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c8af9f-83c4-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784501527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784501527, "uuid": "6776685a-795f-4124-a242-84835ea7372a", "comment": "Malware payload (RemusStealer)", "value": "d0b2dbfbc3a1d6474628f5268cf884fc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784501527, "uuid": "6c9805bf-d795-4009-9e5f-fb5e3f42ddd5", "comment": "Malware payload (RemusStealer)", "value": "2c292ea5d66b3aa9b531e60f55d6af341d101961a649614d022111ff743492f3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784501527, "uuid": "b7fc41cd-f19d-495d-859c-7126c78ccb8e", "comment": "Malware payload (RemusStealer)", "value": "0bf07f316fe80ace56c947a2021e56a07dab0d6b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784501527, "uuid": "85955f53-67d0-4a1d-a08e-d3c739a58719", "comment": "Malware payload (RemusStealer)", "value": "ef9ee21db50c02c9779f3039b3c192622c2e053534c16c8fe475e8b51b61fe85e3ade66eedfae1092a573e0af4a73190", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784501527, "uuid": "d1e9122a-e097-4398-890c-b467093cc429", "value": "T1BF75192C27F969A8F1B77F358AF56145DB3BBB72A93BD64E0500820F1532A018D52F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784501527, "uuid": "6309fb71-5847-48cd-8e58-2de8b8d8df4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784501527, "uuid": "a73b18e1-ea26-40d6-b7d9-37eaa5e82640", "value": "24576:z/oH+J7+nEv4+540g7LYWgq2mJShCYu+hn6Ji1kLA7BieniYvmMBjz:DQEv4+O0g7LYW72mUhPu0n6JiyzYuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784501527, "uuid": "d1d922e4-2167-477a-8e18-b5d8a829be6b", "value": 1681920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784501527, "uuid": "5f4b8117-fdd0-42d2-b79f-2207a1e81dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784501527, "uuid": "062c4147-80b1-4711-9e39-bde63a55b442", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244e673f-8305-11f1-ac3b-42010a9c0009", "comment": "Malware payload (BasicRMM)", "timestamp": 1784419353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419353, "uuid": "5d46417d-0851-4930-8631-8c25730cd510", "comment": "Malware payload (BasicRMM)", "value": "c196ea62e13d7ef3cdb233cdb848a61f", "object_relation": "md5", "Tag": [ { "name": "BasicRMM", "colour": "#D88C6A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419353, "uuid": "6a57d61e-7a75-43bc-a817-918b41ec6fe8", "comment": "Malware payload (BasicRMM)", "value": "2c4f1c37a25f687ddeca3bae95ab1449da75c5612ec820977f695bf072909d59", "object_relation": "sha256", "Tag": [ { "name": "BasicRMM", "colour": "#D88C6A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419353, "uuid": "b835b9cb-f080-4ef3-99f6-a7c94b8cf101", "comment": "Malware payload (BasicRMM)", "value": "8db179834ff28f7d3c10c7a7923c6cfa5875d589", "object_relation": "sha1", "Tag": [ { "name": "BasicRMM", "colour": "#D88C6A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419353, "uuid": "a9e4e166-664c-4c51-89a9-83910dbf40f4", "comment": "Malware payload (BasicRMM)", "value": "339c831c5af747dfa755f0fb93c81ab8054218e2c57b1801864f0849a8f91989fe6ce4af2898f486f74eb987567263f9", "object_relation": "sha3-384", "Tag": [ { "name": "BasicRMM", "colour": "#D88C6A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419353, "uuid": "b58dc100-691c-4591-919c-861d61a7e0e5", "value": "T188C67D03E8A145E9C1B9E235C9669263BB717C491B3223D72B60F7342F76BD06EB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419353, "uuid": "ff780a17-eea0-44dd-9f46-2c27ba7e5c72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419353, "uuid": "90e96eae-b14e-4dbe-8a9d-027bfaa9b6e1", "value": "196608:ToJCfNjW5ccrpY+fOk8ZDQNZKqr9yz1zVr:TXfNjkccrpYzk8JQNhw1zVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784419353, "uuid": "9d836df1-22e3-4299-af6b-42c41e20e552", "value": 12261376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784419353, "uuid": "d6b142a7-4fd9-4d32-a280-3e7da43f2ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419353, "uuid": "cc8ff3fb-b17c-452a-868b-ee0cd8d02122", "value": "2c4f1c37a25f687ddeca3bae95ab1449da75c5612ec820977f695bf072909d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec89d2d-83be-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784499042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499042, "uuid": "a96b652b-e64f-44c4-8cd7-646d74d969a2", "comment": "Malware payload", "value": "4c2b6219006241fa746000734eb7b8ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499042, "uuid": "a7edec51-f9d9-447d-b9b0-177a311ca613", "comment": "Malware payload", "value": "2d0ae80f9689433e7b84ee280e11ce5263f918f6f23288c3d9bfe6ea187408b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499042, "uuid": "1672b4f0-bc00-43d2-8fec-9d1051925ee1", "comment": "Malware payload", "value": "809a43c46691ed2703aa48e3f2b2fae736da08f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499042, "uuid": "affa9c23-5b2a-4964-b91e-38249be8d5c4", "comment": "Malware payload", "value": "bfaf13263c401768736045473dcfe666ffabe0548ce05ecd88c2fe58a5edbfe48ddc529918de16a9a608ffb5d3b12ab8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499042, "uuid": "1919d521-13f7-41a3-bb45-d05e49157700", "value": "T1B6C28E966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499042, "uuid": "dff6d55e-4359-4d2b-b47b-9ac3592f2b73", "value": "768:g8vCB+25j6es8Ruzg9FYpMSUpi+20qUpi+20YQX:g8l25JOmd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784499042, "uuid": "f33db57a-bcd2-4238-b123-97db6d3eb7e7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784499042, "uuid": "3d414a53-5057-4e61-b0e0-5f0b2bb06348", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499042, "uuid": "d7f8f62e-47a6-4f35-bf81-6782130e7a98", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a1ac56-834e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784450997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784450997, "uuid": "8c3cde05-7695-4fe4-8e03-dbad22fc7085", "comment": "Malware payload", "value": "b6aa265d7878ffab703ca6fec15ca0f9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784450997, "uuid": "0162e0f0-86b7-4dbd-be0d-76da6ff41571", "comment": "Malware payload", "value": "2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784450997, "uuid": "9c2db5a6-b1a6-4488-999b-09061f336697", "comment": "Malware payload", "value": "788ea9072c5f61c84c879ccb858ba2a8fe507fd4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784450997, "uuid": "30b4440e-23c1-4cf3-b3e3-07fc0c4ff589", "comment": "Malware payload", "value": "f1d5c1b04c62d756cfebb497c447652a07a1f1ee62bba6e1d1cfe4e5ad4aad5aa0ac5e745328b6f33119ff37aebd50dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784450997, "uuid": "d32b2e0c-7fc3-43f0-b363-7b47dd81ea86", "value": "T1DA01ABCA92709900006D885D72B6D6B0B431C3C6154A4FB8BFDCE63DEF89E24B076F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784450997, "uuid": "37c934b6-883e-41a1-a991-ebab8ca8e372", "value": "24:kXCKysE2hi0ziQvZoha+xA6jIcFFq13A7:e9Qp+Ms+W6jIcFFW3A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784450997, "uuid": "a3c7c4f3-f4d8-4954-b2c0-30486d8763ba", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784450997, "uuid": "e5686fee-3e46-467f-8bc0-c2173b7513ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784450997, "uuid": "1eddf9e6-f1f5-4e42-a0d9-d7db4cb51f39", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3754401-8329-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1784435108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435108, "uuid": "a5d80cec-a63a-4012-a21e-95dfee2725ed", "comment": "Malware payload (DCRat)", "value": "9fe596f4a179c407569978a18985a0c1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435108, "uuid": "3233b69d-f292-42e3-a92a-ab482638d7c9", "comment": "Malware payload (DCRat)", "value": "2e8b7a738ae3982c77f5751b4be096be2841167625190c245b7fb1858cd4ccd5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435108, "uuid": "3e8f9109-0f0e-4232-a42c-81cb50f68c49", "comment": "Malware payload (DCRat)", "value": "ca42f33c912302e49fa3542f7978962f947419f3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435108, "uuid": "11a96fef-a0d4-47b4-8e41-504775542e9f", "comment": "Malware payload (DCRat)", "value": "5f0a6046c5eb7a106b86062feed93bd83fdd0ab149677ff12fbfbeca696438f5d566c5a4a345dba68d1d880b62e6d522", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435108, "uuid": "502f24db-a023-4c8c-97e5-a07cac30ffdd", "value": "T1D8E5A12439EE102DF1B3BFB59BD47596DA6EBE73370B544E1090238A4633A41DED123A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435108, "uuid": "491c7f5d-d644-4892-9798-f3ebd6040b66", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435108, "uuid": "cd3b8c55-e3f5-40a8-a031-d7fb44b6e083", "value": "24576:zTbBv5rUfzpCTn72tmNlgEJMA+uCw7sULqP3NJV08P5Np6JZlP6+cO7TT63:tBA8Tn72tm3mA+IUP0lL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784435108, "uuid": "d3bf215f-a24b-49b4-aeeb-bf96a8c00810", "value": 3065170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784435108, "uuid": "87ee54c2-cc46-445f-a6d0-b7ad89e35aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435108, "uuid": "7ac6ee4c-81b7-4631-9a27-06001df46160", "value": "9FE596F4A179C407569978A18985A0C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142f772b-8389-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784476019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476019, "uuid": "f81eab6b-acc5-4c12-840c-28df9525a3d6", "comment": "Malware payload (Mirai)", "value": "d48da23412b3011fd41ba2c23ac47a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476019, "uuid": "9bc830b3-b1bf-4842-bbae-417cb84ed83e", "comment": "Malware payload (Mirai)", "value": "2f3ab16a9d3f39f63ecf9ec211a51ac3c06c949f925386bbbef039b9008403fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476019, "uuid": "24244868-1a0c-417d-82dc-5fa10e46594b", "comment": "Malware payload (Mirai)", "value": "eff016037dcb14f8b0da55dff18a633a4cddd93a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476019, "uuid": "0258df2c-02c4-4db7-929f-83f5822bd91f", "comment": "Malware payload (Mirai)", "value": "1f35e2f69ac8c053dfdcd871d61a519bea72e16776ebcaf0fbb24d0bd80d38e7949d918d6e700888d60d9df7f8dfbb3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476019, "uuid": "8f69e6a7-94d8-46db-9af1-7635a88ea37e", "value": "T18C430192869BC448F59A52374CEFFF80A478A2417F39C28377046063A59036D7BDE43E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476019, "uuid": "c1d3b6d1-e98f-4103-bf4f-1df20e9821cd", "value": "1536:t9wBLPgoiCPWOiCk8zdIIXKY5MXMlOJ4mInouy8DMB:nwBTMWWOg46IXHK8vmgoutDMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784476019, "uuid": "acdedf78-9e37-44b9-bc62-40922427e589", "value": 58644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784476019, "uuid": "9219284d-a86c-4f07-b885-b0055f958bfb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476019, "uuid": "61f95823-8576-4236-8fbb-e1462eede7d3", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e636bad-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470480, "uuid": "62b026d7-6c89-4dc6-bcc8-3d57dfc501bd", "comment": "Malware payload (Mirai)", "value": "958a84775534d0e734ad5e16579fc88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470480, "uuid": "1690778f-cce9-48a5-a673-e9bad35485ec", "comment": "Malware payload (Mirai)", "value": "2febed09e8a004ac1c470238e0695eb54766f1ca1fbf6ac1ea4c66df6a3d01eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470480, "uuid": "c4f42674-f765-4567-8453-62fc0861a585", "comment": "Malware payload (Mirai)", "value": "40fb18800e363f1f47a0c5ef2752ec4756163713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470480, "uuid": "58322a11-27bc-4eb1-bc87-ebebc99b38f4", "comment": "Malware payload (Mirai)", "value": "9710769285a03b5c8e6ba412e2958f709e122fe46d6070a27bb89be16e767fdcef92da2374f2ce9db3213fbcba0d2c6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470480, "uuid": "c72b01e0-16b0-4259-9de8-2c79d8334a9b", "value": "T13C147D00FB181953D1522DB45B3F0776E779D88318B8E009190EBB561737EBB9AC7B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470480, "uuid": "91c03a4d-4423-4243-aab7-236418b34cab", "value": "3072:LvVfhsZYtmY0YdcYHgy3ySGwIAkYOpMGo4mj9Nn1D+o/:LvVfqZ1Y0Ydc8ggl6AkYOpMGo4mjb1j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470480, "uuid": "b26a02f3-329f-4018-b6c2-802ec145cd48", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470480, "uuid": "d6408628-e68b-4d8c-9f45-7a8dde5d3eab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470480, "uuid": "21f84b1f-e347-44d9-8727-2e089c84d269", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18b28e0-83b1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784493463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493463, "uuid": "0a145cfd-e491-4fdd-a289-b5fa6bdd563b", "comment": "Malware payload (Mirai)", "value": "2ace5d96c447dac1b7b3437712ca5979", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493463, "uuid": "26d96651-7a18-4b68-979b-10c5a2724495", "comment": "Malware payload (Mirai)", "value": "30b37af8712dec58014f16686fd105d736883646d1ecaa55f256698230712502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493463, "uuid": "c8a59303-cd90-442e-bfb0-76a95b398152", "comment": "Malware payload (Mirai)", "value": "828768c96b950f47164faa197e6b226cdcc30987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493463, "uuid": "1381a8c1-260d-4be2-9fae-1f132b1bcf2b", "comment": "Malware payload (Mirai)", "value": "010126346a1da32cd5f0a779f44829b2ddae36d49c5c2b19a3301f58593f79310da21fe20dce9d1d500bf97972294ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493463, "uuid": "f4c5f3d7-1353-4921-bf0d-ec4de80b56da", "value": "T134C3F749E9429F01E4C735FAFB9F425433536BA8E3F97101DA206F6123CAA9B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493463, "uuid": "1db6a417-4fca-4127-bc85-0f433ac321b8", "value": "3072:ecyFIBrV4+OizszZauzK7376aDN/0N5yNoBtCv:ecy+zDOgszZauzKz762/O5yNoBtCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493463, "uuid": "2bae9467-c781-4e65-80e9-71d3960ecd2a", "value": 120912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493463, "uuid": "20272931-9089-4c0c-817d-a9ac5b5f67f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493463, "uuid": "0f27eaed-4abd-4802-9a0c-47c3038559ac", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65ff6f9-8391-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784479835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479835, "uuid": "d4cb6bf1-6e31-4c4a-bd09-015c5c22bdda", "comment": "Malware payload", "value": "2202849915f21b94a85594eff51c4894", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479835, "uuid": "58737692-8bc6-4131-9753-83db0bed864e", "comment": "Malware payload", "value": "317d8295d587349de63afc35a2e5ad3eb165d6825e8d8fbc76ae2df3c161bddb", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479835, "uuid": "fb2fce7f-b276-4b34-9716-181188ed238c", "comment": "Malware payload", "value": "44c24217dff428ff6643770b34ad7026cf60808f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479835, "uuid": "90d2b418-f0e7-419a-a855-0eb66be1c36a", "comment": "Malware payload", "value": "9fd822e79f6879664c2cf1c21bf10e3ebeddd47eb2d161068894b6e1ad6ebaf089242bb2b0542c74be0a316810692bf0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479835, "uuid": "c7e956e8-ccf1-4e64-867c-3037590b9ab8", "value": "T13EF163A792731045B927E1D82FE75B0A6375A00BC006CD383FDD224CCF8B5D999A3B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479835, "uuid": "f41b134a-e367-4453-925e-8d1b0a58b152", "value": "192:vx/b27/CreSHh5i833ZDDVvyd7ljl5OAfduJ78Nh:vx/bh5RwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479835, "uuid": "c6aff9e5-168a-4935-9d22-0abe51361f61", "value": 7791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479835, "uuid": "7db4a6e5-4204-4352-816f-3ca4750bda58", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479835, "uuid": "09c46698-3f47-494f-b3d4-e19387e54479", "value": "thomas.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da61e1e8-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784490525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490525, "uuid": "c2d615ea-709c-4868-b928-73a92ca18f3b", "comment": "Malware payload", "value": "3122a078797350b97dc36d04a53b4dd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490525, "uuid": "95ed718e-5296-441b-af95-f96b77f241f7", "comment": "Malware payload", "value": "31b06ba8c93a54ea3d85d3cceecc436d2782547768a2b0e614220707395f1ad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490525, "uuid": "8c76b2cc-a90c-48cb-8ac6-3a8e4293ad24", "comment": "Malware payload", "value": "d9d6f9a20dd902323fad7a3906c012f950089bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490525, "uuid": "697d76b7-7abb-421d-8193-abadadb19c81", "comment": "Malware payload", "value": "5260550eb17b862997ddb43b8b29cb4d97eb36051421a4c9a12ad04c409f2eaa921d9940f07347fcc2b99fb2a044c36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490525, "uuid": "3742176d-9b76-4175-b98f-59c1b090103d", "value": "T1B3E3D50F6E618F6DF669C7348BF74E21A39933D726E1C645D1ACD5101E2038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490525, "uuid": "ad5f59b2-6036-497d-bdee-dc1a68024b94", "value": "3072:mwpoOzNvufozFy8699kKRgY0inj+j2MAD5:dpo02AzFt6ELsj+Va5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490525, "uuid": "aa8ef100-f0d0-4836-91a8-1b21139b2522", "value": 150832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490525, "uuid": "57a7a126-ae02-4317-a271-b57567adfa14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490525, "uuid": "9d9c0a77-cf85-493b-af73-0ac54cad35b6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae188d86-8370-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784465540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465540, "uuid": "25a8d325-320f-4918-a0ec-5899f9bc829c", "comment": "Malware payload (Mirai)", "value": "6dc2f163e310d48a1895ddb74b7b190e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465540, "uuid": "5083523c-a90c-4ce2-baea-a9f198bc3220", "comment": "Malware payload (Mirai)", "value": "32d569da819c6edd9806e1bc8ab89a84eb0fdb4bd2e7713e505116fc5aec138d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465540, "uuid": "fee253bf-4f1e-49e8-ac62-1859c6408c2d", "comment": "Malware payload (Mirai)", "value": "b2dbd9384ba19cb544106101de3e14cb29bc10dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465540, "uuid": "df8c5841-96d3-4ca3-b3e9-408e65162e5e", "comment": "Malware payload (Mirai)", "value": "af3b4643d02b61f3ea110674b86ce82f457f928ce57a5dfb47c129f90ce1470cba63f5223ed614de37d534d6375883e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465540, "uuid": "3c781842-fccb-4e4e-8e99-db9ad3ecb13a", "value": "T1D743F17FA0B4571591E960B206183A4680299749E794C76CF6CDE0FBB7207F93C0B3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465540, "uuid": "3351c10c-6c56-4cf2-a782-f5610ada3c7a", "value": "1536:GUbFd8Fhah+ib5WPq+It4dlmKXZCryc9nouy8DMP:9pdKh8Ybm4dlmKXWhoutDMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465540, "uuid": "0ea2a6e0-46c6-4fb8-983a-c67b159edf67", "value": 60072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465540, "uuid": "3b88936d-6fd9-4d51-9aac-ad0fb6181323", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465540, "uuid": "f7fe4dcc-1877-45dc-a891-ab5b0d2e6225", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf23e06-8305-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784419611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419611, "uuid": "0a2df040-16b6-470a-a361-41a9ea489b8e", "comment": "Malware payload", "value": "275a03e7a0ec53e69c7da13c0bd6348a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419611, "uuid": "0247cc2b-804c-4e26-ad6b-8cf22b89a43c", "comment": "Malware payload", "value": "342a2753d8a86364f26b67552bea963470412d8342ed6e71560fabc07b32999f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419611, "uuid": "86daf33f-26c5-44a1-862f-9112c34995b1", "comment": "Malware payload", "value": "d59726cedf47553aa1151020dcd0d38e7f7eeb82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419611, "uuid": "e8373886-d254-4d13-9922-149e54964021", "comment": "Malware payload", "value": "05e5be545c4bf7fee484a70b44dfa09c8dbc5ecc5d9d5400af973d54bba88361665d989e4a03423cf0ac3ac73e02bb26", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419611, "uuid": "a17addf3-9a13-4c25-a24d-c340f29318db", "value": "T1C0235C651A857C14AE99C4361D7E2F0CB9AD43E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419611, "uuid": "98d316b0-3696-4ea4-9ae0-0bd6b9a32584", "value": "768:0ZlVEJVIhtMU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0ZrEJ2MZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784419611, "uuid": "f6ab7f5c-77ab-485b-b243-ca3d6d6824a7", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784419611, "uuid": "4a8281ff-34ed-446d-b656-11f66957a311", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419611, "uuid": "5a2d4e94-a34c-406a-b70c-45e3325736b2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172af129-83bc-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784497929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497929, "uuid": "9bdbdbdd-c332-4e36-a3df-0da142de208c", "comment": "Malware payload", "value": "eeb1d2d5f588e18ced050255403a41c4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497929, "uuid": "0ac3dee3-ca00-4f06-ba45-e9bb63f7f439", "comment": "Malware payload", "value": "36e8a488df3ed19cc2f393271814f04569bd1f63fd32349ad13c533f6421e9ce", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497929, "uuid": "cbdd78c6-9db9-46ab-92a7-c835da4571df", "comment": "Malware payload", "value": "05d359cb2de06e7cbb1c336d33ce4f0e3071fdb6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497929, "uuid": "46c8885c-f62f-4348-bb6f-b1910ea9e776", "comment": "Malware payload", "value": "ea86921d54ad70c3c5ba26e7cc9a3129dfb4452a8d2318c170bbf7392366b422106793e7643c1a7ca765a64ad5d84852", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497929, "uuid": "5611df9e-daae-4812-9f09-7b32b48aee93", "value": "T160E63328A6D002FEF6734038EED2659ADAA5B46917B2C5CF5B6887D15E031F0CD39723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497929, "uuid": "9db6db19-05ff-49aa-9b44-5cfe6148a772", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497929, "uuid": "3538205a-64ff-4b2a-a9c8-d4119651500b", "value": "393216:94YSlOp8OEQbQ5F26Ae1uKACVeXMCHWUjXicuI3/PGTAI:92kbQ51AekrXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497929, "uuid": "e03fd6bd-67fb-4c8d-9b9f-93e7c9d430ce", "value": 14316829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497929, "uuid": "8f6bef98-522a-4453-855e-273fc492de94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497929, "uuid": "9bfc2389-1d08-4dba-9963-02e99bbe4718", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498a79ea-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489853, "uuid": "15990807-8fbe-44dd-8338-1d1d9ba61cc5", "comment": "Malware payload", "value": "3ecbb9a7e8d1911d41368ca12020b952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489853, "uuid": "ff1930cc-613b-42ff-8270-57f64df225be", "comment": "Malware payload", "value": "374323e979c06a0d10f1b43b70831921a7e802994bed6b54b161f3e73037161c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489853, "uuid": "f5795865-2dac-4c44-a516-0f83b6cdb8ad", "comment": "Malware payload", "value": "71107a87e72419a135e514cd0126994b79f22d56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489853, "uuid": "7d22f672-c49d-4972-a6a9-a2956200b26a", "comment": "Malware payload", "value": "332a1aab385a9f6ad3336024598592254e6f34b03b8512bb2222cacb9cc4a79f17da1a71e526c683c905a1e4351d5928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489853, "uuid": "4ca5eb19-b56d-422f-8963-4a1f4f0dbe00", "value": "T181B31882BB43DEB3D84310F101B75B254B32FC3A8836DA95E379BDB59A461D0A61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489853, "uuid": "18e2f4a6-48ad-47be-9b05-283cde911b61", "value": "1536:TI2wUuYgRc/+sEXjWw8wc/65NCs4X6GbRfJ2OEgDitB:TI2wC/+DqXw+6C7AOoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489853, "uuid": "c5f94f70-3b91-4fb4-a44b-25c4d2f5b6ee", "value": 110184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489853, "uuid": "49903a62-a88a-4d9e-ae4f-45fa42488fd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489853, "uuid": "9b1c33ef-94aa-44c1-9306-ac571e7febff", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec028f7f-83b9-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784496997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496997, "uuid": "1d858afd-4144-4e55-a734-83be0002b828", "comment": "Malware payload (Mirai)", "value": "1a44875dddd9d0d18c32d0c23a7d009b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496997, "uuid": "3d869b79-1c26-45e3-a04d-f3426fc5f379", "comment": "Malware payload (Mirai)", "value": "37f30b3dca6521b319bdf1b967e205a156c953519fe0acbdad581d6f488da8ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496997, "uuid": "21d88666-7792-43ef-a27f-f88117479f9e", "comment": "Malware payload (Mirai)", "value": "ee16501024b14c186a5f66abe756a5bd891655ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496997, "uuid": "5cfc7cba-2d47-4342-9c41-4551e3edc628", "comment": "Malware payload (Mirai)", "value": "2cd6d2013a1ef25912b396c3d1d98e853a4066f95e921945a8d0847a5cb6ebd464d6fda7ef35d5cfa128a5f810ac6bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496997, "uuid": "981d4211-4f0f-40eb-9243-665cb7c21d73", "value": "T165933A85B981A626C6C25677FF0F024D371A97ECE2DE3302CD141F61378B91B0E6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496997, "uuid": "26c222e2-bee2-44b3-953d-5cf698c0db5e", "value": "1536:1hLMHljKLv+OGBiGBTC6C/mkGKTiR+Qcv4exhEiayoKBWH1d6jt2KZj+kr2YksGp:1dMHlGLfGBQ6C/mNKTiR+Qc/Ei1o91k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784496997, "uuid": "6141f624-b250-48ac-a884-4c0980429982", "value": 93024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784496997, "uuid": "13ef8162-0676-4c55-b568-82c44bbee00c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496997, "uuid": "91ebcd31-3d09-4905-ac58-8ec126c47a06", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b1a3ed-8325-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784433129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433129, "uuid": "517781b2-b713-408f-ad5c-e7aa838c7c08", "comment": "Malware payload (Efimer)", "value": "3006f98990508fe14cfa94aefeb18bda", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433129, "uuid": "be23e077-7ea9-4ec7-8042-16967caf6b06", "comment": "Malware payload (Efimer)", "value": "38452489fd072aa7fedd7a3e61ea37ed2b41efca30bc589b268f6525cf3019c2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433129, "uuid": "26ec2203-e277-4ecd-b1e3-f7d78b85ff56", "comment": "Malware payload (Efimer)", "value": "0ed0c0384f173c6bca24884b9f6714d881e8ad41", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433129, "uuid": "1935abef-8286-4e83-b926-b46aa2623355", "comment": "Malware payload (Efimer)", "value": "d01b20a15531d504842ab4e4e652a1bcf54e79cc6f5eaf30649717bc05f9d03c6afd2fe6502818e711d504f5e5b0fdda", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433129, "uuid": "4b862bf1-3be1-481e-ae81-2790dec7fc0b", "value": "T1C2E6334865E055FEE5938138E9B2D6E5F5A9B8B24B32CBDF0B5487992E130D08D3C173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433129, "uuid": "6069122d-4742-49c7-8331-8f7e2b3bcb9c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433129, "uuid": "bd3d73ed-5eac-443e-ba95-378fed227c5d", "value": "393216:wMRgaBv5z6wUdOJn9GXMCHWUjXkcuI3/PGTAI:w7IGOxAXMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784433129, "uuid": "07bb1efa-6c31-4df5-93df-d31ecc406bb9", "value": 14294095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784433129, "uuid": "cf5f0ba1-3c29-4dfa-84c1-a73dfb14d802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433129, "uuid": "57f141ba-ce91-487a-85f3-ad71bde449e8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c99aa24-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484811, "uuid": "3eba0546-2740-4433-ab4a-5977e84eae15", "comment": "Malware payload (Mirai)", "value": "189b4270241dd913e3bc11984374b054", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484811, "uuid": "139aca17-ffa9-43a1-b1a9-e59795982a44", "comment": "Malware payload (Mirai)", "value": "385867042e172c6868570c73cbd150c1c27493553d6b83262a72d05ab539ab9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484811, "uuid": "3ee755c9-dbfa-4574-9f2a-9de05d58e128", "comment": "Malware payload (Mirai)", "value": "c7783f52d56888dbf4a23fa63a7036c56fb9a2e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484811, "uuid": "21856ce3-8591-44bc-bec1-526b6365b370", "comment": "Malware payload (Mirai)", "value": "759ad198e9c3838ace84a953736b1ff5a75173eb15ece2f56cde611182314593bce52dd1f8619312ec7946e7c61091d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484811, "uuid": "be169c24-fdab-4cb1-be4a-a6e87a74462e", "value": "T189147D01FB181913D1931DB45B3F0776E379D88358B8E109190ABB561733EBB9AC7B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484811, "uuid": "b2ee8f24-520f-4267-94c9-604a8b295c82", "value": "6144:Lmf/ug/Y0wAUquIoIAI2iglQdnFtkcMrOM:LzqUxFixgrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484811, "uuid": "aeb73166-8235-45ec-9e17-db20c42b918b", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484811, "uuid": "a80e2afc-f483-40dc-890e-4398fbaf653c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484811, "uuid": "f888baab-9de5-4d02-86c9-0f863b55f3c1", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caa94c4-8352-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784452519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784452519, "uuid": "3c6a96bd-d4bd-4746-9bb9-ed9b7183d4c4", "comment": "Malware payload (WannaCry)", "value": "500d33acd17a94fc3ed377ecbd52dbf3", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784452519, "uuid": "84d4b8ee-b974-49e9-9b8f-a274198467ad", "comment": "Malware payload (WannaCry)", "value": "3a64e403b83cd168adb9db17a1537022f2db9f9e92940b3b7a1f0efeeeb2e3b3", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784452519, "uuid": "24ced1a8-3f0a-4634-8392-1df6e79db3a1", "comment": "Malware payload (WannaCry)", "value": "bede41eff93436ff9b51cefdc6defd67ff0f1df9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784452519, "uuid": "9a9e6751-734e-4d86-9a02-fb5991f591f7", "comment": "Malware payload (WannaCry)", "value": "9a02516f57649b4127e7a09cba2302ca7eb9cd84bde0d877d237371e5133a330d4569e5acd163056a1e4beef071ff855", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784452519, "uuid": "4f41576b-5799-4e29-9376-92d1c0266805", "value": "T1F336AD06E6E53AA4D6B27FB6257F8710537A7E448D5B921F1220A01A1C37F1CDDE2F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784452519, "uuid": "27850581-8bb1-4293-b3f9-30b7fd5c15f1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784452519, "uuid": "b1bb9c5a-fb73-4775-a695-804ef5caa0c7", "value": "98304:DGDqPoBhz1aRxcSUDk36SAc0B6GIka0HXqbEs0TC+7tT:DGDqPe1Cxcxk3ZAc0B6GIkBHXIEs0Tfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784452519, "uuid": "b3d812dc-de9a-4c94-8dfd-a0d7fd1fe4ab", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784452519, "uuid": "850a423f-5422-4a0e-8d5f-3442ae3af1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784452519, "uuid": "1ac803dd-5c4b-454f-907f-57be0850940d", "value": "3a64e403b83cd168adb9db17a1537022f2db9f9e92940b3b7a1f0efeeeb2e3b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1756722d-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784464428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464428, "uuid": "6d81dde3-5d80-42d2-b7e9-091304ef7b1c", "comment": "Malware payload (Mirai)", "value": "5ddfed3584b930a8cf321349e9d299a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464428, "uuid": "764be258-aaab-475f-a802-7b4b92fc005d", "comment": "Malware payload (Mirai)", "value": "3b2619f1a53b7254bcf64a2bf561c264b081cd6d8583af5c0de529940bdf7024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464428, "uuid": "d4f1b75e-8eb0-4c61-a984-3e812c956faf", "comment": "Malware payload (Mirai)", "value": "8015d9fcfbd46f80245246b123ee2ec6780b67c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464428, "uuid": "8972aa7b-44a5-412d-ace3-cc46e3e0ad7e", "comment": "Malware payload (Mirai)", "value": "6ce06ec3655db12346a5fe5058e4c141d770c674f92608b305f03bcd7139ce1cfdb7a753bb2f8995bc5a5bfc716ff21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464428, "uuid": "b73be7e6-3bf7-4495-8efe-2c7b13fc4325", "value": "T1EDC329A9F890DE52C6D1267AF75E118C33231778C3DE7105CE249E3477EBA5A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464428, "uuid": "e8c8d3ef-7af0-432b-a1eb-9abfc6bade81", "value": "3072:0E7vXJD0eFnpVrxa34oBYk35cYEEUa47psEx2bF+mFN07oU5p7+Qf1Dl:0ErNHhC5cYEEUa47pD2RjFNo36Q95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464428, "uuid": "c40aece6-f11c-4178-93f1-b09e429000fe", "value": 128456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464428, "uuid": "e9be0ea5-ce6c-4a0e-b40d-a8c1aba3b2c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464428, "uuid": "e20f69e9-d303-408d-a83b-329f35c689ae", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573b24c3-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445208, "uuid": "2d3a0776-4f39-4e83-82ce-226785a932aa", "comment": "Malware payload", "value": "7b25c90ffe2c2bfb7d6d52ab44b3191c", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445208, "uuid": "18a2587d-e71a-4ecf-aa5f-8b55e28f345d", "comment": "Malware payload", "value": "3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445208, "uuid": "7e3c65ae-56ad-4e75-bf1f-9c03058458a1", "comment": "Malware payload", "value": "8b66b23468ebc384b993969ae44317e687a5b2a9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445208, "uuid": "62c0f0d6-0e49-442b-bb34-b3a1d91b3c5e", "comment": "Malware payload", "value": "e3f01c6b5a7079ff544cf7c2d4b638fce58e263c10dfc53f1005f073bf339f6569d687ac122db3067fb828069ffffc10", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445208, "uuid": "4c717307-8af2-4ac6-a40d-b84d69e5bb0f", "value": "T12D92B71669B300226913C0BC6BE79746333180079645CE6A3FAC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445208, "uuid": "11117ed1-626b-4127-bd32-d8cadd791784", "value": "384:X4FTAsXe7FUFh/+4MA6ksb7RYsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xe8sXe7FUFk3usafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445208, "uuid": "e7a5dee8-10aa-4084-9971-57bcdf2c58c6", "value": 20092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445208, "uuid": "d4e5b727-9d85-408c-9fff-8df583898a07", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445208, "uuid": "caa4188d-aa9c-4193-80ef-bffa5cd2bc3e", "value": "hongyang2015.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179dd1af-8378-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784468724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784468724, "uuid": "75de0e95-4da1-4085-8291-b6592eb1576c", "comment": "Malware payload (Mirai)", "value": "21376f9dfbf3c171a9ff34c9e2fb1ed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784468724, "uuid": "e8f3da26-e70d-4444-b8b0-3d1a1c8e4029", "comment": "Malware payload (Mirai)", "value": "3be1b094075bf0895bee6813cd670d6d7dab2bcc0034e6505f16e480ffc6ff90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784468724, "uuid": "c3fb8b1e-43ab-4bed-ace8-10dc013f3558", "comment": "Malware payload (Mirai)", "value": "8d952eff64145cefbf10fb50410df0eb299131e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784468724, "uuid": "c5fcfffb-3771-4792-ab0e-cc5e135ce1f5", "comment": "Malware payload (Mirai)", "value": "abf4c60b12c191ffcdb561545e6664f46972b5a17cde0d39c756a3293f67ac44f8c73f888806151d682797931b5fd63b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784468724, "uuid": "becb6e59-7dc8-440e-b09e-40b1c9ae8c1a", "value": "T18C332A95FC41A612C6C555BBFF0E438D7726435CE2EE7303AA256F21378B86A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784468724, "uuid": "ee3dd234-df7a-4100-a618-2765c29d1055", "value": "768:JSyRw5D7+I3QL9GWvLXQrDVeDDjY1uMTG4wflOEOdnQUeLk63OV1foQgPS50sDiL:i9a6QZUrgDWTGzOEOdZmk6eVSS3GrR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784468724, "uuid": "0ec011be-ee48-4e53-9bf3-d09c43d7f6a7", "value": 54736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784468724, "uuid": "663f6c7b-0183-47d1-9148-6ec16136a585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784468724, "uuid": "23c343dc-2d01-4262-9bf2-c8b016802070", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e37dafb-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470453, "uuid": "e683de5d-9c64-4814-8eee-dd2fb0600576", "comment": "Malware payload (Mirai)", "value": "1850a73062029f05e6489a6d7a6a3bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470453, "uuid": "edd70e4b-e45a-4d5d-81f1-f69bfc1f2e38", "comment": "Malware payload (Mirai)", "value": "3be6c1fe87016852d78e42b68b8a9bb0b6f3101ad2642db0686dfff1b1fb7d1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470453, "uuid": "1189f250-17e4-41a6-b774-abe0fe2cda0d", "comment": "Malware payload (Mirai)", "value": "89b21ef963c690da175f433aee5beceeaf9f9197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470453, "uuid": "aa29c341-7bfa-4975-9bab-6cc5392efa9b", "comment": "Malware payload (Mirai)", "value": "d3771b0d72d9290a803364b03be2aa0272d99b3df7a1ba92c273c99e9b381d9090bd225b814053d8b5dc2dc6a8acf03a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470453, "uuid": "bc7641b3-791e-409a-b5c7-ac163249f811", "value": "T16933F25DCEA0BD72C39D493FE8190EE7D013C17DB9A135E25104CA2B2FC215A68BE6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470453, "uuid": "e183e8e4-da36-45f6-bb58-2da6a844000f", "value": "768:OAwo2YmG93+0MhGD9dOMAnsP8Fkl8NTpS8oi4sYuSmx4JQRO8QQzFULIu83U03wq:VyOdPeGDrOzr54Vi4sYpmyLQzFULJfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470453, "uuid": "aa9f2251-6427-4b73-b80c-a933ade76950", "value": 52676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470453, "uuid": "4e9bfe45-2f1e-4eca-b905-fec7a9f5060f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470453, "uuid": "6f7f340f-3640-47d5-ac2b-0a8b1aae7688", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05d5de9-835d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784457437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457437, "uuid": "2b34a4ef-92a5-4169-8e3f-e016f5b63060", "comment": "Malware payload (Vidar)", "value": "2effc13d1714796ff13b06ebcd9125d0", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457437, "uuid": "64096c89-d153-4d13-817e-78109c730761", "comment": "Malware payload (Vidar)", "value": "3db0f2fa8d2225a0c3ad35c137e05370f846995750712259dca3a2dd00020c43", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457437, "uuid": "a8145890-7faf-44e0-a06c-70f8e9bb84fa", "comment": "Malware payload (Vidar)", "value": "c13d6f00c0d9ed6c0895f5b2983208cca8736b5b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457437, "uuid": "794aa34b-1716-4266-88be-73781cc663a1", "comment": "Malware payload (Vidar)", "value": "2aadb689c59e5164ff6126427ea0acceb59baaf92763535cead4739050b77b826d2340cbeb196d825c6d62a468f4b913", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457437, "uuid": "09568041-72fd-4efe-9967-fcf3fd068f33", "value": "T1A9F7338447598655C1CB5FFD617F0AF7AE2B0EB0A21DB0AB06A38432F5D98A7C58C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457437, "uuid": "6ba38152-c550-4b2e-b216-d3ca09d957c7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457437, "uuid": "9ffbc926-4b6b-4738-80ef-b136083ae668", "value": "1572864:vLdk/WpO7FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB767:v2epQaABZVPArg/bXeB767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784457437, "uuid": "b0bd31c0-9a1a-4ce9-a4ff-31ecab08a6f2", "value": 71382139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784457437, "uuid": "f7f14bb6-1ee6-4acb-a581-28a07deb2f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457437, "uuid": "a295aec5-edb5-4dce-8522-1dbf457c603f", "value": "EclipseV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc15986d-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784470825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470825, "uuid": "7a5d79ad-103a-4f49-b0d8-b92f9b7b5400", "comment": "Malware payload", "value": "26bf5d63bc9d033cd52c263b2aa2ad1b", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470825, "uuid": "63d3f950-922d-4a27-b996-8bcc555df8bb", "comment": "Malware payload", "value": "3ec59ae574589c01c611ba26289bc111c767d3ee56b1758d3df63a1600147019", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470825, "uuid": "27a22eb7-392f-42be-b03c-f997a8316065", "comment": "Malware payload", "value": "b0e2fe0a84bddaddddc3310511e434fa61df4ea9", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470825, "uuid": "015da0a8-6255-4893-bf32-00ae98ededd1", "comment": "Malware payload", "value": "c9200cad1ad78a6f0de36fa5d4dd917c468d58f22842921fb8bdd897c325dc6dd9d589a9aedca7f76e9b82e19941bd7d", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470825, "uuid": "8827f772-62e3-46d4-8ca4-068b481556d3", "value": "T1A96523956BD000AAD87BA3B89AF322536775BCC517F4D3CF624082A92F239C4717B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470825, "uuid": "bf34e820-db3c-4a93-b064-13104456190f", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470825, "uuid": "70a7c9a8-1e21-4354-bbe1-ed531797b631", "value": "24576:9rsRcbYKNp03n4gZWmA7OABU5CpU8xPhuyHyCH+8xc9jeYu+gXTk0kyK:9rsabNNp03FWmA7O95iUUPwULH+8Ff+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470825, "uuid": "4ebd93fd-4d39-4c5b-ac82-200658faf5ce", "value": 1533112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470825, "uuid": "88f4eb93-6779-4df5-aa66-ba1e6c54231a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470825, "uuid": "cf02d05f-18b7-4dbd-a6e9-6858e44dda4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b91759-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489660, "uuid": "94061588-06a1-464b-bb17-5dd1ced66c1c", "comment": "Malware payload (Mirai)", "value": "5c325554b40b0d3a15eafd601e3faf2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489660, "uuid": "ca86397c-70f2-4122-bc28-dde6a7f10fa2", "comment": "Malware payload (Mirai)", "value": "3f194f241ddee37baf4b02d517efb28ee3a11ef010ab442709c90c7d7f450bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489660, "uuid": "aed64dc7-c1fb-4907-ba74-80945c85a846", "comment": "Malware payload (Mirai)", "value": "2e2b72c3663a211456e1205f7c03b28a329ecc1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489660, "uuid": "5bc54cb7-643b-4e2f-8b9a-82f13c9de480", "comment": "Malware payload (Mirai)", "value": "1a25f73368dbc48839ad052e7f2b0958c83afa98559e4803281e2b9d092c7cc0f6f57f092e4d53702e54522eaf946eb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489660, "uuid": "f5ab8100-60ec-4960-887e-9b23e9b05044", "value": "T129C3E846FD518F13C5C321F7FBDE429C7A166B6DD6FA3102A925BFA033864D60A36212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489660, "uuid": "1a5b98b6-dc85-46a2-bb36-ac72a1dacf84", "value": "1536:8IC5w9eX+08HokXM4VV5i97RW41yt9PJIKn+JxIol4KwywLtYcLCcN049gOvCGdv:8IgR+034RyFW4MJijqX8Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489660, "uuid": "eadf2bd7-adc5-4633-8214-4308621dc48a", "value": 125808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489660, "uuid": "c93cb783-124b-402f-af99-44ad10f2df73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489660, "uuid": "dc114acf-db50-49bc-8213-412bba379af6", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05febfb9-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489310, "uuid": "7d07839f-fa90-4f17-938c-fea5b3558c56", "comment": "Malware payload (Mirai)", "value": "d98853cdd15fed05ce2c53a0a5e8d428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489310, "uuid": "cd6b9029-45b7-46e4-9633-b32f2ff391ad", "comment": "Malware payload (Mirai)", "value": "3f2d582340e0e6fe2b72e1eaa36b78a1bb772f08e36c8771514daf26d1f60429", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489310, "uuid": "f1336b6b-b0d0-44a7-949c-1e8de5f66f0a", "comment": "Malware payload (Mirai)", "value": "e941c0d8c6c353fa70dcc737d4c46c4ae2527454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489310, "uuid": "d54eedbf-6136-4e1a-a760-37424687827c", "comment": "Malware payload (Mirai)", "value": "e2c115fa5cdd4e810360c16cad4afbf2c19ad36b9c40a018771b4c52e8c3ed8e9b2801f54846327b3f31b64b29bbf2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489310, "uuid": "023a5457-47fb-4f3f-bd2e-7c6ecd158f92", "value": "T1EFA306A3DD26AF1AD157E0F0A1F24E741F53BD6A48570EA9A432EAF44143DCCB5063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489310, "uuid": "12ff52b1-e2be-4000-a96d-9e90e7bab6b9", "value": "1536:Yb3fCWCNKQtz+7yy+aaWpTUiWFxXqYv8KmJ:eCWdQQHaWaiWPnFmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489310, "uuid": "f909fe42-3d93-4580-897c-60faa8fbe73b", "value": 102308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489310, "uuid": "e4d53ed6-5177-45dd-a854-1540b9405901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489310, "uuid": "f34e8f3d-d705-41b7-ad29-3b354db92ad0", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a450c6bc-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470678, "uuid": "45305605-5f1c-42bb-931e-87373604ea50", "comment": "Malware payload (Mirai)", "value": "6d7c4c3875d1e68e1c21aafbe2b53ccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470678, "uuid": "44ab5d36-9647-4f8c-89f0-dbae62fc02ab", "comment": "Malware payload (Mirai)", "value": "3f93929d988fc7b785450558860fe08123c19901b2f01673cc4b8b34c3f94f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470678, "uuid": "2e6c2a45-6ef8-44f9-ae64-335fdab269f7", "comment": "Malware payload (Mirai)", "value": "9dc489f75903464531bfe68964393ad6b352ab47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470678, "uuid": "fe294ede-0a64-4b8d-a059-7eb73dc55e65", "comment": "Malware payload (Mirai)", "value": "bb331c93e46ddddf9480cee4b8a80a41909a41f2f4621d17cc243da1ab332c721575aa51522310116bcdeb0684a91699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470678, "uuid": "4bb589d4-20f0-47fd-8629-d96d00a099b5", "value": "T135838E68AA0F7D81C2C7E3BEBD5A0FA270373CB48364C1B15A00E69DD4E9ED48D91567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470678, "uuid": "474b6ea8-4ed1-4720-8224-773ac38d5b3c", "value": "1536:Ph+mW7F7d3FaeLtcZnJY8G2zBMaak7DB2KOC54L6JjIr:J+L5d3TxKKcBTaiB2KhRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470678, "uuid": "be800894-e80d-4731-a426-8388212f8de7", "value": 83384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470678, "uuid": "6fbfeebc-eb1f-4b4e-bfdf-0a768a5d8811", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470678, "uuid": "6f55b130-87e5-4158-9c73-0184a24c5332", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c064b857-8336-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784440660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440660, "uuid": "3a43dbc7-8f21-47dc-911c-64c14fb8586d", "comment": "Malware payload (CoinMiner)", "value": "0ab5c6d452d9d8581923181a6e4de3a3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440660, "uuid": "79b4b1f2-08d1-4c87-9e11-5c3fd17f9235", "comment": "Malware payload (CoinMiner)", "value": "3fe7dd0ff92a06d6e832728c5be15f86092ab3b27827231410184adeeb689c21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440660, "uuid": "1b0aa4e3-7205-444e-91ae-8303dc1e1eeb", "comment": "Malware payload (CoinMiner)", "value": "cc617c95b077c5f67ea46ee388fecb4082b79eed", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440660, "uuid": "e95f834d-7cb0-4721-851b-569fce4c75b3", "comment": "Malware payload (CoinMiner)", "value": "1879595b802ca42cd8181f50b27ee20cb6b9af804846097c8eb7efbad6a86bb0191d6b2c64d950af490d12c760fe794a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440660, "uuid": "deac79da-dd13-42e4-b769-cf12a750cfc2", "value": "T11A168C98ED0F3912F3C7E23CCF4A97E172173694E32390B679D2524DD19E9E4C6A2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440660, "uuid": "69e6291d-8acd-45e6-ae7c-ca2fbd0326e6", "value": "98304:xz0932WPb3Ip+DaiZh6LYx5vo+zHJA+qFmgI:x0932WDNaI5Gdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784440660, "uuid": "7d143743-f00d-44c8-ae5b-df0606efa761", "value": 4199888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784440660, "uuid": "a58ea6c5-aeb5-441d-9d78-eb53a1a5b68c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440660, "uuid": "0fc26aa8-65a0-4ac8-be93-4575d1bf2e66", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a84b90-83ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490658, "uuid": "a5802847-40b2-42df-b330-bae3105cdb24", "comment": "Malware payload (Mirai)", "value": "be10bc2d3181d5f167bea83fd20571cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490658, "uuid": "9d4d4d48-ca6c-4a76-9c92-2ca6b0a833c4", "comment": "Malware payload (Mirai)", "value": "40538319f2440197c5e202605992cd1d2638e9d4cc747e8a16e429466262dea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490658, "uuid": "def4d1ab-118c-4e74-b7cd-41677fe162c4", "comment": "Malware payload (Mirai)", "value": "09c043a8a2d7a89faff4a3d73c013910e68c9365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490658, "uuid": "d6e200cf-86fe-4959-b151-4580d935ff59", "comment": "Malware payload (Mirai)", "value": "17c9ca9b48560e98ed3c0e30cc55b6eee971659010bbdf657ca3d34d5f9ab133dedda296350c953106bbb4f18f5a8033", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490658, "uuid": "ef0ad1df-6845-4809-9ea2-549dc61bf5dd", "value": "T130633D85FC9286AEC6D01779A76EB68E3322B3A1C3CF3217CD541B5137C919B0D66B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490658, "uuid": "a80cb4ef-7f35-4743-abdf-2615ef2d0531", "value": "768:z3mA1SW/CjvBwzsvRubbI6fl/1WG+7ll5glMJiQ+8IgUzdwVnJXGYss4oILubJi4:LLStPJ6HlNWLglYzGYssi8ihXTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490658, "uuid": "eecf44c6-af1f-477e-bc90-646720bc219a", "value": 68232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490658, "uuid": "a3be531d-5340-413c-abd0-906f042ac419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490658, "uuid": "90d96d1c-7be1-426a-b5b2-ea3cfe2c5bf9", "value": "ohshit.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0030b8-839e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784485023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485023, "uuid": "0bc414ca-bc4e-44cc-9bd6-f7147ee186bc", "comment": "Malware payload", "value": "cb906e524e99957e0f28c66c010a192f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485023, "uuid": "8bae8ed9-18ef-407e-bbc1-840af76c7564", "comment": "Malware payload", "value": "40c253bda87cc6bee634d60340aa1b153d4f980a6cabf37d2500d23019375e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485023, "uuid": "2b700f27-4bb8-41b3-9fda-c7989f3555e9", "comment": "Malware payload", "value": "d3d138d4e13baaa8de4c674ef8187cec714ec1e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485023, "uuid": "293be5cc-b2f8-43d6-804e-fb4c863c7323", "comment": "Malware payload", "value": "0ddd29b5d09791c2544946d76a6af0038a3c58259a21a406292533553d69cc1289d3e1a36121ba69b42b146a76100379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485023, "uuid": "7c42a3a5-6ba6-4051-a8b7-a3ab863e350a", "value": "T18CA3F786BB43DFB3E84311F112F74B258B31FC3A4827EA95E3797DA589121D0A616378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485023, "uuid": "c547651c-e29a-4347-8f9b-126f88486005", "value": "1536:VjN5zSAQ/w57sdW4s0sBRWwrrGSRKSno959VGMSMpLA:V3zRQ/wp/b9BRWwNnotUMTxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485023, "uuid": "4d464081-d70d-411f-96dd-f8c97744fd81", "value": 99908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485023, "uuid": "059c7892-7d77-4a63-862c-e9df66498d30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485023, "uuid": "9d1e8a9e-1c0b-43bd-85d3-708128884c65", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c043a3-83bd-11f1-be1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784498416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498416, "uuid": "654455bd-1bfd-465d-9926-5ac4786e5577", "comment": "Malware payload (ValleyRAT)", "value": "9c986d7e311ce1e8db7bd65b8271a87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498416, "uuid": "b6583950-7401-4d17-b1d7-19f1df746411", "comment": "Malware payload (ValleyRAT)", "value": "40c98ff9673f67cfa82d9e2e16a2e55644f71fec87e2d92f25821a2b917f8145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498416, "uuid": "f85fb634-b8e9-4e7d-8520-fea02d231dcf", "comment": "Malware payload (ValleyRAT)", "value": "5c542d609013e48e6095af6ce5ef28208a35bb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498416, "uuid": "7ba14568-a040-421f-bcad-5707f116dd40", "comment": "Malware payload (ValleyRAT)", "value": "8beb180ac740b5a7ed929023c19802012f71ffa41a453d26c6813e927ababf9f1d8bf75463ed5d4e32755af098db79a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498416, "uuid": "1fc2f200-6e23-4e4f-ba0e-bb82cd8a8ba4", "value": "T1F4D77C0272A54A61FDA23B7186D81727EF3ABD3157B648973E0C2BF20F7A3154A27711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498416, "uuid": "17f98fee-7ae2-47ac-add2-7ee1ae26671a", "value": "d3f487c6c23e9d9845b2eca3fbdd93dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498416, "uuid": "5e5e3082-16e2-476e-9074-314509a9aa05", "value": "393216:GyXTrculw3aURH+EIXBYNitrgaFa1305l/9CidVeJoqaQKiYq7eSdK0ngpk+HcM+:RgRErYd7IzIT9WAHNei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498416, "uuid": "484d4c20-f6fb-49df-8fb0-3c5e589bc573", "value": 61770902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498416, "uuid": "d98854e6-0b6f-46f1-8241-8bf1775096b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498416, "uuid": "4b034dfd-c801-45e3-b3ad-0c91aa9bafed", "value": "9C986D7E311CE1E8DB7BD65B8271A87D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e20f1d-83c0-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784499985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499985, "uuid": "db8f6cf2-f8c3-49c6-8b8a-dae4a47f2137", "comment": "Malware payload (Mirai)", "value": "d18fa4617e884ead6bca454ce4184440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499985, "uuid": "521f4e87-3af1-4b08-9f9b-73129c1c22d6", "comment": "Malware payload (Mirai)", "value": "4280445841f4898c26f409239f1a623304b637363087bd88a6ee9506e0256463", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499985, "uuid": "27e12bc1-cc2a-4e04-a741-36e1b3468eeb", "comment": "Malware payload (Mirai)", "value": "c15d1b9d400d518c91ec4e105aaf6ac46b93954a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499985, "uuid": "92c169a7-31fd-4029-8a23-863232bfab07", "comment": "Malware payload (Mirai)", "value": "7ab47d194a392afa33e09ce290aab5d768380955e29e0f2744b808c9aa87e37fd2009d3726893521d528af95d7153faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499985, "uuid": "4e243713-3226-48da-8d10-864b0253b997", "value": "T191E3FA07A951DF12D1C211B9FF5E425937136F78D3EE72029D24AFB0278A8EB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499985, "uuid": "48ad7450-3878-4dea-a073-00738d3b3c62", "value": "3072:Ss7DUEY1wmZXvNfclfalIxnqjPNoQNyMKrvBT:ScDTYLZXFfcpasn2NoXMKrvBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784499985, "uuid": "615266e4-98e3-4b4f-b5d5-6bdfcd5989a4", "value": 147444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784499985, "uuid": "ae58eca0-9bc0-45d8-8976-cf62c3669e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499985, "uuid": "b981129e-d4ce-4cb1-a36a-3bededf35544", "value": "SecuriteInfo.com.Linux.Bot.20354.26072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ad3c52-8329-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784435142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435142, "uuid": "2543b6b3-f26f-4940-99e1-12734a637877", "comment": "Malware payload (Stealc)", "value": "222554b05266473df7aa3a133afd9d9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435142, "uuid": "b80b1b03-1b8f-4442-9a7b-1fd7087955b3", "comment": "Malware payload (Stealc)", "value": "43b730b200c203aba8ab1c7ddf342c168e8d7ba384f07751c931a4aac7b23a56", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435142, "uuid": "f2b1725b-ab4d-4500-a9bd-f2009780c123", "comment": "Malware payload (Stealc)", "value": "9f72dd2092eae09fdbb27538fcb4ee1a1c7ccbd3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784435142, "uuid": "d21ae6bd-6963-483c-89bd-16bfc1c15661", "comment": "Malware payload (Stealc)", "value": "a577582051e761618a2b46b0441de7bb59f3848d025a08953f7385de7eca9f2d9713431dc36a0ea6a7afae4b3f481cc5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435142, "uuid": "643c1093-4702-41a9-b5ef-b1f9c554594a", "value": "T18875280BBCD005F6D4AA9232896761517BB2BC490F3127D73AA0B27C2F727E49E75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435142, "uuid": "895b49f1-a7e4-4822-badd-f70592949ad1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435142, "uuid": "7c3a8582-70eb-42ef-9adf-b10976de8a1c", "value": "24576:zHpYhK5bCDR5MdvmnHj+K1T+5i/QBele5yKD9e++vRbui:zHq4bqRSZmD+0TZ2KvRbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784435142, "uuid": "a534a3e0-d461-48b4-83ae-b5d3fe04be7a", "value": 1554944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784435142, "uuid": "6ac7eb00-04ad-4907-88df-3e2c947de935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784435142, "uuid": "6e9942d7-0aab-4719-bee2-99d2c678ce86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8b9c6d-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489856, "uuid": "39b4ba99-0613-45df-8fef-be7a2a940a03", "comment": "Malware payload", "value": "d29bae9f75a854dcb2cce66805352102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489856, "uuid": "8eac8b65-655a-41d1-8aef-7207ffb19cc7", "comment": "Malware payload", "value": "43de9da4637e381e9459540498c1a0bb6e91cb6767756c19435950834682e136", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489856, "uuid": "f3a8aa35-66fd-473d-8969-aceb583249bd", "comment": "Malware payload", "value": "68281501c9c9e456616856c751d1ef6f4ed39c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489856, "uuid": "79812b9f-8eb0-41c8-9b26-e06c0aa0ac0d", "comment": "Malware payload", "value": "105db10631e932f5d7f1a851bce6b904505d913fbc2f9ee48fb8f0b6a8ac19083f22d9ec20dc4184ef51d1f697e867db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489856, "uuid": "d5b632ab-72e6-4873-a86c-3acdb4a39650", "value": "T1B0C3F6027B0D4F03E1432DF4377B0BE1839BBD5228A9E280751AFEC957B19B29506E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489856, "uuid": "9a5bd0e9-ec98-43f2-b3d0-301c1511e8ed", "value": "1536:u78Ui81YWjx4QG56xFbTj+32lT54I7rxv7DxvAp6I3RAuHXgFSqjYzcv:uIUi9WjxIoxZ+3234I7rF+przq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489856, "uuid": "18888024-ddc7-4b64-bccf-3d3f0cecfa82", "value": 128428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489856, "uuid": "be9f7979-fa12-444a-a97b-976773a59212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489856, "uuid": "0f7e52d9-daf2-4a0b-8e04-b908f06b345a", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bff7787-8389-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784476167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476167, "uuid": "c0039cb1-df3c-4860-b938-47b8bafd43c0", "comment": "Malware payload", "value": "82dd807761c149fd9f05ef8bf9e31b6c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476167, "uuid": "42e0953f-f2ed-40e9-8749-38b3695550e1", "comment": "Malware payload", "value": "44f0d0cf154447a6e3236c00a9aa9c6232e00bf8cdf66f57800971bc4fe3e69a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476167, "uuid": "a718f0fb-ab1e-4e65-9249-1580d6dccfb4", "comment": "Malware payload", "value": "3ba258491acb95a5ae736ad39b75adea65ff5555", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476167, "uuid": "88a0f630-9697-4561-a44c-d9e45d1bef3a", "comment": "Malware payload", "value": "e3db38446d23969673211b4f3f232e911e4d13064bca05afc890d94e8432b50c9104246b65d5e2624e2c03e96e85ccd3", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476167, "uuid": "b41f0a49-d8b8-4050-b1f6-61189aad211d", "value": "T1B775B01AA3A401FCD077C2B4CE57960BEBB2B44A1334A6DF57D09D962F23A715A3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476167, "uuid": "ce65485d-b9dd-4bb0-bb61-0a5533226564", "value": "94e1c85e15805e1e413bdf491fdaa09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476167, "uuid": "7faf0530-ac13-4463-8712-a2f14b287564", "value": "49152:NSKWFJs0UztTKmUDr9J0bxIjQrMKnUbF7J:EFy0U8Yx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784476167, "uuid": "97cc2465-a4d0-4bbb-9a0a-5a9df200d3c4", "value": 1682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784476167, "uuid": "db243cf5-14ed-40ad-a8a8-47326aae5f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476167, "uuid": "e051a009-5cdb-4cf3-8d3c-4b8ba6199856", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81a45f3-8371-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784465986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465986, "uuid": "990081a9-e968-4e51-8643-d0bdd68fc64f", "comment": "Malware payload (Mirai)", "value": "dc75496d04cdb07f92cb86ffe942994f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465986, "uuid": "53c35a81-09e9-4073-a679-f59adb685067", "comment": "Malware payload (Mirai)", "value": "45eb6d2a70b177de6b58d0594048689e98bc74e4f0d597ee14c1e609f9cfadfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465986, "uuid": "a8cdef5c-c197-4a3b-b923-cdb235b34ece", "comment": "Malware payload (Mirai)", "value": "0efe656cb44d3cb069ea60b02b3dde0f461b8cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465986, "uuid": "8e69e775-1030-497f-bdb8-98a996fae406", "comment": "Malware payload (Mirai)", "value": "ccc78aac04bdcb721c1cfd4c8f2f3551977ecdd25d8b8939f464eac72fc45f9226af1a3b4a786921ea2ba884422818be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465986, "uuid": "0a5451c3-aee0-435d-a478-74daecbd5080", "value": "T16C236C47F743D0B9F95716B1107BA7064732F93940A9EB46CB265D36ED23A00A72B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465986, "uuid": "88eb8a5f-a94c-4886-bc00-c1be81c4864e", "value": "768:OQI2YgXcGOlyz4i9tar0djlijKuNDsMtw8vJ7qhS0F+XYBtSTsIqP:OQUEhOAz4o5QhNIMt/UD9BtSTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465986, "uuid": "85485e58-2f41-4181-b984-67252110a85b", "value": 46836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465986, "uuid": "83676c4f-a05e-47f3-99c9-9357a4972092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465986, "uuid": "7c4df369-fa82-4f03-b3f0-1169c6290b6e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffea429-8378-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784469006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784469006, "uuid": "991022c2-95e3-4297-a3f9-1620554d300b", "comment": "Malware payload (Mirai)", "value": "6496ec66120977f61b5d020ae2486279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784469006, "uuid": "f5248a93-8b55-41dd-bfeb-e3a666b1f56c", "comment": "Malware payload (Mirai)", "value": "461d1f5e0a798c1f3210c5f5af30abcdb432a8a5915ca452e4caabe22335e491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784469006, "uuid": "f0406001-e910-4a5c-9907-91cfd2d84dfd", "comment": "Malware payload (Mirai)", "value": "3911dc4bc317da908eebfb298d1170a9f85cbab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784469006, "uuid": "447acbf8-7e2d-44df-9e08-b41ffb6ad337", "comment": "Malware payload (Mirai)", "value": "8ff032041fb87bc9ae11cf679136844e2edc3ecb614d238826bb10a3d529c433aec3566567c967ccb74967994b62a6c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784469006, "uuid": "b7d22e2e-a093-4d4f-a24b-f5f5dc8db9c0", "value": "T1F073295AFD806F01D5D625BAFE4F414933634B6CE3EE7212AE205B2527CA92B0F7B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784469006, "uuid": "15b5f270-2564-44a9-bc65-3cce6ebf4a0c", "value": "1536:sdntb4ymurl50ZZa43WLZ73ZK8dWllICitD4J8OgcZvYH/prRYW6:uVrkZZa43WLZ73ZLn5D4J8OgcloDYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784469006, "uuid": "f8c7835a-3bab-47cb-8be5-bed9bdde96bf", "value": 79768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784469006, "uuid": "91f63874-91bb-4fa0-bcfe-a967876f4bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784469006, "uuid": "1b7dac28-022f-4053-bd7c-fe35ac72caab", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5da32b6-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489659, "uuid": "ba5b4574-e4af-4fdc-8e75-51ab8953022f", "comment": "Malware payload (Mirai)", "value": "0508b99c7bf6d71059f1d259233fbb99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489659, "uuid": "84877be9-9ec0-4d8a-9f09-2a918e97dc9f", "comment": "Malware payload (Mirai)", "value": "46617426fa58da42fa7f76c3c851b236b0097b46e3e92e2f04971218fe745ee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489659, "uuid": "0d423789-e00c-43e0-b1ff-8c636921ff33", "comment": "Malware payload (Mirai)", "value": "c9b677818e8ca539936730dd7732778c1fe53a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489659, "uuid": "be0c39a7-ab78-4a34-a5f8-913910a29ed7", "comment": "Malware payload (Mirai)", "value": "1830ab0e852163578a26cde4a1fcffa6c059c7b783613952f427bc1578434c4fb5d0edf254b7cbae2f62aaf8435785e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489659, "uuid": "22a49c2a-3b1a-47ce-8545-0a3082ae4b3c", "value": "T102B3F886BB83DFB3E95320F112B75B314A32FD3A5C26DA81D3397CA599911C0A617378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489659, "uuid": "abd2fe42-3f60-4e49-8faf-dab0d30fc786", "value": "1536:7lIRDPRFWoojtjqKru8hkswFRPJFtvQgmjVJKQsmuKWho:7WRqtjjK8hyzRBfDm0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489659, "uuid": "6906b7a1-0a04-4b79-9501-25fbf85e4f33", "value": 110184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489659, "uuid": "79016058-94ae-4b42-bc0c-cd7d9ef1f083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489659, "uuid": "eaf5a1c7-1b77-4887-912f-49bf319c73a8", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ef4beb-83b5-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784495222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495222, "uuid": "beb50213-42a4-4bac-a349-8a7a173fe049", "comment": "Malware payload (Mirai)", "value": "2db2a7ae3c0e5a91a921c2cd48ceebef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495222, "uuid": "456fad04-ccb3-41e8-8532-2780dc00dcaf", "comment": "Malware payload (Mirai)", "value": "46e5c2627299f6f940589debfae6359c68ccae6828992aef6daf108d12d184de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495222, "uuid": "b85ad5bf-a923-4c8c-bfa0-3e651adc7594", "comment": "Malware payload (Mirai)", "value": "2d5e17b9ea5087ed85deffe15747b4ff35de1362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495222, "uuid": "f0ee0c1c-deba-405f-b037-af811e29e6f4", "comment": "Malware payload (Mirai)", "value": "8fc4752ef47eec05cec27a3c0ef8fea1f3bccfe49be6f5fbcf71ba40493ca89c82d0dfb35030e6437f2315a4aa733c44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495222, "uuid": "32ba757d-3f9b-4eea-93f7-d0265b5b4e0b", "value": "T1D54301D1CF24FE89FB742672D92EC640940D8AFCE9656AB350B619116AF32CC7BB0543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495222, "uuid": "3cfdc38d-88d9-49fb-badf-3fe7b7e9b4e3", "value": "1536:DvUwV15WGkqzewK6avAnFyOUquUP5lLoQfx:DLV1Uwva4FTUq1PXX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784495222, "uuid": "7a4aba0b-35d6-45de-9f1b-9c64b9cc8960", "value": 55656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784495222, "uuid": "4825772b-5dfd-4088-acd2-0ece0bf381df", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495222, "uuid": "8be6b521-b3d8-427e-a0ae-ebdc74bf1112", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fdaac3-833b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1784442577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442577, "uuid": "7accd431-08ee-4b45-8f37-dfb960dcfa62", "comment": "Malware payload (Stealc)", "value": "3faff5636621a5c58200a96083fed6c9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442577, "uuid": "7470e3d4-b43d-484c-9b58-39e8718a6c33", "comment": "Malware payload (Stealc)", "value": "47489d74275a748f8d5c607e16a2696d05167c098f12cc0e191855f9d41edb10", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442577, "uuid": "c14b4265-d19b-4318-b36e-c49860059aea", "comment": "Malware payload (Stealc)", "value": "ce98c8f53f8f1d8abb31ab19abcdbc2066aaceb2", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442577, "uuid": "85da0a6f-20a3-422e-be54-354a4f5317a9", "comment": "Malware payload (Stealc)", "value": "8e13eaa03fac41f086eb95cdfdeb7b9ca6c048108d9f3ba739e7a984bd58586b842a1de793ac088ec251afbcb9233e74", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442577, "uuid": "eccad72a-2ac5-47d5-a325-8845aaaf4e5b", "value": "T14C7523E8E39DCF1AC7954FB00555D27523F02D8AD410D7029EEAACDFB426F2191983A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442577, "uuid": "7ddc7e0a-5532-4e4e-a7a6-f950542d4111", "value": "49152:bOPxMJrnMoYj1662IGEmNa3nXuigV3tBPXep:aPSBnKj166PFmNanIVPXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784442577, "uuid": "327b549d-f418-412b-97aa-27ee35398a50", "value": 1575936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784442577, "uuid": "deaaf7a0-13cb-4297-8f47-7d26d502a297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442577, "uuid": "cca640c8-3798-43fd-964f-66a9beaeea9d", "value": "FLStudio2025 Crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057062ae-83ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784491027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491027, "uuid": "9bf2e300-3fe8-4826-acaa-4ee2f1675e62", "comment": "Malware payload (Mirai)", "value": "4b5a4661c087c01bc252370d8b10607b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491027, "uuid": "7d8a8e83-dd64-423b-8b22-793102b83381", "comment": "Malware payload (Mirai)", "value": "4756c00dfa749f3fdf3a687a464632d692da370fd159c78b3ed70cad32192555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491027, "uuid": "14d8c8c4-b5f2-4828-8de3-77e538e422ce", "comment": "Malware payload (Mirai)", "value": "5cb813316b5f476d14ba6467b8e72c263c533095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491027, "uuid": "bd582f59-e1d1-4eb0-a306-25c7ecab6d6d", "comment": "Malware payload (Mirai)", "value": "8f1c7c7a06c903d4d1f91a15eb3724ed83c27dbcaf24c1c8f013f6a9dcbf4e3d32dea25e34e47838c147cd35d1326305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491027, "uuid": "d025f12c-576c-4303-848d-aa5f0ce7abc7", "value": "T11703F16095492438DB701B3BFDAE06D27ABD2F78C5BC7293920D942CA8CE61147BC897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491027, "uuid": "7892cace-3c87-4899-b6de-2bd9ceaa0174", "value": "768:hiEBFQtTh/C/6fPMLQoZ2fTnZH2LyRN43O+R9q3UEL2l:hJKTh/CSfPHDfB86WtEL2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491027, "uuid": "4bfee2aa-59d9-4faa-b979-0381f5f0c035", "value": 38060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491027, "uuid": "d1d41658-9c9f-4907-846e-01ec6cb9583a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491027, "uuid": "acec580f-5516-4138-92a2-e9cba095c6d9", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5855dd72-8398-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1784482576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482576, "uuid": "7a043da5-3083-4629-b384-89d85b1471c9", "comment": "Malware payload (Ladvix)", "value": "ddd137fd6121014af73998200c087485", "object_relation": "md5", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482576, "uuid": "f3137866-2b6a-4ff4-aedc-d28b1691f00e", "comment": "Malware payload (Ladvix)", "value": "487205fb99f88dbe3ce1310810dfa116af9281bd3b9110c343f26c5e7216854c", "object_relation": "sha256", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482576, "uuid": "f2770844-6e06-4e26-aab2-a06b1b95fb00", "comment": "Malware payload (Ladvix)", "value": "b798000f241a91bd3531aadafe7bab962ef2555c", "object_relation": "sha1", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482576, "uuid": "646e7ad4-ee67-4c74-b815-87bc2746edaf", "comment": "Malware payload (Ladvix)", "value": "579b68b5b0de190f76a7ccc2de4d63e86bc146dd8d19a53739f999b1b5d127eb2f1ac9afadee8e4d7dda928857ace71a", "object_relation": "sha3-384", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482576, "uuid": "84976ad8-38d5-49e5-8f64-f8cfcaf0165b", "value": "T132955C5BF2B364FCD15BC030479BC7A3A835B4A512313D3B6684DA351EA2E601B69F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482576, "uuid": "070d973b-44d7-4b11-9b12-71a2b753d03a", "value": "49152:63lN5/4fGf81DNVGXTIRJPGC4RLThPxqoy:8lNJRUDNXgC4RLxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482576, "uuid": "f786b20b-b20e-4537-8270-a7a26579c49a", "value": 2045591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482576, "uuid": "e0dc8f2a-e1ad-4c8b-be92-2b0570d40309", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482576, "uuid": "989fb2de-9a4b-4ea5-aff0-660036f824dd", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc52b536-8339-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784442049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442049, "uuid": "44bfa180-e968-4375-8c1a-45657b2ffe3a", "comment": "Malware payload (CoinMiner)", "value": "1acba05841862954122086449b034dc3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442049, "uuid": "a69a0cc8-eb3c-4fcc-b1b3-169fdca3b5b5", "comment": "Malware payload (CoinMiner)", "value": "48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442049, "uuid": "2e1b23de-e162-4b28-87c7-85f6c2730826", "comment": "Malware payload (CoinMiner)", "value": "02a2e35700b64fe7c5a21d820e6c8690b5e9892a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442049, "uuid": "0364a2d7-4496-46e1-8118-22c3208379c0", "comment": "Malware payload (CoinMiner)", "value": "0e4fa78ed28bb1c2aee69d99644d32696fa34ad37c2ff03cd573fafc42e561ee253728a66fde951aa0d1f39778cc19ed", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442049, "uuid": "923f14ee-f7ea-4c98-91e2-b320dd33da07", "value": "T130367C88E793E0F0E65308F0559BDAF761305B355053F6F2EB8A6B65B4323416F093AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442049, "uuid": "a414d184-2132-4246-af60-52bdb392d1ef", "value": "98304:ial8QeIviTsWm8F4CGNmyXP/WOkdWeyAFgyTKA9YScpOK7Q5X:ial8WBUFY/cWkz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784442049, "uuid": "57f9098b-77e7-40b6-92c3-f462eaa977e5", "value": 5107292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784442049, "uuid": "5d74478c-29f9-47f8-88eb-b92d4fc82af7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442049, "uuid": "473142bc-358a-4901-a3b7-874fc8c5f967", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7bdc82-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490527, "uuid": "1c72c5e2-b377-44f9-9b1d-5c1f6fa50f4c", "comment": "Malware payload (Mirai)", "value": "5f12439cdfb1bc6dacc2e99defd43e56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490527, "uuid": "7ee53243-2acd-4b69-b270-f3b88c3ffd37", "comment": "Malware payload (Mirai)", "value": "49332eaa138eee74fcd2da90b85b9026420fd88668aa1b811721f2f797aae860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490527, "uuid": "94b9e714-235f-4c85-8bd1-d53ab15b803b", "comment": "Malware payload (Mirai)", "value": "0df711a39ac10dc68816e32cf9ab236418771e6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490527, "uuid": "c09bc43c-f086-4c3b-ba20-840f0e299388", "comment": "Malware payload (Mirai)", "value": "7b647ec274e5a4faab3232846306a274813c1d57206161e0a102deaa80607f1aebe5d4043bd745ce3b20c35d16a3d464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490527, "uuid": "d098ccf2-0209-4e96-b88f-33537f88f275", "value": "T1773301B2A3046670EDA63835E03E8A81DD249BF1D37F27B3B11CE661D1C254E36692C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490527, "uuid": "7e88a340-d374-4891-953d-15b2342e9356", "value": "1536:eRWNXrrxcBdFYkYK7gvcTctJPwt6r/pfV:eRWNXrrx6XY9cTYP5rBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490527, "uuid": "4b2e5a22-e01c-49ac-834a-ae3c385de2d3", "value": 54352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490527, "uuid": "ee6c6e9b-dbd5-4e27-8ecc-1a06befb121b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490527, "uuid": "1a04a175-be61-4677-b720-1894f563081f", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e18c0e-83a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488365, "uuid": "e8a3ead1-2d80-44eb-8ece-f4feaf0d6e31", "comment": "Malware payload (Mirai)", "value": "2b17285634d70eda4d538b04592f16aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488365, "uuid": "b99e3b22-34f4-4c11-a240-24ae121ae07a", "comment": "Malware payload (Mirai)", "value": "498c4448fe92aa128ace9a68ef271660deb690d9be2ebf7d5ecceff4508d77da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488365, "uuid": "a5ebceae-ca65-452c-be47-5aad4fb46383", "comment": "Malware payload (Mirai)", "value": "c22f2f782ae1d4d928b018672224a936c4075a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488365, "uuid": "e2302c6d-5465-457a-a025-e315aa895975", "comment": "Malware payload (Mirai)", "value": "a511593e50e8bc1ab714b8e1bea44f24ea899876b53f8b7df41141f6788103ff1e3d4cb06deccc3ab8e7c3a3d18b18f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488365, "uuid": "26fc0553-f6e9-4ba8-8d54-ef64349e8210", "value": "T1FCD3CFCBB7A724A1C45343F047CB7B8D2E932211DF9BA4E76D0E657B54BA0EB15123A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488365, "uuid": "f41730b0-4399-4733-9f66-5dafdaf56085", "value": "3072:XpYRp1uJHECO8vgH6ZQG8vuTGQAWE87L6qG:Xs0EKfZBdTbv6qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488365, "uuid": "a93731b9-d683-4865-80d4-8286d3ce5cf4", "value": 140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488365, "uuid": "9eee2d36-d45f-4444-8346-8d130081bab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488365, "uuid": "4bb142f6-300d-4d5b-8cc1-f5ce17043bbe", "value": "ohshit.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1386417-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490107, "uuid": "763979a3-9488-49da-a4a7-813913e79323", "comment": "Malware payload (Mirai)", "value": "201954a3db36e2934f11f231ae793ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490107, "uuid": "dbe73f61-21bd-4a44-b545-d80ccd0dd429", "comment": "Malware payload (Mirai)", "value": "4a9d4dffb3463236968e30d962a619839780b8bb15415d2adbf598cda2499e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490107, "uuid": "a09df2db-bc3d-493d-9cb6-908ceac71e18", "comment": "Malware payload (Mirai)", "value": "33da98cac22ee4b021f328105acdf3ffcf16f227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490107, "uuid": "ba243c42-c58e-43e1-9344-03e7c35d53cc", "comment": "Malware payload (Mirai)", "value": "f3b6bd5cb2d10938de44c95143b25a67333f15f40329331c7ce16a762a54bf8196c39d70bded27033e44c2cd60c49a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490107, "uuid": "b8861439-efa7-4d7f-aa2d-31d91d9d99b4", "value": "T105C329A9F890DE52C6D52676FB5E018C33231778C3DE7106CE149E347BEB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490107, "uuid": "dca525ea-ca8d-4690-88c8-fe0b1804950f", "value": "3072:gXLoVhpUaVm7MF0iIbRcYEEUAPYMWpNwhe9wq4XynNJFpqtuKf1DlP:g7sDiiuRcYEEUAPYMWfwCN4XcIMK95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490107, "uuid": "0a484a0e-475c-43d6-b2f2-e6399d8ca129", "value": 120240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490107, "uuid": "ba2c4d15-01eb-4a6a-990b-f10af713d5ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490107, "uuid": "958ee1e2-cee5-459b-a4b1-0df8e76ff455", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247f8847-83a7-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784488932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488932, "uuid": "8e978767-7397-4ab4-806d-353a624a497b", "comment": "Malware payload", "value": "1692a4e3cdbed11a2e40fae6d3a42aa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488932, "uuid": "c3d07629-9035-4bc5-b2dc-e316f88677d4", "comment": "Malware payload", "value": "4abded0a7e30e35447f5253b85042cb0b4789aaaf2cfd092845aae5615790f66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488932, "uuid": "ad293b06-c372-4cf8-ac9d-44b55376d1b8", "comment": "Malware payload", "value": "41a95ff529a5a7786edeee5902288538720bab28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488932, "uuid": "7dbd432e-816e-4b13-9144-58bf5a5be2bf", "comment": "Malware payload", "value": "148aa4e6bfe0d24483029d404afd2a814fbf44b9aabcb7327e241cc311823dcc9ebd33e1743efa1f40cd7f077fda9bd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488932, "uuid": "f51cc73a-5e71-454e-b2bd-d1d019e0a313", "value": "T1981633707A6B114D6921BADE8DC117EBF9293DE84B6CF504A1FE26A6F0335C33D28521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488932, "uuid": "3ba1660a-6bcf-41cf-95ef-4fb5bd2a8633", "value": "98304:HwIqp75aznmEUmk8/mn9/LxrfOgvI5x0ot2O0/:QlaBhk84htfDI5/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488932, "uuid": "af4be0f9-10a6-46ff-97d4-90950b0d4520", "value": 4044056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488932, "uuid": "2b0bd5d5-58ad-41d7-a4d5-663746b0e932", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488932, "uuid": "4c98bb08-bcad-46c8-918f-5f2cfbd75aaa", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39c6dd7-835d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784457362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457362, "uuid": "41d13f5f-dcc4-4ae4-98d7-d096603cda5f", "comment": "Malware payload", "value": "48c8bf0139135581ceb04e3cc7478ddb", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457362, "uuid": "3697be0b-307f-4fed-9b10-e2f123e6ba41", "comment": "Malware payload", "value": "4afb96cc7c7c1e14e2da361d8948607add1896a057d245567ca132829295cc54", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457362, "uuid": "e4a6d0e3-f931-47be-884b-d01b21c48323", "comment": "Malware payload", "value": "1ba1317fac1ccc054d4457f3de71f8d827ff03de", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457362, "uuid": "a069db40-bea1-4d02-a196-49fb0361c15c", "comment": "Malware payload", "value": "083249ec65554fd8c36236038d9b691cfe550c750e056a7e145893ad5a5221049973578af861374623692d675bbdff75", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457362, "uuid": "4c2c77a9-518b-4c2a-a79a-ea2ff9c0f3ab", "value": "T110F7339043958255D1CB9FFC617F0AF3AE261DF0732AA0AF46A24872F5D58BBC58814F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457362, "uuid": "ecee4c0e-e7ba-4ae3-a4ce-3fb0c0047d78", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457362, "uuid": "f366df1a-a2bd-4f8a-b13c-47b093b77e90", "value": "1572864:nLdkG/IUU4FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB767:n2GltaABZVPArg/bXeB767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784457362, "uuid": "27f0823b-2b15-49b2-971c-f2ad05441e72", "value": 71513896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784457362, "uuid": "9898620e-6c2e-4afd-8693-1d57193f0943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457362, "uuid": "8dde76f0-ddc7-4f3d-b3a7-b7e03a1fd485", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a8730c-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490039, "uuid": "925b976a-cdff-4582-9e94-b48fe467c00f", "comment": "Malware payload (Mirai)", "value": "2991bf412edef2d7ec881fc99e015ba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490039, "uuid": "6d749279-45a1-4cdc-b5d5-6677843c05b9", "comment": "Malware payload (Mirai)", "value": "4bb4372715d1d8509a646b71e9c1e47421f7fdbf3322618ae76a7639fe19cdc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490039, "uuid": "4d38bead-bcf6-4715-8f2c-881fc6312327", "comment": "Malware payload (Mirai)", "value": "babf60f266608f66cf0b261283420bdb119bb536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490039, "uuid": "87ba86c3-f571-4e96-baf1-a2f7c890c73f", "comment": "Malware payload (Mirai)", "value": "35d34f8df137e30f4e44ed56d700e72815b514890ca52b8d8c74d3f756b47200c52e1dabdc3b1868fe7422786b9fafd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490039, "uuid": "7257cbd7-946f-46cd-b52b-e795563d04e3", "value": "T15FE3085AEC819F11D5C526BAFE5E7189331337ACE3EE7212DD244F2523CA91B0E7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490039, "uuid": "da764113-8424-4f6b-b5af-b6f1e176697c", "value": "3072:21gzboBQibDwoag5S+huJr/fNhdSy6zapZas/DfP6G1ulSTnhdXWpDV:2GvoBQibDZag5S+hu9fXd8IZas/DfP6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490039, "uuid": "3b486996-d1ea-4cc6-b338-fed017a65c8d", "value": 153108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490039, "uuid": "26920303-f5ed-425f-b8a5-2fed85613100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490039, "uuid": "5dff9fcf-8c59-43e9-af2b-ee53ddde7437", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca10e6a6-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494363, "uuid": "d9160231-b82e-4f2d-b80c-18283a087f6d", "comment": "Malware payload (Mirai)", "value": "9eff30ca7aca4065ad5fb1b5dc0af4f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494363, "uuid": "a8037091-273a-4038-8e5d-4bd093d2dc31", "comment": "Malware payload (Mirai)", "value": "4c73ada5e56bbaaab427c105b513e39f62784a87862642885a6b477dbbc2340f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494363, "uuid": "03489abf-08a4-4882-8e0a-e6e7535f0452", "comment": "Malware payload (Mirai)", "value": "3af6cef4f4356314b7845f508a1b04d5531fae93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494363, "uuid": "bd25831c-df12-42a5-a83d-689fb60b54b2", "comment": "Malware payload (Mirai)", "value": "594d99d7d040c9c7f6925d849cfe326a28375365d5282ba45454259a4445452d3e25e2a6904851416f7c17a0464c574c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494363, "uuid": "0cce1f2d-7938-4a64-8299-bc94427f1de3", "value": "T1CF04184F7720CF21C729C53045B3CB9656F926522BE28849F35CDE086E65349A92FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494363, "uuid": "c4f4ad04-a067-4ae3-9169-21a42e9f7519", "value": "3072:rqchivCd3Uv4xEpor4pdQ8vdk0ruYu4daB7h2EqJFfqQ1DajM:uA+Q8vvru7PQV5q2MM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494363, "uuid": "7cf640be-a236-4e8e-bcc2-4e9255768e0e", "value": 180928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494363, "uuid": "b8e1f960-4aae-4ead-9594-632b94d0a1fd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494363, "uuid": "89bfc01d-9ec8-4a11-b46d-d1669ad8a53f", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a589f9f9-8365-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784460801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460801, "uuid": "745a1b1e-3360-4337-bd9e-87c7fc97d470", "comment": "Malware payload (SilentNet)", "value": "02f4c69567902d3eff32e611f1138054", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460801, "uuid": "d840dfa5-b2da-4fa7-b150-f44c27f30a94", "comment": "Malware payload (SilentNet)", "value": "4cbfb6caed8357f803dfc00600f778b53624f0b84964cfc8bc77b7854bedc0c7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460801, "uuid": "6824091b-f2a3-4811-9a4f-60ba13bf0563", "comment": "Malware payload (SilentNet)", "value": "75916940fb75726ace2a3af791d4191e24e35200", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460801, "uuid": "6b13a353-06f7-4efc-b0fd-126c0cf1ff2b", "comment": "Malware payload (SilentNet)", "value": "c50e03dd8c7b2397c0315f8ab982964c73bcbb4658c343811257ace0b098e361c62c1839efff83b18f498ade91ddabc4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460801, "uuid": "e44c64df-bbb0-45a7-af70-ffd7bd5c486c", "value": "T1843633DD05819C45F1043F920E81D6AFB4E5D56D8BE2A6CA1C5DEF22F7FAD8C21B0922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460801, "uuid": "6f2df6aa-85ef-4ee1-ae9b-221f5e38806e", "value": "98304:IdHgQn6EN5wjB//AogrT0l3ltdLk1UXwUeWU9glNG/V7jfzzucDll/XDG:ICA5qnAogrgl37dL7wDWUeGBjnVDll/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784460801, "uuid": "2a8034ed-8f70-49cb-b8e0-1754401e1008", "value": 5067135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784460801, "uuid": "73929c98-3692-46f8-8572-9688b49e5fca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460801, "uuid": "c4fc855c-c191-4269-90f1-12f59ba81587", "value": "Krypton new.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618a2397-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477867, "uuid": "db6ad06e-97c4-493a-850a-c4e9bed90344", "comment": "Malware payload", "value": "bc3b1690b8bc9fe93bc572046bf1a9d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477867, "uuid": "274b3d9c-3b6f-4672-b038-ff82fabfa336", "comment": "Malware payload", "value": "506759205ffd1b94cd599775c6dd6530574a58a41a8b9f2113faa0b6669de6f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477867, "uuid": "2391b7bd-128c-45cc-9948-5a5e199a1db0", "comment": "Malware payload", "value": "d747081981181db493daa99df3214002fea4fa8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477867, "uuid": "c1592d57-ac5a-4be3-84ca-ff9b66897819", "comment": "Malware payload", "value": "a76cb2d1d746ab02ddcf780249dbabcc70a7c2dd22fe05e88957c2419b6e7e2f371c415ccf9eaeb056cd3f243ba88399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477867, "uuid": "256e075f-063e-4c74-90f1-03175def93dd", "value": "T17B357D5AF2F374FCC067C030435BDB62A835F46511226E7B25C4EA352D66EB01B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477867, "uuid": "87dafe3d-9af4-4286-ac5d-264d9b091ddb", "value": "12288:9KT2ZktG44oWTCY3Hywk3oBbq5ky2CTXXwEmyRZGTRjoVw4DJ25kW:9KeaG44oWTpHtuoBbCkyJTQh1qDJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477867, "uuid": "eb56c3e1-9dc1-4097-81ae-ce8af914dbdf", "value": 1058760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477867, "uuid": "69225216-4730-4fb4-8742-faad8a1fe3c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477867, "uuid": "ffd1869c-1d44-4da1-ba92-949f3def3cc0", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8237ff1b-8313-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784425523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425523, "uuid": "a2360b55-1f19-417d-aec5-444139264c1c", "comment": "Malware payload", "value": "98cf266493a57fd79a02943aff61e614", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425523, "uuid": "8b1ade0d-c2a8-4523-b53c-acda438318f3", "comment": "Malware payload", "value": "50f055e3b6662ff9f81a04eef52092b644f1617b9d0d9e6bc3f1f1deca01e3a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425523, "uuid": "d928e3b5-8f2b-4a56-ae36-2b6a1331f742", "comment": "Malware payload", "value": "22506172fe7f135b83d228110f485986722f2c6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784425523, "uuid": "1138fc6c-18b1-4fe3-8f66-47260fc05944", "comment": "Malware payload", "value": "8734de1e3cac57cc813c9ae3fcd13464002bae143c3f852e4b5c03e52b65d35b5812907b11fcfdf86a4e042bb557b4f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425523, "uuid": "e79cde93-b0e7-499f-9989-d9c41cc6a296", "value": "T12B8533C09E17CE6A9FC7BCF4E7A7D2780555F325036CA72AAB7E103D202805CD475AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425523, "uuid": "352949fd-8af8-48c7-815d-3f8220e0cd79", "value": "49152:t7c6QJOue2Sltv2i66hVtMPzEOp5BHGUf6zZ:t7T2SlJn66h6zE2gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784425523, "uuid": "8f9cee04-a7ba-4a41-aa72-dd129a72dcc7", "value": 1743900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784425523, "uuid": "53fd288f-9bb8-47e2-902b-51b8c45ad677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784425523, "uuid": "3a121659-772b-4227-b8ce-e976fe2be93f", "value": "riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d2e89b-83bb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784497601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497601, "uuid": "b75ab84d-0933-4c54-a90e-4a0537405924", "comment": "Malware payload (Mirai)", "value": "d2567790fb43acf9e15ea987d2ef1c1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497601, "uuid": "01b8e37b-7966-49f1-b535-81c319023ecf", "comment": "Malware payload (Mirai)", "value": "50fa67706d725e7a22247a361c6d6907eab4633c20c471705cae8b10228627f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497601, "uuid": "948b1e2f-26f3-4c7e-8558-f99c0d75bd49", "comment": "Malware payload (Mirai)", "value": "d0897e85582aee9929e63bc0b5accbadffd75af7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497601, "uuid": "fab21d14-d50d-4ca1-a4d9-167a1fa4f132", "comment": "Malware payload (Mirai)", "value": "6f03b96e00940bb17901ee3acfd2ac335acff9b5fc1c193463e22858e32a348706884fb56b1bd2d64a0a114766b209b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497601, "uuid": "614981e8-ed21-4d40-9d31-e473ab85d044", "value": "T123A32A96B881AA24C6C1467BFE0F118E33135BBCE2DF73129D145B6077CB56B0E3A916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497601, "uuid": "072d5a22-553f-460d-ad91-ab2ef7a7266a", "value": "3072:p88HoCuXoD1GgnI/8JPQFC33Xvaaax+WERGPsaVlCEwuq:phHXognI/ePQg3nvaBx+gP32+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497601, "uuid": "a8fe3094-b6f4-4cdc-9ba6-2c2b3a3ef0fc", "value": 104688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497601, "uuid": "59465d3e-7744-43d3-b87f-f79f88d5e202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497601, "uuid": "6a44e5c5-4e1f-4786-8dad-1283898db824", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230e4cb1-83ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1784491506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491506, "uuid": "e5473a78-8d12-4e31-8f8e-2c84b45b796b", "comment": "Malware payload (AveMariaRAT)", "value": "148ee6bc7028182efe69d87047f0a7e9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491506, "uuid": "d7515e86-cac9-4766-87c3-f73e2884ef81", "comment": "Malware payload (AveMariaRAT)", "value": "5155d941fc16d359553f446fc150a95bcf2ca4700e4aaf3ceba975d3b2162d76", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491506, "uuid": "7437c0de-10b0-4166-b31d-52792f4d5153", "comment": "Malware payload (AveMariaRAT)", "value": "27b13cfb5b8dfe3266258bf74c3f14761093311b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491506, "uuid": "3770a3f1-9460-4dc0-ae47-e7d4137ea761", "comment": "Malware payload (AveMariaRAT)", "value": "6a53f11a160bbe11be1749225e1a606e194b4380caf28fd672370d07dec88448fb0766ebc85b3c9879e1f21a1aa73100", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491506, "uuid": "dcd79ed5-a422-4c51-bbae-840f0d8746c6", "value": "T1D894CFCA63C08D31C9569E3480302E7803379F463E59F246ED68BD7337B7ADA2866597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491506, "uuid": "84d75a05-9a58-4b1d-aa79-73c03fb0e622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491506, "uuid": "ac1be1cd-39b4-4ee6-b6f1-5d9c208a88d3", "value": "12288:C/bSajBtt83yT+rZugPSe0Mz+N6mSHCcR:C/bhjBgyIZke0A+QUcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491506, "uuid": "5145f1a7-ea84-472d-86d9-78677e64ebe1", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491506, "uuid": "40efe1aa-4b0b-4c6d-987a-fd9743ecee75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491506, "uuid": "55b4204d-5bcf-490c-8268-910b8001507c", "value": "148ee6bc7028182efe69d87047f0a7e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7176634c-835a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784455989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455989, "uuid": "207ec7c6-6008-470b-be20-8430e762b6d7", "comment": "Malware payload (SilentNet)", "value": "df38e902b736cbc534e356a62f7e2d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455989, "uuid": "0d0aa016-41d5-47a2-b976-cd356d0af67f", "comment": "Malware payload (SilentNet)", "value": "53bdb4aa4dfafe97c6edcaa5fcc602481d87c851c33bc438d404424467a99d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455989, "uuid": "dd906bf4-9916-4ef6-ada7-48e9fc26ca6c", "comment": "Malware payload (SilentNet)", "value": "4fe831111019dbe84cf6a947d6c48c09ed26504d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784455989, "uuid": "589d75e3-b5cb-47a3-99a7-84ca13d661c3", "comment": "Malware payload (SilentNet)", "value": "d3a2aec4b9ba3d339391a10311096070f00c81937bd240c891f8c9753f875c3d52864f197eab89e861e7a5113732012b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455989, "uuid": "34e9675d-399c-4e1e-85f3-2c6075ef3d35", "value": "T17E357C83EBE385D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455989, "uuid": "900e6aa0-7392-46e2-b355-23eeac79127f", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455989, "uuid": "42ed44c4-35c9-4caf-936a-61c6cc2cd157", "value": "12288:YZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGgvPqItNquB:Ycb4M06WpoPrwbvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784455989, "uuid": "169d5bbd-9d0c-4c53-a2b9-3ab2a70ac96a", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784455989, "uuid": "ca2920eb-6269-42cd-a64b-c431719b0065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784455989, "uuid": "926da181-070b-49d3-b080-cad08636419c", "value": "Hackclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0505b77f-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784485872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485872, "uuid": "18f9965c-752c-4ce6-bda7-c8b299acebc3", "comment": "Malware payload", "value": "44b9d79b6e9cc0976eb97fcc36bb4fde", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485872, "uuid": "a9148cd5-0fbd-4e65-a6dc-8ac8917364ae", "comment": "Malware payload", "value": "5560d5e1e38d38b28a49cd14938ab685fe090d399f461e7052bdcc416f2ecc3f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485872, "uuid": "99a88388-4b1b-42f8-aea3-56b80014221c", "comment": "Malware payload", "value": "a9a7f01a17851756e50c0db5e1452d29688ba242", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485872, "uuid": "fb807a14-c4bb-4c8a-bdfc-578991951cb6", "comment": "Malware payload", "value": "89da53e883a7c28afabd87bac022f9fab31eec3eb43e1d3b94681cc4762763e745af24a8c09b65477d68674a02c5f521", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485872, "uuid": "6a0cb88d-552e-4661-b18a-441cdfaee2fd", "value": "T1BCC27C956A867C44BEC98A3E4CBD2B0D6DF5C3D1224952AC3D8B3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485872, "uuid": "d3f94e76-bd78-42dc-aa56-091796ec77ed", "value": "768:68vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:68l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485872, "uuid": "81e6bade-df4e-41e2-9d91-9ed397085984", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485872, "uuid": "42b13e37-10ae-4b55-9bce-9a15cc7ab749", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485872, "uuid": "3ebcf009-0ca7-4206-9dcc-46cb0e4583ef", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d13e523-83b5-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494932, "uuid": "5ed07d8c-830e-47bb-8130-3914026d37be", "comment": "Malware payload", "value": "9e52c730d1cb38163d1dfac9f2dc1ed7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494932, "uuid": "27392616-c93e-4219-8d00-fafb27be4577", "comment": "Malware payload", "value": "55edc1a2ba23130219567ce38ffc6afa4c9bb9e1088b0d52cdd8b988fad71bf5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494932, "uuid": "9ed9a487-f99b-4e54-9bec-8c39af5cab70", "comment": "Malware payload", "value": "f91ac321a97b21add1e1da5dddd37e0afba32763", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494932, "uuid": "0381043c-bacb-4183-ba81-13e614a16bef", "comment": "Malware payload", "value": "d1f6758580b9104a1ebdf05cb570e75a32863158ef581ceb2c69d11ff4fac97a3b503c7bcd77d62b90ad74306f289485", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494932, "uuid": "3dab8c3f-5e3d-4f38-8f01-896aaf19d809", "value": "T162C28D956A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494932, "uuid": "8c7361d0-f65d-4566-9dd1-154789f45942", "value": "768:M8vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:M8l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494932, "uuid": "f4aecdad-1954-4b0d-965d-28469470962f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494932, "uuid": "bb5f5a43-5444-41d4-9f31-2b40f91fea6f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494932, "uuid": "d978bfe6-6a85-4c78-9146-2c95b483e741", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d041cd6-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445298, "uuid": "a2184fbb-b7a9-4fcd-8398-29d2d2c67eac", "comment": "Malware payload", "value": "d2275907e0294f4f15ea53476d0df497", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445298, "uuid": "a65e4439-225f-4bf0-82a7-e5c2636e93c4", "comment": "Malware payload", "value": "58f45441bc2e9b98470a8548f20a68042265aa4a875c099f65989aa9c065fea8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445298, "uuid": "d4f33718-dd54-49e2-9554-4974babcb56a", "comment": "Malware payload", "value": "9626534291d04442b2f65c6186f50f4f352dc971", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445298, "uuid": "78c50d1c-b31e-497f-8583-15550319a4e1", "comment": "Malware payload", "value": "357027b6c70b79e0b3ac447fe15818f8a028d3c8dbf89a7cb9fb38085aec0463d8b05ba7fd8fbe198ed6a4d14aba8bca", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445298, "uuid": "bcf1398f-6845-49fe-8826-c420b470e4a7", "value": "T19E077C85E79809D4D066C634C95A8732F6B1B8760EE3824B0754C71E2F739DD8EE7E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445298, "uuid": "33fdf66f-5fce-48f0-9fb4-58b495619e85", "value": "f469ac0906218570f79c54d1b58dc057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445298, "uuid": "50627489-64e1-4db5-9056-b5405797b900", "value": "49152:fb8ap1Tn9ByyPt5nGi4fwGEGzgF4+FuzgiHYA8C3gLIwUtkT23+gD:ftbhfCLL5w6DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445298, "uuid": "f2008d21-e1c6-496e-bdc3-389a1dea9918", "value": 17220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445298, "uuid": "3604ab8d-3e8a-43a4-97f7-f322dbbb48e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445298, "uuid": "27cf4183-69c5-40c3-acec-71d05c2bd1ef", "value": "winsconsx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5921eb0e-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485584, "uuid": "abb8bc02-4446-445d-bcb0-8a8bcc04e321", "comment": "Malware payload (Mirai)", "value": "edee4bf5d7bc2a3cf54c3f79a0e02793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485584, "uuid": "afc6fabe-136f-47ec-b767-c5389dbb2ddc", "comment": "Malware payload (Mirai)", "value": "59f00a1a1de59b99245241493d570ea077476edc4d6298cf3c2657e8b2c12f1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485584, "uuid": "c8ba9923-fb30-40e9-8062-22b4e6b1e864", "comment": "Malware payload (Mirai)", "value": "c592e5a6baa69c3ed635c4bf29bf8a9aa25fc6ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485584, "uuid": "296f2df0-bf27-4956-bc73-c6990d9ba3a6", "comment": "Malware payload (Mirai)", "value": "dcdb23b413926f1e54f66af6f3f5df31f99ff669e6dc247bf0c9bcdf8078f0d02f6b8711133286830e15f2a7ead9d875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485584, "uuid": "404254f4-5cd2-4745-8a1f-a60bcf6622c6", "value": "T1D9E39FA49A0FAD83D2C3E3FEAE590FA7303734B04511D1F75D00A69DE59EED988B1522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485584, "uuid": "695ca0bc-8867-46d1-996f-988cb4bf9953", "value": "3072:qg7+cTgyZhNsqvnC2/U4ds01FNjwvE7ElIhbgBsKhRcLz:qcff13b/Rds0jNjho6gaKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485584, "uuid": "261ef4fd-4297-4b83-927c-57666a40b482", "value": 153464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485584, "uuid": "d150e563-a431-4c1f-8eea-db21bea88106", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485584, "uuid": "92b5421c-402b-4248-8875-b274e9350ef1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd6d1dd-8387-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784475153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784475153, "uuid": "79445e66-7fe7-4cc8-a7a6-dd07acfadc57", "comment": "Malware payload", "value": "0da2d10996d5dca7b20734009ae0c762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784475153, "uuid": "4d68cc38-528c-4727-b8f7-470d9e39152a", "comment": "Malware payload", "value": "59f4701444485e6a5315890d7121a8ad76848ac9cf6c05bb5dfd3b2e65020677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784475153, "uuid": "2572d460-21dc-4033-974c-6a75e3db0769", "comment": "Malware payload", "value": "e87310e30442f9a9dfdd5305f6d4ec7b2bce651d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784475153, "uuid": "8f6fe235-535e-421c-8459-866a701cae40", "comment": "Malware payload", "value": "b9c0d36826af712eccbe0f28383d16acae5997dc49fc413e829064b2d29cf12917fe0a5340ded688828891c5345cde3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784475153, "uuid": "2bbdd93f-429f-4954-b38e-735cb739173f", "value": "T107665B73905614D8D1ADC974D5152213BEA8388B673873DBBBC076F11BBABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784475153, "uuid": "68218ff9-d551-40b8-aa91-bcf0f3593349", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784475153, "uuid": "556c84c4-182f-4b99-85d4-c73aa2be1d63", "value": 6914048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784475153, "uuid": "637bb3ac-3aee-4587-b14e-baa8521d9444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784475153, "uuid": "7fdd4937-88e4-40ba-9187-6b9019700dfd", "value": "59f4701444485e6a5315890d7121a8ad76848ac9cf6c05bb5dfd3b2e65020677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf37338-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784464704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464704, "uuid": "69c9242a-a68b-4b83-901b-893f87518be7", "comment": "Malware payload (Mirai)", "value": "e18b27c35ea3f6f7c0b37d87592520d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464704, "uuid": "047cffb1-3856-495a-9a4e-b6b08a381e22", "comment": "Malware payload (Mirai)", "value": "5a63fdc300f38c1dbe04514759a83ef5b790e2981d875412ab2650540246d1f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464704, "uuid": "65f8aade-5fb6-444a-9843-14f4837d9bed", "comment": "Malware payload (Mirai)", "value": "02f2531f99922a722f7a527cb506b14956a19749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464704, "uuid": "b2094a3c-6eb4-40b7-8815-af1f22abb955", "comment": "Malware payload (Mirai)", "value": "740f756b7bc034dd36bd092765eff1a3d93c0540e2aabc9086f06bb094eee220e19e6d949c19f63fe9f65a05ba3195c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464704, "uuid": "fad8a15e-ed63-49f4-b182-7c5178cd2670", "value": "T1C583024A8FABA935F95700F5CEE92D717C4F63392B85F8D81E1D041C2A6C4A53FC6624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464704, "uuid": "419aacfb-6846-4ec0-bbc6-93071d8fd25f", "value": "1536:/tydwI5J7LMAFWvvYw1NBrjk4QcrlyodH//WnvEOZHlanBpC2pcc5rZYXgzeQe5:/tGJbg3RdA4QcZyw3yvbRoBpDp55lYXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464704, "uuid": "af478677-46d7-48d7-bb29-d9b8ee1e0165", "value": 83156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464704, "uuid": "ad26da78-b7de-41ae-a8b4-a12d80b39a85", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464704, "uuid": "868868d4-65a5-4bca-a245-c3d1093c2dfb", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba55084b-83bc-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784498202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498202, "uuid": "d7a256fe-b16a-48bb-a144-541f78c05dd4", "comment": "Malware payload (Mirai)", "value": "f5ee25c5b2ad46869e6051b05fa33498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498202, "uuid": "af1069f9-db98-45a6-9310-e64fa6887f45", "comment": "Malware payload (Mirai)", "value": "5a99dfdf7905c92ed743dd1d5fdec044ad2fcb2ecee6d088a7349f7a719d552b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498202, "uuid": "bd176e56-f472-4864-aa2c-d3132b9104da", "comment": "Malware payload (Mirai)", "value": "769de354ed58edf0058a1050672956785ee67667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498202, "uuid": "b32ce12c-428f-4f8a-9106-3dbe671a7e37", "comment": "Malware payload (Mirai)", "value": "77fa049e35c6a71266077a473f0ad6f5302909aa33b5fa3c605e32b322ec65104f9ed1ca17cd9c11444b6eccc1d42d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498202, "uuid": "bfb8bc0c-06fe-4eb2-a848-4763194b6b92", "value": "T10FC37BC2B10D7EAEE5932E7DC20617176E1C5E519C83410290B5FE532AB76E31E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498202, "uuid": "fccb902b-fcaf-4689-b731-7c84cded7b07", "value": "3072:5groW5JrtBP0Py3HZRUyqsPTFESRvgWR6sQLLjyoK:iroGp0PKkyfPpzvgWEsQXvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498202, "uuid": "1f9a8f75-1aa2-4232-a328-a19d09260ba3", "value": 125296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498202, "uuid": "53f955b7-fba0-486c-8c55-e19014bc7c57", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498202, "uuid": "2a913238-7ad9-416e-aef3-188f7720a1e1", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee96048-8372-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784466132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466132, "uuid": "63dc43a8-420b-4ae0-b70f-70eb6d031205", "comment": "Malware payload (Mirai)", "value": "7c86bf055cd83dd6332176d60e9a5d9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466132, "uuid": "549521bc-ab22-40f8-aef1-c0da038b70be", "comment": "Malware payload (Mirai)", "value": "5acd598a6b8e3d6f5346dccf232b4c1aa5d542cf5818e7f6c29bff1618922855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466132, "uuid": "e8fd5e91-08b3-4b50-986d-3c560242dea7", "comment": "Malware payload (Mirai)", "value": "e5adc9e5d29dc0a15254e4d2c08889c0fe23c8a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466132, "uuid": "34f40bcb-75a2-4fb6-9f4f-c4d3323cae48", "comment": "Malware payload (Mirai)", "value": "49003a8884187ea769ed1e33d7098ef0ae1c29f3346e506cf248862da21e4ab6ad0b9f45f1afef3189d26e8bbbba8de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466132, "uuid": "c958fed1-a69c-4860-8b45-db8003feb32a", "value": "T1B94302CBE6099F39CE0699BD055CCC9CEFA49C5B5103930A4C5CB07D886B8CD7E66BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466132, "uuid": "bf2314f6-357e-4604-ae60-d5865ed5bc9d", "value": "1536:eBKZxyabFf02yBTsa/+PQRgxW/guPWuUFW4MnBC:eB6dbFZypH/+ygY/g6cFW4UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466132, "uuid": "08a9f49d-1e85-4913-aaea-f076387c4726", "value": 59528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466132, "uuid": "31d43c6c-e36a-4010-90e4-25ea2a192946", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466132, "uuid": "927bc6c2-d1ca-4187-8d34-2635197bb579", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c65b4bf-83bc-11f1-be1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784497937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497937, "uuid": "8f8d66b8-f180-498d-8cbd-7f6324770f08", "comment": "Malware payload (RemusStealer)", "value": "52f56cc1abe3ed2f437aaae0c74f5db9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497937, "uuid": "b18805f9-e3ce-4e1e-ae48-d4517a2811c6", "comment": "Malware payload (RemusStealer)", "value": "5f85e22acb86ebc9031256efb11af9f1eed58621312a0c0bf448fe699e809c92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497937, "uuid": "fc619555-7fa7-4728-8272-1fd74bc9dfb9", "comment": "Malware payload (RemusStealer)", "value": "196515f98d4a043751629ffdc6e4fc371391b5b3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497937, "uuid": "684bcd0a-3e48-4848-964f-f09540da35e1", "comment": "Malware payload (RemusStealer)", "value": "c51e35d0238fdde3f43a7148b0c8efc12a61db19c5d2122816e0a0dcb95c0a45602a65b66e8b6f62728143fb6273122b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497937, "uuid": "93d46e25-d752-4132-8d7b-a882cf4db5ef", "value": "T13DC54A077CE049E5C0AAA33589B66192B775BC090B3633E72E9077782F727D09E79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497937, "uuid": "89116bf1-16fc-4e10-aed8-318257045f26", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497937, "uuid": "0d0c26ae-9b17-472b-b7b6-28a2670a5117", "value": "24576:VpTdyJ3QrMFVmj1Efw8p8S2l0uVyTFNAJCQi1ZrSEtxJBele5r9DY7v7Skn0ih:VpTy3QYFUJEnp8S2hgJNECyoKSu06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497937, "uuid": "b23d5808-381a-447b-81fd-faf676b960c6", "value": 2513264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497937, "uuid": "a3661d58-5585-4958-afae-6e67a026a9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497937, "uuid": "65bcd780-171a-4850-8c3c-00ea712b4389", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f457fd9a-8306-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784420131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420131, "uuid": "2b5d91c4-e3d3-4449-91de-59816b0815ab", "comment": "Malware payload (WannaCry)", "value": "174ad172303b51111727aea63e9bdc0a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420131, "uuid": "df3dfd7f-f769-4535-bd2c-7a954be70a59", "comment": "Malware payload (WannaCry)", "value": "5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420131, "uuid": "cfb95d8f-be8a-491d-b579-1732a554331e", "comment": "Malware payload (WannaCry)", "value": "94cec0c0823f19023c283e73a4b7486113e02f22", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420131, "uuid": "52f758fa-257a-4885-8b34-ad5bb6de9895", "comment": "Malware payload (WannaCry)", "value": "858a895ce036880cc42066354015cb7ff716c75257992f4f0c1b760b9529730297e30c0c5c820adbe52f76465b2d652b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420131, "uuid": "96cb76d6-5ef3-4a31-bb29-0b1126067955", "value": "T1BF363358726CA1BCF0460AB444B38D2AF7B37C59677A8B0F8784827B0E53B979F94711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420131, "uuid": "59f024c9-399e-4224-a4ee-322f9ccc72b1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420131, "uuid": "4ac03821-f64c-41ef-ab83-f6cde5ad3cd0", "value": "98304:DXDqPoBhz1aRxcSUg6SAEdhvxWa9P593R8yAVp2H:DXDqPe1CxcuZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784420131, "uuid": "5e5fe81e-7dbb-48a2-8a02-94cca2d2269c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784420131, "uuid": "6d8999d6-8217-476e-bd82-282826692b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420131, "uuid": "c9c009fc-704e-49a2-8524-05f241dc61df", "value": "5fc07750ace241e22a7d63a5d5aff50815e975aa0084c285ccc7c514c58c09df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a19bd1c-83a5-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488055, "uuid": "f967fbd8-9014-4d21-98f0-5a976a673147", "comment": "Malware payload (Mirai)", "value": "11243dae7ef9e250dd9e3998ee55cb1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488055, "uuid": "74bea421-0702-4555-862b-9d0485eac2b8", "comment": "Malware payload (Mirai)", "value": "5fc29f473af01cc4c78c411f2c525499f4fe03b8a612bad446cf4381031523fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488055, "uuid": "6e513509-4b49-4620-a061-850637b1f024", "comment": "Malware payload (Mirai)", "value": "48aa89a26b0d8b04e38e2637d618ee72136f09d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488055, "uuid": "571068c7-5d0b-4242-bc39-9cd18f16e584", "comment": "Malware payload (Mirai)", "value": "b4eec0a1c9ba61ab63d10874890d1fe07dfa42a5a5630158f31e9084872eddf4d4c9a36253031dc1a6cef1e6a49e6d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488055, "uuid": "f4eb28c0-a898-4ae3-99aa-b537c2b9126c", "value": "T12B04184E7721CF61C729C53045B3CB9656F926522BE28849F31CDE082E74349A96FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488055, "uuid": "dbf03d44-da45-4dcb-b479-538c0abccc5a", "value": "3072:btWmp4i9Xlm58NJkkKMq+4V0ym54f15D0/fG1DLSjf:RNKMq6iN9sf0If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488055, "uuid": "94ac9778-0726-4a9b-bcc4-2e6a53ccc744", "value": 180928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488055, "uuid": "d3634b08-1ec9-4693-a10c-7363b5d1a6eb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488055, "uuid": "ebdc5f45-927b-4e8d-96ef-7af2ea1c0c6d", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2941e9d-8365-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784460796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460796, "uuid": "72ba824d-e7ce-4333-8810-352ad9b1ea07", "comment": "Malware payload (SilentNet)", "value": "ae615ed8afd31ca9ee39e53d2e6d9f5c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460796, "uuid": "d800ade1-f184-41cc-9f58-1a667c79196b", "comment": "Malware payload (SilentNet)", "value": "6297beedcc5c293c008694f2bf40261e60b7440bdb92f51eb5d0c22781134c0e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460796, "uuid": "c59cb107-05ee-4058-a58d-b8afc0b0a413", "comment": "Malware payload (SilentNet)", "value": "9361b4201245d563186107e665877f9ee25c2c9c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460796, "uuid": "6b6121be-eea1-421a-85fd-89cc387589ed", "comment": "Malware payload (SilentNet)", "value": "acfeacde30fe23518acd4743fa44d8fa47284e7136755497a7398e29bb257b00c704964ff2f8b58ff3ad2f5deaae4790", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460796, "uuid": "548e5281-75c2-4e43-845e-c04805927f55", "value": "T196A633F6E90A31E3F0192031A8104631BC15DAD57099231A7BEA5AFF6E0E4695F7C37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460796, "uuid": "aaaf5fd1-b24a-4d2a-8a25-a0d0b6938a6b", "value": "196608:X3uST47Ba2+YgkeW4Ns0O38A9pNiidiNq/UcvBu6OYjP5ANu:HEdyJs0OBRiNqd1jxyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784460796, "uuid": "4715fdd9-2d66-4ceb-b618-3c89b36fccd1", "value": 10036509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784460796, "uuid": "0819c8fd-703c-4a24-8cde-1292a7215963", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460796, "uuid": "cc3163a2-452e-41aa-bd2b-9f32aadea6f2", "value": "02-client-tester-injected.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a8bb8b-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Redosdru)", "timestamp": 1784467081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467081, "uuid": "3d6957f7-c39d-4a5c-a74d-fdbf19d97db4", "comment": "Malware payload (Redosdru)", "value": "10477973b66b41fae5e8334cec3e85b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467081, "uuid": "a29b546f-0d80-46b6-a654-48c40970eeba", "comment": "Malware payload (Redosdru)", "value": "62b07d9d1a68010bfdc39df0f22996c386162d53a328ab59a9becb1a30d1a454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467081, "uuid": "b16dab18-3e40-43ca-9558-c6c45bc48607", "comment": "Malware payload (Redosdru)", "value": "c6321a5075f7d3cb86f52a60c8644f01e92d9785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467081, "uuid": "3754d306-3b6b-4130-bc20-28d677e5225d", "comment": "Malware payload (Redosdru)", "value": "bd2da2607d77dff3215b063922816bee047f42a18d1e0a574879e5363afc5a356be60aa7dacfdfc716288762e5a9e465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467081, "uuid": "41cc6f35-07da-4c32-94e6-539db49aff53", "value": "T17FD4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467081, "uuid": "5c2725b4-e919-4526-ad8d-1407ac4e499c", "value": "f2b391a4d3eb9bd6a54cf7e0b90ea68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467081, "uuid": "b3c5d403-079c-4001-b362-7cad5604acb2", "value": "6144:VmBvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VSCJktEMm3WmmBiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467081, "uuid": "899a420e-9fa8-4369-befc-7be56fa6d718", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467081, "uuid": "91469daf-f627-459c-937d-4eab838ffd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467081, "uuid": "bb78df73-ca3c-4d71-9547-e64667a6f649", "value": "62b07d9d1a68010bfdc39df0f22996c386162d53a328ab59a9becb1a30d1a454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68121705-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486038, "uuid": "8e6b941e-0c21-4a8b-a04d-ca99e6c3c572", "comment": "Malware payload (Mirai)", "value": "f0eb02d7d424c4f7fbf48a74f7a5a9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486038, "uuid": "1243cc6b-6cda-4626-a8da-fd464d508780", "comment": "Malware payload (Mirai)", "value": "635b3f87384694ca954602b2e3ccf7732056833e8276ab80d8f3545ad420d414", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486038, "uuid": "81586400-7c8e-467e-b616-cc41b346d199", "comment": "Malware payload (Mirai)", "value": "0f43aed5349632680e04f7300c145b055175d5b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486038, "uuid": "e9b4c3a8-96a1-42fd-bbe9-74009d378ecd", "comment": "Malware payload (Mirai)", "value": "1459759ca37210e22dddaabf03f21ba48fcc0d882d5cdaf1d88695f5a59076fb553b6456ae9620b3de5ba15ec2e2cb3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486038, "uuid": "84b36cc6-52a8-4a6a-b014-97d27563a866", "value": "T16A145B46EA408A53C0C727B9B79F524633239765D3EB33069D18AFB43F8679E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486038, "uuid": "a599de5f-dc59-4960-b184-d578667375b8", "value": "3072:7RpNo3S5bkojm6unVMXazG3j5NEW5LduD8Ek9tCzh15TBVj8zlM/9Lpvx8:7RTIUbBmpViazG3j5NEW5BuD8XCl1NBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486038, "uuid": "0d5c3a5b-d6f2-4b9b-a8d4-93f95a4c3eaa", "value": 192624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486038, "uuid": "202bd2e4-f857-46a5-a0a8-a901cf204021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486038, "uuid": "58e9143f-957f-4f86-8dc8-5f3cd98ea5e0", "value": "ohshit.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd33e0d1-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489671, "uuid": "cf776696-8861-4885-a684-fc1e8eeb2300", "comment": "Malware payload (Mirai)", "value": "da707378b17efac4f2a35b396b7b5521", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489671, "uuid": "1177a65a-e966-4a59-9969-38e6c2d40d29", "comment": "Malware payload (Mirai)", "value": "640d998f393ab58183e50d5f4af714e601fd28f2678a87c8ea7d9f5c97988611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489671, "uuid": "9d4be750-3b76-4b70-8b26-04152408303b", "comment": "Malware payload (Mirai)", "value": "0f5b4c98aa5f98b10fe4d505684ce39963d3c529", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489671, "uuid": "104e2809-ad4e-4cb7-82f8-cc7b4b73898d", "comment": "Malware payload (Mirai)", "value": "55bdfdde702858112c0c9920a105879feb5406e7d64aa691e04f2b568f51b6e4f548de8f7e7e16cffb388878b84128c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489671, "uuid": "92a807db-4a31-499a-8082-89585b4327c7", "value": "T1AAE3E6C7FD01DEB7F40BE3B648A308057530FFA60D525A72726778AADA390D41467E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489671, "uuid": "bb1e76c3-304f-45db-8467-6497e72a1515", "value": "3072:+F2j+RioWS/AyzI2n1MkJmKVIjbiwLz84WJyu6pPaE:fdS/BzpPJmTLw4Kyuex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489671, "uuid": "641bdb2d-6584-4694-93ad-65a2ff9d68b4", "value": 150508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489671, "uuid": "a6fc3fa8-d285-4444-b23b-ac82f0763ab0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489671, "uuid": "a3cd7dba-b3c8-458e-b185-9f2fc2ed047e", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f08cc-830f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784423730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784423730, "uuid": "23a61b49-23e6-484d-84db-545b3d05f80a", "comment": "Malware payload (WannaCry)", "value": "9c5a2cc6f282ad609aa6f3a9f6a7950c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784423730, "uuid": "3a138ab1-6e54-4b03-83bd-24314e136f02", "comment": "Malware payload (WannaCry)", "value": "64f2828e5e89e4bc6ca46d799d6140f2fae9a0db324caecf74d39d785cdf8715", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784423730, "uuid": "470fb6b5-553d-4d1f-a770-240550ade710", "comment": "Malware payload (WannaCry)", "value": "38f0bbdf2d2414339505f527b369e591ba7eb33f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784423730, "uuid": "49413a40-f799-49f0-a870-74bce044e1d5", "comment": "Malware payload (WannaCry)", "value": "84bc1979e3a379e341747fb588fbbdb0c75489871cb6bfcdc82e4e8a94bab46e84c902c26bbe018c9b729b567f731658", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784423730, "uuid": "984676e0-83f2-4811-a229-21d671ce51e4", "value": "T1BE363358726CA1BCF0450AB444B38E1AF7B33C5967BA4B0F97C0867B0D53B9BAB94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784423730, "uuid": "8c9ff8fc-d3e1-4232-821c-6b88e2124455", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784423730, "uuid": "3d7d90e2-8e54-4eb4-bfbe-bd5290001342", "value": "98304:DqDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DqDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784423730, "uuid": "9ec79116-58bd-4cc7-8c4b-2afbd346bc3b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784423730, "uuid": "fdbc105a-c845-4110-a36e-ad98407d9428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784423730, "uuid": "ce707d12-747b-4b4f-b7e5-68ddf57681c4", "value": "64f2828e5e89e4bc6ca46d799d6140f2fae9a0db324caecf74d39d785cdf8715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f60732a-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1784445329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445329, "uuid": "4aa8538e-3958-43df-bd3d-cf98b1f5d8fd", "comment": "Malware payload (WannaCry)", "value": "6d9c7e5651890d5b5e431679f6037aad", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445329, "uuid": "503da177-b5ad-4c23-b80b-f1b8240b0ce1", "comment": "Malware payload (WannaCry)", "value": "64fa25e0e80a527b9caec41f68d96f696ca41467ab4e5edefc1bf1795ee3ffad", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445329, "uuid": "088f71f3-df2d-412e-9894-f21df09306b6", "comment": "Malware payload (WannaCry)", "value": "f9b686eb2d853c694e4931aa73c9ae2d5c8dd80e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445329, "uuid": "247ea0f5-46f3-4a63-adcd-1522e79ad0e2", "comment": "Malware payload (WannaCry)", "value": "4d504693fc77e9e98f8fd9f4a5b5dddf77e7fce9118f7e4b77096ba180802944f83cc0c8af4292654e4d2a7ed368c775", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445329, "uuid": "d9202283-528e-4364-bb8e-5ebfd80cab51", "value": "T1B565235D32BC91FCD007233594B38E26E7B37C5A22B99B0F4B5486660E03795AF68B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445329, "uuid": "18416447-19bb-4a1b-88b6-569aa1cefadf", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445329, "uuid": "464c88b0-6182-4b1f-8044-a6ebcb7edbc7", "value": "24576:jbLg3bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz662z:jn2nAQqMSPbcBVQej/1INR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445329, "uuid": "5bccc4a6-512f-4767-b429-23f1f09e681f", "value": 1542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445329, "uuid": "fdcee3cc-4747-402c-89cf-473a1d319801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445329, "uuid": "d1c0368d-03fb-4e27-a3e6-262ba6948e09", "value": "64fa25e0e80a527b9caec41f68d96f696ca41467ab4e5edefc1bf1795ee3ffad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772bd137-8305-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784419492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419492, "uuid": "21676361-0e85-4834-b304-0d47d55de5b8", "comment": "Malware payload", "value": "a0498c52d419bb229ca7947fed6bdb26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419492, "uuid": "0d64fd23-d67e-42fc-8327-b27c51f2e07f", "comment": "Malware payload", "value": "650cbbc9cce1761c658b98dd7e2d7aff2532e9d04e1056a1c44a61652406b104", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419492, "uuid": "d4f89466-aa5e-4b68-97b9-4e66883f5dd1", "comment": "Malware payload", "value": "5fdbd0e3915b9b9e5f5bec50b224b4f319bdac28", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419492, "uuid": "fbf4c269-7117-46e4-a25a-fcf9b5a53ef2", "comment": "Malware payload", "value": "2a2a402d1cd9c489a527a46df07b0a7df23c12cc1860d0c245085cfd503e33452e458dae6e0b0bb7ae680a328ff8a8da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419492, "uuid": "af562627-5c8a-4ed4-9470-4964ea4b6320", "value": "T1FE236C6516857C14AE99C4375C7E2F0CBDAD43E6314492EE7FCA3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419492, "uuid": "8bb3e945-93be-4ced-90ae-4330e8cf70bc", "value": "768:Ur9NyXsZztCs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:SHusZgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784419492, "uuid": "f9364b08-7677-49f2-a522-ac8cd0240e78", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784419492, "uuid": "e741dfd9-3a92-4ee6-8f8c-aa00ede2490e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419492, "uuid": "1cef2695-25ad-4ab2-a85f-f9b1d2aac30a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853dd550-83b8-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784496395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496395, "uuid": "688a6940-b9b1-4841-9c55-da19e3c800de", "comment": "Malware payload (Mirai)", "value": "9562569ef5c0d7c488e2cd7ae58358c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496395, "uuid": "c2ecf521-0aaa-4cda-bee5-eabc0940c75e", "comment": "Malware payload (Mirai)", "value": "657403eed6142cc526188769792fa9b0c4fc5e4d744302b0467c8fcc9bda2cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496395, "uuid": "19334dd5-2298-4fc3-ac4c-090fad2f4839", "comment": "Malware payload (Mirai)", "value": "68285f5e957d06d7b52fdeea0f2e5672d68c6058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496395, "uuid": "16fb8fdc-9a1f-4e68-aff1-6bb153305c9b", "comment": "Malware payload (Mirai)", "value": "b488926762c79420e55393287e733273d827af07cb7a8536d153e9e41cade0b59e8b1ea4ac2e15ea84394be0bf5fd508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496395, "uuid": "ba2bc5e0-c0b4-4a1a-8cda-f1ff67240f19", "value": "T111430182CE55ED8AFB343272D81E8640540D8AFCDCA679B355B729205AF22CD7EF0583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496395, "uuid": "ac977aad-45e6-4055-81c2-880a15794f9b", "value": "1536:DvUwV15WGkqzewK6avAnFyOUquUP5foqz3yfw:DLV1Uwva4FTUq1PyTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784496395, "uuid": "3c21a9e4-037e-434d-9cc3-45964a3195c2", "value": 55656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784496395, "uuid": "6bccd305-0b4e-497a-8ad9-dd9add271668", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496395, "uuid": "d010250f-c132-4dc0-92cc-0c7a7821a0b7", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fc0ecf-8362-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784459460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459460, "uuid": "02097926-1d3a-4f28-ad47-4e8a8226b0dd", "comment": "Malware payload", "value": "e95a529eae94910bf10e1d7fbb782fae", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459460, "uuid": "64c6a2e7-3148-400e-9448-a7494c8232b5", "comment": "Malware payload", "value": "65c6437aacaec779509bb9df0dbf839624f566a154a80d42d4a3c468388c2b7c", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459460, "uuid": "83a67f92-d292-4c5e-86dc-0c8b674529f0", "comment": "Malware payload", "value": "eea32d4f6c1e3bb129087f8d674516e22f13ea5a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459460, "uuid": "7099f639-4bb6-4d85-a4b9-dbfebb04ff8f", "comment": "Malware payload", "value": "625697e47a7fcd98600ea43096710855c8ded536952dd6f04fb1fa5912159e64ad708fab7c96c575d1eed252b3b6bcea", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459460, "uuid": "7300b44a-39e4-46a6-859a-992e7a17dcef", "value": "T1EA141A42D260222EDADFDA35FE9CA18115E1BF22CB3952CF83407D1554359BFBEA8271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459460, "uuid": "35659681-b9a9-43d6-99e1-1faf18c02652", "value": "02937d5d6013d9de953275083b08bd0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459460, "uuid": "2c97c856-38b0-4147-a71d-54fd315f8ec8", "value": "3072:jPnAtHufHgCFUAQZ9zZkRaWbaahItUzxj2BZJfnC2t0X9lpsBY/7qaPBzp:jPnA9U8Zk8WbaaOezxj2ng2t0X9LsqjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784459460, "uuid": "fe9cf075-ee6c-44e9-b8c3-00f18b98d067", "value": 196194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784459460, "uuid": "0e8e2912-2c45-4ed2-98f6-a61c24872b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459460, "uuid": "17b1dadd-7ff1-425c-bbdb-df80009ddd32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30420bf-8397-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784482326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482326, "uuid": "6f930956-2b12-414d-a9e9-e95a8bc40824", "comment": "Malware payload", "value": "34df312d6422687c4d011af380552ca2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482326, "uuid": "2c0fcbf6-21b5-4fdd-bb19-4c7c66f9e494", "comment": "Malware payload", "value": "67c86a34fef4fdfd28bd5b88cbfabb3b10137b7acf7992675900af6642a5cdbe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482326, "uuid": "79bb92df-da50-42ee-bb81-62064d4f1263", "comment": "Malware payload", "value": "2d3b93f946fee67097a2a9d18bcd9cea795d8cc1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482326, "uuid": "95f2f6ba-0b74-470f-b504-ba4420af097b", "comment": "Malware payload", "value": "6712043d4ff540069b3a61ab18d9de5ab29ea85d051a7dad35c2689cfc946f809c8804f63bfe14bcaf6028e69a46f2b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482326, "uuid": "d08b8749-7368-40fb-bebb-4b04885465ff", "value": "T14DA73354F7622B89C23DD2368191B86FC6948433E74BFF4A3C6D0779C24B9A65387127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482326, "uuid": "14c93f0d-83a5-441c-a055-631c6f2684df", "value": "f4d1e4cd7416ef83f79f7c6a038875b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482326, "uuid": "60853ca4-28b9-439f-afc5-6c02c47c099a", "value": "786432:o6r9nXKHgxNuq7BoXJJftMRX+7ipptsSPEP/wOujfeOZeBbEHciYr5KYSVVef6Jn:o6r97xoq2Xr1yAkIoTzeOZeBbEw2DJKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482326, "uuid": "acd2fa14-e448-46b2-8aca-7dbe908ebbd4", "value": 47247708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482326, "uuid": "164479d3-08be-45ee-ac5d-4c73cc831db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482326, "uuid": "b8188dee-9ed8-41bb-a89a-2b8f3ff7ca63", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639edf18-8389-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784476153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476153, "uuid": "7873c800-fc0b-4982-8842-0fc065133070", "comment": "Malware payload", "value": "b704ae1614bf6af2b15c1452b1a159d2", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476153, "uuid": "5dfbaf07-3311-454e-ba04-fd903372bcfb", "comment": "Malware payload", "value": "681299eaac55779dbfcf54cfb4d0d01683182aa83798008cdbe26d10fb99564f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476153, "uuid": "25e59a43-1022-45c5-aa7e-aeec8b051822", "comment": "Malware payload", "value": "40be68bc535fe410a468c180bcc734f4b52a18e6", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476153, "uuid": "97c2a18c-6b8a-498d-a6a8-6c50db4433d4", "comment": "Malware payload", "value": "619405746fa44ba8aa7ff3ddf44f69050743e193a7c8edb1608f3812ce07429f448b25cc198d6790a61bb5d66107ee87", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476153, "uuid": "275b262b-5190-4547-a3cc-842cbd731f93", "value": "T10A76AD40BD2C1C25F6C6F2BD9E8A4BA0B15BF8A04670C2DB793741ADDD91791A03DB72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476153, "uuid": "2db820aa-e9c1-4220-b58b-bf8c73053c03", "value": "98304:YyGjBuHWKi5SQZBMnfzhtbTJUI1LkDC3aEcIM4Je+Je2J:kjBsWKi5SIgLhtyqAm3aFIMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784476153, "uuid": "0c23a86a-2883-4feb-a03e-586794d8cd5d", "value": 7357432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784476153, "uuid": "0e57b73e-272b-455f-bf07-78391c30f87d", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476153, "uuid": "ec55d389-749f-4109-98f1-15e9a64704ed", "value": "CoreTypes", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d5c06f-83a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488555, "uuid": "b1751b1d-9294-4943-8604-260ea8263cf9", "comment": "Malware payload (Mirai)", "value": "afb384b4114544211ea99e244ed63d32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488555, "uuid": "7a7391e1-7591-433b-aed3-938877bd9fc4", "comment": "Malware payload (Mirai)", "value": "6a3becfcdf2cd4d91cc68090bd7a07c39bf4414f775995b2ef78a209968a39a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488555, "uuid": "d46a2834-524f-4ac2-9781-c7e9458710f6", "comment": "Malware payload (Mirai)", "value": "72f93185cf1dd99d1f65e235193f02f23f926071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488555, "uuid": "fae56aed-a869-4b32-adf9-57b325ddd09b", "comment": "Malware payload (Mirai)", "value": "fa65d7b5397395b1995947a5acf9f415cbb507f655b5f50fe8f1805003a37e2a0c22908ed53e7d85169d60e7960f8d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488555, "uuid": "370518fd-dc38-4042-a800-7cf77ff79160", "value": "T121F3461A3E22DFABF56D827047F78920579876D636E19684F26CD70C1E202CE641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488555, "uuid": "c2a921cb-4ed9-4a63-816f-9b1b208b8ba8", "value": "1536:2pp9zvlLYJPgjLRbJHlFiZ7NOIbevX6V2yGlTPYhHJBMgGL5CuxgTQ:gpHLYJYvRbJmZ7NOIgX64iKL5CuSTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488555, "uuid": "8404c3d9-7c24-4b74-9efd-c8fa14fc7a79", "value": 171664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488555, "uuid": "80cbca88-5d66-4c65-ba54-0dd5d25e4201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488555, "uuid": "9eac2a1f-64b7-4eca-acfe-38e94a148616", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f061daef-839b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484120, "uuid": "4dd31e90-30d3-4f51-b807-1a02bb08cbe1", "comment": "Malware payload (Mirai)", "value": "cfb5c5fcf874b291400c6d879928518e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484120, "uuid": "4a67318c-6f79-4a91-93df-13afd48fc0b1", "comment": "Malware payload (Mirai)", "value": "6ac9859df5046052e4c00547a93fc4a25e30e123b4c3b07c34323c77b412f906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484120, "uuid": "571e4578-41af-4456-8679-f82f2d8b784e", "comment": "Malware payload (Mirai)", "value": "5caca250443dabf006441873590fef32d62a34d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484120, "uuid": "b0cd8297-526a-416e-84e7-31964d6e57b4", "comment": "Malware payload (Mirai)", "value": "607387e073c6ee213be01b67c1e1f816e1502437cff65673d5bebd904a4841495468d57274d3c78b3188ab21a5172475", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484120, "uuid": "48c5f0bb-cc2a-465e-9ca7-fd641be44560", "value": "T117B32955BC819B16C6C2267BFF5E42CD371723ACE3EA3116DE259F20378B51A0E2B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484120, "uuid": "6417169a-11ed-4145-9ef3-345d8c7b096d", "value": "1536:IzPdRgVr95kfIIOy5QyVP0SQbQGyEimYGeEyyFwIOPzstbGOt0TJN0WSrwyW/:wHgVB5gIITVP0Tb+GxsIOPz6K0vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484120, "uuid": "b173cdcf-0165-4236-8c2c-8c89e18509a8", "value": 111960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484120, "uuid": "560cc63a-c4c6-4210-bf7a-df7f712cdffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484120, "uuid": "6468d759-99ce-4eae-b0af-25e056a93011", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a6d317-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489662, "uuid": "21958ed6-a2b5-4b99-a520-b14c6b8c15dc", "comment": "Malware payload (Mirai)", "value": "1c19a1c164e6f5a86c626418da82e748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489662, "uuid": "95075b7e-432c-49ce-a0aa-32eb63bc1442", "comment": "Malware payload (Mirai)", "value": "6c1206f3021163a64f126288286ac46aed0e8f10e292553e721386f8466636bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489662, "uuid": "60cc98ee-749c-4317-9004-d7a3895ed9cd", "comment": "Malware payload (Mirai)", "value": "da3e783dc485d5eb20013a90868e56a402666108", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489662, "uuid": "95c51953-7918-4e65-a347-eee4f3e1eac8", "comment": "Malware payload (Mirai)", "value": "c66044bb264cfa1601231ab18494c7e416741cfc623221459f59dcc1045a2f6142b38d7ccf0b0ef4ca78db788b0418fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489662, "uuid": "67e1ad5e-6765-4b90-8057-c99cac059c48", "value": "T128D3F902A951DF12D1C221B9FF9E425937137F78D3EE72029D24AFA0274A4FB0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489662, "uuid": "4c7117eb-db05-4700-89be-4ff4e4d9301b", "value": "3072:U28aqYvBP+X0SMhsBaMDdwDCmNND1lKU5/Ht96:U281EIXJM+BaiCDVNDuU5/Ht96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489662, "uuid": "ed12abf1-4fa8-47d5-9151-c1a35faf4669", "value": 140000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489662, "uuid": "60ca8ccb-4ec4-41ad-a110-4653f93867c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489662, "uuid": "b510a804-420b-4159-8fc5-0f8ea223beef", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80eb5a51-838e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784478349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784478349, "uuid": "c205f6f5-1f26-422c-9b67-8e54cad7cbe5", "comment": "Malware payload", "value": "11ebff3c00d40d9457888edbdc1578e9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784478349, "uuid": "1f8c5d93-ca02-46ec-81cd-8c310d7af199", "comment": "Malware payload", "value": "6d581ca6c51f8f23c7c80f49b316b6729cd60224f015233ba7e73812aca24bc2", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784478349, "uuid": "9a5d1fd8-a5de-42a9-9b43-cbd343ce5220", "comment": "Malware payload", "value": "59ea118642422d73518f2205c158e08923f5e236", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784478349, "uuid": "fd77ee10-8680-4380-873f-8c13a0463fa5", "comment": "Malware payload", "value": "242aa5528a792caf23d7ba23bac1a3e1389a60f75fa625752c88b8f60c4a5c1d2a1a4aa68a7243bf651ecfe6c057d734", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784478349, "uuid": "7aff24a9-6ac8-466e-b781-3a0191d13175", "value": "T1FD85235396E88467F6A7377CA9F12323B2793C901B7393DF66406A9C2A337C25531722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784478349, "uuid": "3c74efbc-2fd7-402b-bd3a-c120053a7102", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784478349, "uuid": "40993540-fc0f-4621-98e4-000bdca4ee74", "value": "49152:zkfovDwaxCH/WmLWoi3xS0TASv9hiXScHP:PEu34crv9YScv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784478349, "uuid": "e8e58a70-2694-4c98-a746-66822e28b925", "value": 1768120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784478349, "uuid": "6831fc0f-20e8-4fee-96d6-b865dfd18180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784478349, "uuid": "494e00ec-ac09-45ce-8931-edf85983a1bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d97e82-83b8-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784496457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496457, "uuid": "19b7e442-aaa4-4e3c-bb72-7b213e5b6373", "comment": "Malware payload (Mirai)", "value": "84e85242246e6777a5fe82db4fac2607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496457, "uuid": "6b195e27-4cfb-4a14-aa45-5d4971cb1e62", "comment": "Malware payload (Mirai)", "value": "6d7ac1b59ee7fc971e0e4aa825f9b49fd597ac67fe9ab57def3ff37572b2c6f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496457, "uuid": "ba12de08-3bd9-42d7-86f7-25f45f566af1", "comment": "Malware payload (Mirai)", "value": "bf6d42b5642f47d61e5495f7eb087cf4a01ff63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496457, "uuid": "e9868521-a774-4db5-8078-e0e7c2264d9b", "comment": "Malware payload (Mirai)", "value": "60b79bc4ca01690f3c5a4a842fb9ee89243c41f688125e99c95dae13b8c4f53e8909615027a4c8efb86d0c70a17bf4d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496457, "uuid": "b1b84163-d2b8-45ca-bf86-a48873c10e72", "value": "T1ABC32A99F880DE52C6D5267AFB5E418C33231778D3DA7106CE109E3477EBE5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496457, "uuid": "b59ef439-6417-402f-b2fd-adbdaabab7d4", "value": "3072:hH0Q8oVUpSaVDSMcMZIBTcYEEUAeMMWmNwhNAfSsXMFNKFpAiuzf1Dll:hKUeHZwTcYEEUAeMMWAwoasXdiFz95l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784496457, "uuid": "ef761090-8709-42ed-ba3e-1316c7d76236", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784496457, "uuid": "df945904-6624-40ca-9ed2-1a3c628fadfc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496457, "uuid": "74a917c8-7c24-42da-ad0c-15da2ab91107", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f27fee-836c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784463671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463671, "uuid": "ec99b34b-2fca-41c9-9ff2-51f5c67d195d", "comment": "Malware payload", "value": "18c1be70569df18c868ddae0a01e942d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463671, "uuid": "f27c1143-9d46-4e80-b024-706fd0f5d8a9", "comment": "Malware payload", "value": "6d9ada5925ac865f4e390ea613c151b4f597c2753dcd00c925bb8fd89ba8eba9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463671, "uuid": "746b23ba-cfbd-45b1-a9cc-0a70dc13a7a9", "comment": "Malware payload", "value": "948004908fd401ae31eab3813cf9d33cd9b78bf0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463671, "uuid": "753c92b7-0e44-4ec7-b829-b9e436f1456e", "comment": "Malware payload", "value": "2bf06f18a4277125098601684ae74a489ede773d394820d4d202c24f893a2203df6f37573dab17dbbd2ec0e539273b62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463671, "uuid": "aa80e70a-24ba-44bd-a472-ff10bff14339", "value": "T1FBC26C966A86BC44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463671, "uuid": "000abf4e-4599-4530-8ff9-b9f3c4f9a70f", "value": "768:m8vCB+25j6es8RZ9FYpMSUpi+20qUpi+20YQX:m8l25J/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784463671, "uuid": "23051792-92a3-4775-9738-37e62e645b22", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784463671, "uuid": "d39bb62d-ea7c-4f21-92fd-14f827e76524", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463671, "uuid": "bbc55bda-ed9f-4c23-8b8a-9cfaa2f35a26", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98d87ad-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489665, "uuid": "ff731956-3f36-4fcd-8351-07bc9a7f10c9", "comment": "Malware payload (Mirai)", "value": "a80be6db07e7816b6c66cda59e9d12cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489665, "uuid": "23b5c124-401c-4a50-8c7f-de703a172658", "comment": "Malware payload (Mirai)", "value": "6fd23933cd4d6c4e6e5d57ee22788924340a05db50230fa80edf5132a08dd138", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489665, "uuid": "97ba59be-2134-4549-89fc-8cdb35ec2ab7", "comment": "Malware payload (Mirai)", "value": "bf5ea3d47568604735d68749fab258a871caefb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489665, "uuid": "c585670e-bd5e-4e71-8782-c835f300c5aa", "comment": "Malware payload (Mirai)", "value": "8dcf83faababb28fdec2204442d03e1906279c4898d6e3ff9061c108e372fc0db2ec7cfe67de7eaabd2998e097e1bb6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489665, "uuid": "9314757d-b5c7-4ffa-801b-e1158f31c8b2", "value": "T17204651A3E12DFBBF56D827007F78930569976D63AE19584F1ACD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489665, "uuid": "f078472a-663a-42f1-be44-098b4c5a41b2", "value": "1536:TzzL+x2daFPfCEL+ykn9K/o2efK5ox3YhprNTQ5FueLGG7Jlj3m:Tz0wAPfCEL+3Kgaox38AF1LGG7rjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489665, "uuid": "14de14f4-d9c4-4ecf-b7fb-83026cad62c1", "value": 189420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489665, "uuid": "74e9a62a-4282-4eaf-be99-b86319a7b510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489665, "uuid": "0193a530-56e8-4016-a134-bb6452f07e3e", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65377e1-83c2-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784500853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500853, "uuid": "e10ab566-808f-41bc-860c-835c01c28ee4", "comment": "Malware payload (Mirai)", "value": "97657493b3bddf2092af5c890f971a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500853, "uuid": "89cf7997-e079-4467-ba6c-36bf41cb81d4", "comment": "Malware payload (Mirai)", "value": "70005bbb6db8afaf30661df0311395fb3cf7bf1ece51d511841d4f4def908a29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500853, "uuid": "44661a74-f070-4232-a58b-167905f4219d", "comment": "Malware payload (Mirai)", "value": "9fedac487a28b0520ef0fd67e509d95701058bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500853, "uuid": "d8710d46-0ae5-4c59-b269-6cacb4f1b668", "comment": "Malware payload (Mirai)", "value": "cd41f2adf8a8a5273ba4e720c16f15c6c2e1990d8f13bca0fe0aaf5e369e48ba0413a4fc28ec42d6cac3f8c4059d5dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500853, "uuid": "585ba79c-d486-4b13-952e-28ed5206dfc7", "value": "T1CCC32999F880DE52C6D5267AFB5E418C33231778D3DA7106CE109E3477EBA5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500853, "uuid": "d82b98dd-bfec-4b08-9457-b1327a3a12c7", "value": "3072:hH0Q8oVUpSaVDSMcMZIBTcYEEUAeMMWmNwhNAfSsXMFNKFpAiuKf1Dll:hKUeHZwTcYEEUAeMMWAwoasXdiFK95l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784500853, "uuid": "a3957998-fd37-42c1-aeac-1eeaa3464aaa", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784500853, "uuid": "9d0e78da-a383-4076-b05f-6d7e6c61b925", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500853, "uuid": "6ca20313-34fe-4a06-9841-2a65d40fe8de", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4981984-839c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484449, "uuid": "bb7d8681-095e-4f2d-b44c-146f47bed156", "comment": "Malware payload (Mirai)", "value": "0ee6922f71430515d6e83b7a5c6eb2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484449, "uuid": "de180efb-ca37-4218-ae3a-ad8a00f8662b", "comment": "Malware payload (Mirai)", "value": "70950aa0eca42828f021552fb7ec37525d99d3fab5524cd1880e0e446944b8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484449, "uuid": "4711810e-f255-4ded-b52d-45f1d34ee0aa", "comment": "Malware payload (Mirai)", "value": "656ac72250b21beabac997630cbbb2931d28c96c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484449, "uuid": "89ce8ed0-be60-4cdb-b9af-e57503f8202d", "comment": "Malware payload (Mirai)", "value": "739fca66c02494a5fecf8e640fb544ef154ae7624902440a0a60235a57b25afb9f24300bd11689747f367d1aae942635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484449, "uuid": "c8fe163b-0b5b-441a-970c-1e6113b1019a", "value": "T11904D61E6E258F3DF279C73487F74E21975873C62AE1C545D1ACE9111E2038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484449, "uuid": "7f2dc1b1-0f2b-4caa-b90b-94e310794a0f", "value": "3072:XSyDz08fuwpUC+YWJlCdOA386DuItLWjhaWjdpxgS8nbDjqIK:XSyDpfuwN+HCdV38lZN5fvAXqIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484449, "uuid": "bd432f88-b3cc-4f48-bbe2-68be55e013b3", "value": 177776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484449, "uuid": "be385ed1-c246-46a7-a1de-5a80dcfce5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484449, "uuid": "4c4c2ea6-3735-4efa-a2c2-e29ec5dd1865", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a99ed4a-83cd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784505451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505451, "uuid": "bffa28ea-2145-47bf-95f0-14a90a0c1237", "comment": "Malware payload (Mirai)", "value": "7c08044ec23321c4df7fd08c6e1f5007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505451, "uuid": "af8fd87d-0e19-41c2-9e12-b97b6d8e19e0", "comment": "Malware payload (Mirai)", "value": "71458c54a327762a69035b4076ab75dc325572294d2c06994b7a23dca1523f3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505451, "uuid": "94095c2e-61e8-4587-9755-53244abd9332", "comment": "Malware payload (Mirai)", "value": "4de9355acfa63ce23563ea94bb4d4f739527a00c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505451, "uuid": "656ed8cc-b542-4204-8c7c-17f1d4c8169e", "comment": "Malware payload (Mirai)", "value": "96e10516c080027adf4be7990ff06ed6c5aa90ca081266d7df8802dba74f7c05f2dbb1ae6304d87593687d3674b63fc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505451, "uuid": "ac2c97b3-375d-4cd5-ba5f-cf863eeadfcb", "value": "T160C32B99F890DE52C6D42675FA5E428C732317B8C3EA7106CD209F3477EBD5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505451, "uuid": "8e693748-60b9-4701-8c18-c2febaba93a8", "value": "3072:bfQSR06/dtBMozi7Gj2UQ4g8OeC9yUcIj/3ieJ0EsZZf1Dlwu:bf661pj2UQ4g8Ob9yUUeJ0/Z95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505451, "uuid": "c2439f10-b499-46ea-ab8f-8c0c3007d0f6", "value": 120248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505451, "uuid": "f9ccc6de-4edb-4a57-87ec-5eb6437663ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505451, "uuid": "ac48415c-b496-4310-a412-4237c5a7fce6", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af7de11-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477856, "uuid": "d0211af4-f265-4fe2-909b-61def1c850d7", "comment": "Malware payload", "value": "ad9371c87921fa735803d37d41050dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477856, "uuid": "5e30b119-1ea6-4588-a043-d64355d520c3", "comment": "Malware payload", "value": "7152c674b0de7157c470aa0deb8fcaba1ca8f04441a7ef2f11027fcd964ca944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477856, "uuid": "ad2ed94a-42ca-4ff2-9f16-6791e6df20b7", "comment": "Malware payload", "value": "1eb741727b407594b248bcc3304b618536d48b81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477856, "uuid": "bec00886-8e6f-4e65-a580-802cd1e911fc", "comment": "Malware payload", "value": "4e9a717b5c58a9ca9b7262f365a2353dcdb3fd8f06048738c9641b548dae748971a554e255e14aa5b7babdd6fc657e59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477856, "uuid": "d0e26bd0-07ba-42dc-92f0-2ece14ad1e7e", "value": "T104F3241A3E22DFBBF55D827047B38920579876D63AE19684F1ACD71C1E202CE641F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477856, "uuid": "aa6affd4-b27f-470c-b7dd-af847c7753ed", "value": "1536:F0UDwNtMbt5ElYYxcYc0aUe6AZFz4TbjTmrfuMBtQ2rtgl:wNtMbolYYuYc0aJZFQefttQ2rtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477856, "uuid": "117f2453-2fb9-4955-8410-a9a7973a04a8", "value": 171652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477856, "uuid": "5de87c52-8ca6-4d7b-a5c8-846288973cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477856, "uuid": "4b2ab268-6f9a-4e73-bc84-9ffde793acce", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4408e1d5-8325-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784433150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433150, "uuid": "78e0d09e-01d1-4ee6-a443-255e2795e67e", "comment": "Malware payload (Vidar)", "value": "93cc155253429c5d55a4d35c41f11a33", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433150, "uuid": "5a1f824e-6eda-40dc-b68a-c9cbcb5ac0f3", "comment": "Malware payload (Vidar)", "value": "71d5fabdd8b478089e543ab6a6e92fa1bcf822ca095ee9ace7789e665c495dec", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433150, "uuid": "58ac8c48-9072-4f7b-81ac-79591eb8bb03", "comment": "Malware payload (Vidar)", "value": "001e146ce340e22096824e3428aaafd95fce6528", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784433150, "uuid": "a2cdeea1-2c5e-42c7-bc2e-ca33367c4806", "comment": "Malware payload (Vidar)", "value": "62484331438c490272fb3ba715aafd93643f031b7cdc58652d2800bcee6f577b41c1bba8e41c357511f9ddb0f655aa3a", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433150, "uuid": "4d29c000-ffcc-4daa-819d-76544b9c95b2", "value": "T1C1577C07AFDC07FCD567C7FC89AB9B32C6F1B86A8622C24B0554C7151E729B14E6A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433150, "uuid": "6b6e8f15-5230-40dd-9f03-2f11017e69a8", "value": "f469ac0906218570f79c54d1b58dc057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433150, "uuid": "b3bbb85e-1e04-4787-a0f6-6b16e5090ffa", "value": "49152:ToAnT5THZp2mLlODnSiGLGqna/x5qIj5yPgFjs913k/BRHGfoN0IrR/ZDlGIBLOH:TdK1qna/x5qIji3WjHHNPO100c+R6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784433150, "uuid": "e71f95a9-dcde-4592-a876-037b690d5e45", "value": 29413888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784433150, "uuid": "52ef6759-e814-4b5f-ab93-f6d8df5eb2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784433150, "uuid": "648b8c93-32a4-4957-a007-74f5202ef911", "value": "DeltaExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770930c1-83b7-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784495942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495942, "uuid": "c36250b5-6a93-4eaa-95a2-84a37a75f201", "comment": "Malware payload", "value": "5277b26c4b2a98cafcd387f0e827dd4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495942, "uuid": "bdd9baa4-a545-4685-a75e-d436ead3752e", "comment": "Malware payload", "value": "72246ddf2ad80143d2454f7fd7da6b1956fa25b60f27ffa0351aa7aa0a98ef43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495942, "uuid": "30b42f53-a32b-442d-a448-211c68f70432", "comment": "Malware payload", "value": "588d6a8b1b85cfd805d397034d91545be8769408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495942, "uuid": "e1935ee7-038f-42c3-947a-ec3e80ea9953", "comment": "Malware payload", "value": "eba866922f55a7b3d45a0ff6ee2e601bd4331db1fcfd64e49e57ad0d6715b0575be6bad69cd9c0d11c9c3a7daa4e42cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495942, "uuid": "ca11ceca-553f-4f7c-8e48-c636874039f0", "value": "T1BEB30886BB43DEB3E55310F102B74B224A32FD3E5836EA81D339BDA199515D0A61B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495942, "uuid": "183c0516-fa12-4086-b46b-4c8053fd6bee", "value": "1536:f9x+cxuGGPMZgCsbs/gfHwd3OzpldT+MJlolIO02rtH:f9x+7PMZlcs/GQt2vqdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784495942, "uuid": "558963a8-c4c8-438a-a476-4672f6a8a59c", "value": 114336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784495942, "uuid": "00bed4ee-0558-475e-a779-2c63d67b7fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495942, "uuid": "d20abf9b-e970-4df9-8644-2dbeb0f15b61", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c03dc7-83bd-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784498443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498443, "uuid": "d49ac7b1-960a-406b-9c39-8b24c4d2e082", "comment": "Malware payload", "value": "69d16a5ab6e1de58af06039c365f7a91", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498443, "uuid": "96fea591-d7ec-467d-8841-759891a8cd75", "comment": "Malware payload", "value": "726ca85760e035489a885da5b01dbe62c7a1e0b52e1735b656adbc899090a572", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498443, "uuid": "75a0e5db-8056-488e-8c78-0e0c72bb1a97", "comment": "Malware payload", "value": "7b0dec3128dc6ed5f1490d3c2596804a012f695c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498443, "uuid": "63190c8f-cad4-4e8f-aec7-60d347d97f68", "comment": "Malware payload", "value": "6fced0b4c0d10e76c87906682a73219c21d144f02e964f4929f836d5bfd650ebc6df817b85afd59c2887d284514aec00", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498443, "uuid": "e1859e0f-dfd8-4f40-b257-bfe0b0e2d890", "value": "T15C237D652A817C14AA98C4371D7E2F0CB9AD43E6324452ED7FCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498443, "uuid": "258fa96f-e9fd-4474-8f4a-69111bc85dea", "value": "768:8pXOGVvw9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:8VLFcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498443, "uuid": "c5917f4d-1f69-4ac6-ae92-8bd9c3703c04", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498443, "uuid": "958c6e65-45d8-45ae-9261-3695157de7ea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498443, "uuid": "3600285e-543c-4beb-9bc1-49c477b652cd", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3103b8-836d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784464299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464299, "uuid": "ab1885fd-3691-44bf-9992-400aa79c60af", "comment": "Malware payload", "value": "ed8d627c4dc4c131e8420922aba2eab6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464299, "uuid": "1131b28b-b83d-404b-a13d-ebe6e2a404b0", "comment": "Malware payload", "value": "7323bcc98fb1b23e201b6a775ab791634601dc5110ad1557b6dac94ceda14545", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464299, "uuid": "e47c0e34-dec5-4837-90f6-9310283c6f98", "comment": "Malware payload", "value": "98e2563936ca6dc71509a1a9a648e075e3474515", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464299, "uuid": "3aebfd42-7328-423b-897f-e891b85e1363", "comment": "Malware payload", "value": "81c1272d2a877b216b4cbe21304cb60168044731eedbd99dcfb01f22b1977c8571e9c66fbcf4914e6cc1057b219aa510", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464299, "uuid": "d5f74614-20b6-40f7-9a8c-3795dfb686cb", "value": "T1E601C2CED250581040AA946D26D79499F470C3C6164A4B78FF5C983D9B88E14F076F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464299, "uuid": "57aad6bc-89a7-4deb-bba9-c48fc3ec95db", "value": "24:kXCKysE2hi0ziQvZohazfa82SXZTaezKJEaX:e9Qp+Mszy82SkkbaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464299, "uuid": "8bdc6788-92a8-445b-8a96-53bee2a6651f", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464299, "uuid": "233425a1-2fa5-499c-91c9-3b5fb00ce10e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464299, "uuid": "8020fe2e-4292-47a6-8ff9-d2dbcdbb8709", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96a7094-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484913, "uuid": "86c5ec5b-6f48-43e5-aa82-656302a513e3", "comment": "Malware payload (Mirai)", "value": "9ab397640b3137a326068160b5a5247f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484913, "uuid": "bb7d4dce-ca66-4190-9382-d5984828eb6b", "comment": "Malware payload (Mirai)", "value": "73869a5a3d8a9cdd15d72723e310fe744ef120ed8e5c7143209a472f3a23158b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484913, "uuid": "775f6d30-c0c6-48b3-99d0-869e29a9fe47", "comment": "Malware payload (Mirai)", "value": "d229ca3f254a3d2204954e52c6a019b463b933b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484913, "uuid": "57d7c0f9-14f6-4296-b0d9-2329bb337c07", "comment": "Malware payload (Mirai)", "value": "1cb2bc64e1745953bc814f0a253f5974436a0d13150c53abc81a7d83c8f9acd47a5a2f44cfca5a9223c7a4117dec3458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484913, "uuid": "1d28d2ec-4dcc-468c-a383-4c2d116df15a", "value": "T1E4D31955FC829A12C6C2167BFE5F82CC332723A8E3EB711BDD155F25368B91A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484913, "uuid": "02767be0-8ffe-4018-823b-7dbb95b0b648", "value": "3072:zNWnrQNN7l/LfEsme1Sry99DgTclvUvjRZnboC:zNWnrON7lj81FG0Tcl8bRdoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484913, "uuid": "841e5ea9-b00c-4d93-bc9b-a857aeaf4a36", "value": 132460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484913, "uuid": "dddbe9ed-5958-438a-b5b9-d36c7e53127c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484913, "uuid": "abdccfa6-42ce-4a74-b119-7d58f588d1f5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3c1a9a-83a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486849, "uuid": "3e8b9146-c5d1-4af7-b37b-264f103040f8", "comment": "Malware payload (Mirai)", "value": "1d741fb0b1f881c11c1d8d60cc28bf72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486849, "uuid": "2c16035a-28d8-4ffa-9a92-583421c3e5a3", "comment": "Malware payload (Mirai)", "value": "73ad9a7105eb9c7b548e8e9299e7446623c3286f878d7f0abd0c4aef20a88caf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486849, "uuid": "6e59936a-5217-41f4-bdd7-daf049ce501b", "comment": "Malware payload (Mirai)", "value": "7b838af377e1a7b593d1877cadfa2e2b15ee6b63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486849, "uuid": "f8a9c547-9283-4af8-901b-7912f27ced88", "comment": "Malware payload (Mirai)", "value": "4bdfd6b1dda15aa23acb69df2d8c790a73000fc6e8f384a09843d417da2c13223dee2bf2cc71d6a70e5cf2616ccb11e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486849, "uuid": "6b00fca2-9c8d-460a-b52c-5a5b389ba477", "value": "T107D35B48FA5BC0F0D6D340F1063BEB6A9A3A9D216173F5F5FF567A62F8B1201188526C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486849, "uuid": "a5ba47f5-55b6-4ec0-b925-a14a3e3c445a", "value": "3072:iQ1QQPigD0Tmnh38zbPYHa3kbVDWII8KJh:FQcidzbwkkpDC3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486849, "uuid": "84ea1bbb-930a-450b-89ed-54fffbd093a6", "value": 140668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486849, "uuid": "8d333cbc-43d5-46fc-a77a-acaca8015629", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486849, "uuid": "3df57c6e-325c-4e20-b14a-6961c45955c5", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74b59dc-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467300, "uuid": "91f588a3-180f-4961-94f9-d1fe90a18ebb", "comment": "Malware payload (Mirai)", "value": "b9ca7cef9e16dca14b62dc68779c7d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467300, "uuid": "496d37c6-bf68-4311-a42a-b801e6df2f24", "comment": "Malware payload (Mirai)", "value": "74c109e455269524e231ea2448820679b25177f1a70935218ac175d775360cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467300, "uuid": "af34402b-7084-4b81-9abd-44d50d47586d", "comment": "Malware payload (Mirai)", "value": "6204698af66e7b512e03c302e3682162717a831f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467300, "uuid": "7c5ecdc2-0d84-4956-9497-7d8885865fce", "comment": "Malware payload (Mirai)", "value": "db3bafc1364a01c5c87282a60e0f3702a184d3ff98344835195c4cfb35a0bc716d88d365a32eb4ba71a88951b265cb9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467300, "uuid": "8571d91d-910f-40fd-bfda-363ea773cd40", "value": "T17013F1017BD5B4E28DD02D38AC61008FBA5AEEBC55A9F03771780C7CB5F312F4699A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467300, "uuid": "3241d65a-eada-4709-9771-fa4194c0dbc5", "value": "768:RejTZycYuASB5Igp1sxK1UzfcIEV+z8P4m5BEMQrEUDzAGUAjCkdm9q3UELL:qAcYuRBLp+UUzfcIs5PJ5BEBrEUDisLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467300, "uuid": "b6d27e65-744e-4a04-a075-f93dcdd9b2ef", "value": 42720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467300, "uuid": "13706ed7-4eda-4538-8a00-43c6d41f96b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467300, "uuid": "fa7790da-bc8a-4c97-9315-4e3041c76b00", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1033d20-8369-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784462538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462538, "uuid": "e8e6e085-958b-4d5b-beee-1f4c732ec066", "comment": "Malware payload (Mirai)", "value": "3801e17b121850fb99c1268d5146f4f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462538, "uuid": "c2c6f5fa-3dc6-485f-9899-a095e950f1f3", "comment": "Malware payload (Mirai)", "value": "7607a6631a90eb57ad892bb0cca2bd6618940822daed745392676f6aec4a33f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462538, "uuid": "c8069dc9-61b2-4d68-93bf-5f487753e58b", "comment": "Malware payload (Mirai)", "value": "f17cacbce218f651337564c1ddb9743d3b69c84e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462538, "uuid": "85a91bad-6164-49df-b492-e9d155e1d250", "comment": "Malware payload (Mirai)", "value": "bc39157e5d76cc8b6b59b72ba7f70716e55fb722cf30456567361348a73d0d22f890d68282fb87293f87296c664725f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462538, "uuid": "d119af39-87ff-44da-b0ed-f80ce9b3673c", "value": "T12C746B85AF600FEFC46FCD314AAF431729DE9C4B42A5BB3A617CCD18B19A20646D385C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462538, "uuid": "17ea3a73-b57a-4fd0-9e20-ba12fe42ddbe", "value": "6144:NGgyO03iF8K0MgaEI+nCf6IM+FVl7Secva2E9DOIYDXLI+:NGgyP3+Qa/f5FVGaZ9SIYTLI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784462538, "uuid": "eb257403-11bf-41eb-a6f2-47b4b91b65c8", "value": 347616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784462538, "uuid": "4cba48de-5c17-42e2-a150-d97d390c8444", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462538, "uuid": "5324afbd-a341-41a4-a611-199c488b6a1a", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bf3ff4-837b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784470381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470381, "uuid": "d93946bf-a820-43e6-9192-980df6e1e87a", "comment": "Malware payload", "value": "0bebb527a0b95985f36a8e80004b4631", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470381, "uuid": "0420da78-311a-4155-8cc6-57c5367e193a", "comment": "Malware payload", "value": "7695790496d0ac7319b8f8b01f0a9f8a8166df7308fa51dde96d74c21bdc1be1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470381, "uuid": "f62fa064-428a-4e59-a77e-e96f2f841903", "comment": "Malware payload", "value": "d4fc6e4f7ae0139822b9bb070dd7b396e5702da0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470381, "uuid": "69089ca3-00b9-403d-a94f-899e180ebb23", "comment": "Malware payload", "value": "7529fcb26d16879374850e1c4d8aa53a98c548f3390ad53dcbaa65c22ecbe3b7ac019a17017dbd46a78527e13180f702", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470381, "uuid": "a4b4fe69-0f71-4580-9bce-3c9bda7a2c87", "value": "T1A914281DC912A50BFD3AD8F11136033EED2176DACB98C0F2A999F63F45A99D8CC71492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470381, "uuid": "7a80ddd8-8d89-43cb-b2db-9a5a8ba8d6ab", "value": "d4ad4e6883878549cd313f3fbb5fffe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470381, "uuid": "0bbca473-dcbd-4e94-83e4-85d75801aeee", "value": "3072:xSdaYWMIglP5Tl+93diIofxBaVpzPArmzFAaXX/423WTn3jIx4bAKTgvpcpR7qgD:UY0T4LFmx8psyzFAaXwoWTn3jIxgUvK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470381, "uuid": "42b0e99c-72f3-4418-83c6-b790f6214505", "value": 195648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470381, "uuid": "6552987b-9b17-48cb-8315-4b5c68bb915b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470381, "uuid": "b03b81c6-bae6-46b4-882f-7cfb64256c50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e069aa-835b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784456406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456406, "uuid": "f5e273ab-cf97-4f26-b51b-31362535cc2e", "comment": "Malware payload (Vidar)", "value": "7722a1b01d44735291ff41502f5c697e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456406, "uuid": "cc8a6a5b-8a45-4c15-a0a9-a211d3fce4f9", "comment": "Malware payload (Vidar)", "value": "76d750e2ddfed6f984d95ab0419a085e21f124924c4ab64be5732a1d93719299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456406, "uuid": "5c07cf8d-b107-4621-b34f-2f479adb1659", "comment": "Malware payload (Vidar)", "value": "d72c982d721aa19424fdb1beba9696c2fe8817b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456406, "uuid": "067f99dc-ebfb-44d8-992c-586f993898de", "comment": "Malware payload (Vidar)", "value": "cf32d13b649186f7fdcc0fec1a4ab600168b59c39357b55aa093da17fe8247387101f81870e161f5b942daf34c7f5924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456406, "uuid": "50339ecf-03da-4016-a455-d84c1402331b", "value": "T13557BE14A3F93DACD527DA74CB5292F3D77078414321ABBB3699C2152E33A909B7B321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456406, "uuid": "00714957-4f62-4942-b8bc-de97601d8eac", "value": "22db4279351881cc876b9d7a5b04df90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456406, "uuid": "85e26131-8676-44b6-aec8-61400d32f81b", "value": "49152:4b9J7xEKI0ZSWR4hTkF+WkNj8x33wWu8Ox+/ArqyqM199bu+PQTU+:x0khTk0Vc3wx+/HrMvPQTU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456406, "uuid": "970f75fc-2b2a-420b-bb09-334b8d026457", "value": 28262400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456406, "uuid": "2f5f7767-23b9-4b6c-8411-cffa593758db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456406, "uuid": "1fffe792-3993-4439-8121-960d2a565e93", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a53f44-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494468, "uuid": "e3e5ae60-94a1-4a81-892f-da601378c724", "comment": "Malware payload (Mirai)", "value": "05de727483ef3520f14cad9b0df74a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494468, "uuid": "e11b7024-9a94-4ffd-8e35-f35569ed8f30", "comment": "Malware payload (Mirai)", "value": "79d9c24f196c5bfd45779912d15f5b0de795de88697a4b066c71acaf9885e012", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494468, "uuid": "17ce26e2-c564-4895-a929-7aef31213037", "comment": "Malware payload (Mirai)", "value": "745cf9b12dcf958642cb00569c4cad42ae85e4d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494468, "uuid": "1dc70af8-afa5-4b34-bad0-3afc5f0d5607", "comment": "Malware payload (Mirai)", "value": "00ddb891ae7f75a42288e7d933243a644bcfda5e13cd16e21c1ba0addb3df6bab6024e09dd8891482e8c0e4cac1b505a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494468, "uuid": "f5b3f1fa-e708-489f-bc98-6f1bdf23e133", "value": "T1A383082AB9419F15D4D526BAFF1E438933536BBCE3EE7102EE141B2527CA91B0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494468, "uuid": "fbaee3b7-3c7d-4b2a-8e55-a88917930c14", "value": "1536:pnnpHq+9rGYuTkg5PynmOXeuhDIzLyPtcNF3GRIbuCDlluCiKHWSkZGOaCr:7Hq+D0kWSVdwyPtcNF3GRItG2HWVGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494468, "uuid": "d104f7ce-7993-46ca-abca-3f0e490852ce", "value": 83952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494468, "uuid": "96352cc7-b523-40f4-ba79-e6b43886ae31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494468, "uuid": "055fe56a-d234-4227-a91e-a3b15a8bb866", "value": "F8dj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11004745-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489328, "uuid": "b8ace36c-346f-4f1a-bb11-bb160fa0f8e4", "comment": "Malware payload (Mirai)", "value": "f4631ab84e78e21e141dd57f5b000da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489328, "uuid": "c9bb53f3-d0e6-4e53-a6cc-fdf51a19523a", "comment": "Malware payload (Mirai)", "value": "7a3f207d0b557dae45366a53f882e6abf6b14df1727889e3c316eb90f3d63b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489328, "uuid": "795478a8-3fbc-4644-b978-c70c1577b641", "comment": "Malware payload (Mirai)", "value": "c415217dce62312094c2f30b9e49cd9018e09b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489328, "uuid": "758fb8e0-06eb-4249-be62-e8fcb2ca1e45", "comment": "Malware payload (Mirai)", "value": "92f6a6e5ec1d12c94880cfad36daf5e6e1038ba35e5c7f1273afb4de45c676adafa2ce8480bbcffe223c7384c18256b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489328, "uuid": "d724e9ee-e86f-4dc2-90db-85a990561566", "value": "T128044B49AE742BFBC06FCE30052E834B25DD944FA2F5B779A678CD4C399A20859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489328, "uuid": "f4ddbc89-0ba7-4155-b000-131c9fd01099", "value": "3072:UCtpifVC/IkzX7yD0ISGIyqKmH+qJ02TN7tjrUoVTZ3M1D2:LpCVC/IkzX2D0ISGIyqKmH+qJ027jrUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489328, "uuid": "a0c871df-64be-4c73-9ad5-299766004cf2", "value": 177648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489328, "uuid": "f462bdab-926f-40a4-982b-3903ac9113d9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489328, "uuid": "ff1c6b55-12fa-4bb8-8307-cca1a7862c39", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e76484-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494110, "uuid": "af22b9f1-fb86-4a1e-afae-88db0cdd140e", "comment": "Malware payload", "value": "1e8c13d0dd0a36e84bf4e6eee8ea5f9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494110, "uuid": "c76aef87-8e23-4dbe-8b5f-b849b4dbddca", "comment": "Malware payload", "value": "7af9f92dc7451c066fa17ad4b274e7ca3aa59ef1b71a37878d90b51090d59758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494110, "uuid": "13cc7f08-e0c1-40c5-b529-e2de97a9fb90", "comment": "Malware payload", "value": "2a8fbe0b39e30e58cda7735e866e3ac155f202f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494110, "uuid": "e1eca9d7-2367-4a0b-acad-27bf66370cfd", "comment": "Malware payload", "value": "a96bb84151a4bfe252672c71f4ddb75c60dfb173e619ec08eb5f87c521c6404492cf9a9952f6ac278ce00cf35cf7cc56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494110, "uuid": "b8d782ea-2007-4ad3-91b3-3ed62e00a36f", "value": "T1ABC3D846BD418F13C5C321F7FBDE42983B166B6DD6FE72029925BFA027864D60E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494110, "uuid": "835d4239-efe5-472a-bdcd-3c68981561f9", "value": "1536:+qVX2DSprkAQxax4VgLU7znAACzStFMPvQRz66jeGHXlCe+wywAKFHAo6eWUlqOA:+U2Durky46UPAA2Icvp66boDRDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494110, "uuid": "0ce79817-8d79-4512-92a1-786056d6d7a9", "value": 129284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494110, "uuid": "63e75f14-27f3-46e6-8d8a-dca7c723579b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494110, "uuid": "4fd71226-f8c4-4480-848f-d6ba6510b196", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3997f71-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490111, "uuid": "d78f7342-2f50-42c1-9301-84ea8868f272", "comment": "Malware payload (Mirai)", "value": "d768c1ba8b0549bd811987106442cbc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490111, "uuid": "274e85a6-1332-4d0f-ada3-143b797cdfb9", "comment": "Malware payload (Mirai)", "value": "7c220658b0187a4e9aca9311485defb2b0ff57575b299886d0dea6ff85c2d66e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490111, "uuid": "bac22c45-961e-4d4d-97fb-7f3b62d30738", "comment": "Malware payload (Mirai)", "value": "aafb109a1d4ccfaa3fd0f2dff4224a2da64d5ea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490111, "uuid": "9ed9ae1a-7ddc-4ec2-a5cb-3fb8f157d5ce", "comment": "Malware payload (Mirai)", "value": "0949c3095a59fcb8661f19186465111f99c3242972a0d776b9c360ab8631bfc55ea4413d056ed2cc28bd39741b685e84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490111, "uuid": "cf221e25-4659-46cc-9dd3-5e45224606b2", "value": "T1A5C34A0675A144FCC15AC474C77FA537EA31B85D13247AAF3784BA712E22E361F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490111, "uuid": "bc01c61a-bfc6-48d2-8e3d-b7974a76db93", "value": "1536:a9/3n/1BCbw3hQNhrIAGPK+a4V6z6xAQoKthgeW4+kWH1/6QqGXDz/hG44NordU6:a9/vaw3hwZGyWYooVx8QqGf/hG45EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490111, "uuid": "3baa7c9a-51cc-40d2-b094-f88eeaa3eec0", "value": 120696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490111, "uuid": "dbf9782f-d6aa-498b-95a6-5c181c1a340d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490111, "uuid": "076b4b02-c7f8-4b11-aefc-c42d45acf6b3", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ff5adb-833e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784444188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444188, "uuid": "29904010-f44a-4721-ba02-eb70c346931b", "comment": "Malware payload (Mirai)", "value": "e9ca425cdbc4912f5a38069fc52c9404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444188, "uuid": "7a20a856-e28e-4465-a999-c2697b0fbe25", "comment": "Malware payload (Mirai)", "value": "7c6127614a344fa43f411021a0a420a62261285208d6a5a2cadbf213777c0ece", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444188, "uuid": "05246dbb-3c63-4fae-a020-f23b744a677d", "comment": "Malware payload (Mirai)", "value": "b89e944fa2986596132b27b270d2ceec154410ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444188, "uuid": "cc85067c-414b-41a4-8d1b-5e55049d865f", "comment": "Malware payload (Mirai)", "value": "9ca73b2dcac23e4fab140d012d65332b4602b5a635b8e5c2616ebd6f7d447582a8ab126b67dd514907f6dd73c3afce6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444188, "uuid": "65334432-c938-49ed-acd1-503a4ac1229b", "value": "T15DA3C70AAF611DBBD81BDD3305AD070234CCA65771643B7A3578C928BB8A54F8AD3CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444188, "uuid": "a3ae3d84-61e1-44b8-b634-98611598132d", "value": "1536:rga3sTUtQnUbXC60BAFLJ7qaufrczVCIyse0PExog5I+bY48:DUaQnUbXj0CFLFioCxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444188, "uuid": "9a2141d2-fe79-49f3-b341-008a1a685cb8", "value": 100996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444188, "uuid": "f260527c-4523-4083-ada9-9ecaede16a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444188, "uuid": "bdfbba86-958f-4699-834d-edcd26942e9a", "value": "Fz0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3b4727-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477860, "uuid": "79cd7ad1-ce4f-4414-9d50-26daf55000e8", "comment": "Malware payload", "value": "a78b26a446321c9fdf798ce4374ece17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477860, "uuid": "4b0d04e0-20d0-4c5a-918a-beed76884546", "comment": "Malware payload", "value": "7d82dff6134fa3a1c184b87c0eed3b1d864828973a8914db57540b6d650afd61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477860, "uuid": "6393008a-4271-418f-b626-2004b1265316", "comment": "Malware payload", "value": "0f974aed20f6b0a9898bbecc61105c976343c856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477860, "uuid": "2e8450c8-661e-440d-8d6e-2f0ee33d01c2", "comment": "Malware payload", "value": "cc79d354ed4a732f0daa8f5ec33be4c540e2ec532b7ffba17a316edf1dc53137cddc91a0fc196892d1b2b87c69620ee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477860, "uuid": "ed80c938-b31c-40d1-b0b3-0e0dd807a72f", "value": "T13AA30763DD269F6AD117E5F0B2F24E781F93BD2A48470B99A436EAE84103CCDB5053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477860, "uuid": "4ef400f6-5f09-4ec6-8e9b-65eebd00ffe4", "value": "1536:itarwCXK+VE77dRCT/oHbBiWQwIm2Poeq:Garwn+0yT/oliWjOQeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477860, "uuid": "71187282-2fad-4a03-b78a-95e998f69241", "value": 101880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477860, "uuid": "39dbfe9e-f441-42fa-90d5-b580766ca148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477860, "uuid": "9e2c7751-733b-43e4-885e-30ac6fc657cf", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb0ad1a-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494287, "uuid": "ddf11563-4bcf-4ad9-ad92-a19aaabb3c9a", "comment": "Malware payload (Mirai)", "value": "79df299c7294c47c7b40c7c089be88d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494287, "uuid": "1fc71bf0-889a-4e29-a3c9-0e6dfa9fd391", "comment": "Malware payload (Mirai)", "value": "7e18534d5a2100286234f677cf74961d656656b6e5070f72ea7ca422e65f05b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494287, "uuid": "2c3a082e-d527-4dc2-8201-7ba11d674660", "comment": "Malware payload (Mirai)", "value": "a622b0f96d753563d2ab7ea835740ea012534539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494287, "uuid": "b16ad1cd-1795-4b71-a12a-a69455d25b04", "comment": "Malware payload (Mirai)", "value": "49ed2d7dd2370f97da3c1795b99afddce7aa7e14e94838395ee882c99748389dde0d2637eb80e760f7abb6f8ece3dfb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494287, "uuid": "6f3c037c-0097-4368-b142-c719e1084ddd", "value": "T1DB830253BE3E4AA8F0E9D2B9275A2D8D2E336635986A3F1F9B404B77234CC5C4775024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494287, "uuid": "c73d8ba7-8e91-400d-8eaf-f6a3aa10a4b6", "value": "1536:GkbJUVjCuHl4xE/6cGSOlo30LDbQA0ZR6o3ATrEMyXL1Nqp5+5p4yFSUeQo:RCVDKxE530DQH8EWyXL1Vp4yFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494287, "uuid": "09f9beaf-bc2f-473e-8c93-baf88152eeee", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494287, "uuid": "4e8e7fda-fdb0-4f0b-97f1-f61526ce4e61", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494287, "uuid": "af78cd92-5e16-4e7b-b4f2-6b4f853fe08c", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c5081b-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494594, "uuid": "2874cbee-0bc2-4e86-afaa-cad111cb7871", "comment": "Malware payload (Mirai)", "value": "118f0ba8256b321e716b21e17cdcfca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494594, "uuid": "8cf2adbb-3d58-42c8-bd44-97ff8412b2ce", "comment": "Malware payload (Mirai)", "value": "7e325a38eec1443f0994011a9be3dedeee626f206bd799d1af7b666207e3291f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494594, "uuid": "53068cd0-8270-49d0-870e-b54ad22ac1a3", "comment": "Malware payload (Mirai)", "value": "c1675fbe6900eea7c4cb78e33c8743fa195d29b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494594, "uuid": "f151df73-d5d4-46e5-931f-771c97c90542", "comment": "Malware payload (Mirai)", "value": "a70b9f66a9f5137c34a19ffeb9b8a36cd2be2b36ddea100b4c85bfe0b26bfea88940efbe8b1935258daaa4e8e9b44954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494594, "uuid": "72cc4e6d-e5a4-4f94-a219-1b157690c37e", "value": "T19A5302B4E39DCC97EE9B7EF6D464C14E73902E4911BC83960EA95FC93B820AC1990652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494594, "uuid": "b531c0d2-4470-4900-8548-c60bb01266fd", "value": "1536:094Vhe+ckWJCqKZotkhkf2vk4UtKeCDuhQ0p4u+qgw0r0:094i+Ne7K0khkOvjUtD60p4u+qgw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494594, "uuid": "0e3ba4c7-f8de-42a5-80ff-b1a6c977a416", "value": 64612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494594, "uuid": "6a2a897e-1080-4c10-8bb0-e0075b67483b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494594, "uuid": "4781a59d-0f05-4dfd-8df8-2fe54c06a978", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ab8e6-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490587, "uuid": "3d7935ce-14c3-4cd4-8b28-37a1efb564be", "comment": "Malware payload (Mirai)", "value": "e19b21d04b3ced50a689892d5c7184e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490587, "uuid": "58c5119a-8f9e-47f5-8b27-4255c17741d9", "comment": "Malware payload (Mirai)", "value": "7e3a29e8a34ee62c5f7c83135af6da4894f5d5aa376a5b27f189e872b105c3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490587, "uuid": "90af1b42-928f-4269-a6cc-ef69e12c611f", "comment": "Malware payload (Mirai)", "value": "098dcebceb4df47b614ef23032a36f934ba0d6f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490587, "uuid": "a2472d6b-9cf4-4300-8468-be4da78ac364", "comment": "Malware payload (Mirai)", "value": "87febf38b9d00e3fd11a7797ca374a50b3404947e246ee27a951ea2a671c6094d35b26a4e0cfa429b7371fdd4993fc1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490587, "uuid": "494abc30-7d7e-40e9-8c80-8c09171f31a2", "value": "T153C31B99F890DE52C6D42675FA5E428C332357B8C3EA7106CD209F3477EBD5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490587, "uuid": "24e0a849-a6a9-4a5b-acdd-7b25e6de8f27", "value": "3072:+0LjWhuoozijB0gUQ4g8OOC9yfhsRRy+J8EsjZf1DljH:+o6j0gUQ4g8OL9yfd+J8FZ95j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490587, "uuid": "8682f8b5-9278-41c6-893f-97c8a0316a26", "value": 120244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490587, "uuid": "0469ba1d-ca73-4bdd-98ab-f9711765283e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490587, "uuid": "0b853592-0848-4e8a-a913-0b69013072aa", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab35fd0-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485774, "uuid": "77d139da-3dfe-4e49-bb86-2f96a6e6806d", "comment": "Malware payload (Mirai)", "value": "438bcd144ac65847883d550fedc418c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485774, "uuid": "1b65981a-d42b-426d-af47-cb2371211423", "comment": "Malware payload (Mirai)", "value": "80c6a1b435f754e522ae28945f0e74a4dc4d712b640881001141ea6044b2101f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485774, "uuid": "42f29683-c592-465c-ad30-0943df0e3621", "comment": "Malware payload (Mirai)", "value": "f0f3925b2f368ce8955481d5f28b6e4abf3d857c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485774, "uuid": "c6ce5749-f617-4dc5-a2c8-8fde59030ecc", "comment": "Malware payload (Mirai)", "value": "57b0d0433e850bc83babda194b4c5c6286095b0ed9e3f9d2da222140c1ade559319491c491c2fadd757fe6738ecd8847", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485774, "uuid": "c97e97aa-25c9-45cf-8bd3-1613b223cb05", "value": "T1CCC329A9F880DE52C6D4267AFB5E518C33231778D3DE7106CE109E3477EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485774, "uuid": "45b91543-d60f-4f08-8615-981e0dd5546f", "value": "3072:ZLaTQnWpqwVpWcchkEi9cYEEUuh99nKOvNwhcHR3aPSU5VwuwU8Tnf1D5s:ZCqqskP9cYEEUuh99nKOlw+daPTRKn9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485774, "uuid": "93d3dc28-791d-40f8-861f-ff13cc1f0515", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485774, "uuid": "596122e5-24d4-43e0-bd0c-b1fb2f40bfc6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485774, "uuid": "dba295cd-fced-4f9a-b1ac-82b4b7e0d27b", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c810a10-833e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784443928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443928, "uuid": "0f9a94f7-220f-42fe-9aa2-7862cfc2922e", "comment": "Malware payload (Efimer)", "value": "a18949d2a1538d75a0905f16097d87e6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443928, "uuid": "96dc8024-c2bd-4789-a36d-29906f003843", "comment": "Malware payload (Efimer)", "value": "810bde3f1534d6f35c09a748bfc887308dc25d9492149911f116220852273b5d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443928, "uuid": "b709ee0e-dbb1-4cc5-982e-46f3a39c9958", "comment": "Malware payload (Efimer)", "value": "49b48d1342715e3bbaaabaf7849c679c5c5a01a9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443928, "uuid": "754c1dc2-48a6-40b9-b0f1-a0ddb52c47db", "comment": "Malware payload (Efimer)", "value": "8039eaafe1d984c15901070fe759ea73346ab2f00dbf9ed196394a0ebb45338e18bc25cc61f137d044a3fa072a82acbf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443928, "uuid": "2f9552a7-bb38-403c-b6fd-be9747a57864", "value": "T1F6E633A4B5F001EEE5A3413DECE185D1F17AB47A0B72C69F63A446293D630E14E3B71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443928, "uuid": "083c7fa6-827f-47af-9817-6ace03ca7cfe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443928, "uuid": "a27c739a-3394-46d7-b93b-7434bbe43aa2", "value": "393216:lX1iNDgY6Vl9+t/oPeqnmCdWqXMCHWUjXHcuI3/PGTAI:5EOY6At8nBdWqXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784443928, "uuid": "caad3642-2fa6-4ebb-a743-9be9fda2d9eb", "value": 14310488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784443928, "uuid": "9b04c6b5-3ad6-41b4-bf03-b38f7fb0ec9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443928, "uuid": "8fea5879-eb09-45df-a178-bebfb39eb3b1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2414c3-8392-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784479930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479930, "uuid": "91dadf58-a7e6-4fc7-9c55-3bb183967892", "comment": "Malware payload (Efimer)", "value": "cb914b406726a668f03c5ecabf999c20", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479930, "uuid": "6968c968-dd8a-4fbb-875e-e02de2b53141", "comment": "Malware payload (Efimer)", "value": "830418fab925fb6b34c1e819f7e099ee92d6b5205bf4c73586f0bf7430e72080", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479930, "uuid": "8acb4fe4-c361-4b2a-ba8c-d9f864188e72", "comment": "Malware payload (Efimer)", "value": "c1b656b3429c525817df649d24f44a4d6f0a51f6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479930, "uuid": "c41ece8a-ad15-494e-b163-b10638505d2c", "comment": "Malware payload (Efimer)", "value": "d44e2bb5f94c7917964ebfa05ed37fa23d13d4528ff0de126267c35266944635c4c01dfd952a2583571b8e42ab76bd6e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479930, "uuid": "02d320f9-789d-482d-9fd4-d381f4184ff1", "value": "T1D9E633D0A2E006FED6B3613DADD25186E0B5746B4771C9EF43B892906E272F08D3E257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479930, "uuid": "cc3a8d27-7b2e-4d6d-b464-cb794b181c03", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479930, "uuid": "d652f323-ac1c-4228-8bef-061a885604d3", "value": "393216:9gqr85nFa0uqWLj47b9nT2Od8+XMCHWUjXicuI3/PGTAI:9Lr8duspvd8+XMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479930, "uuid": "113fca2d-99ce-4d85-8282-983a6b9445f9", "value": 14286672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479930, "uuid": "502c25ff-0dd3-487c-a98b-385178943a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479930, "uuid": "825371c7-3daf-4b49-aa9a-1e910b07450a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a6c5e8-83ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490866, "uuid": "b93c371e-f432-436f-921b-73f6cc035e4b", "comment": "Malware payload (Mirai)", "value": "f80c18e117f6a2e174173654f510310a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490866, "uuid": "5350a509-0dc4-46b3-9d69-0568779c9bea", "comment": "Malware payload (Mirai)", "value": "832c3e4004d79744f87c1ad2ae9bb148a9ca37c8b61de222ad4a1c8419c392be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490866, "uuid": "89f8fda7-4a22-4285-ab14-813de3d755fb", "comment": "Malware payload (Mirai)", "value": "a10fb1e0b6c4833a0031b7fae115e1099c9b8a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490866, "uuid": "7238f11e-3446-4387-80e5-73019e19d580", "comment": "Malware payload (Mirai)", "value": "79acb7c827bbf262c71a014f5fc3fcdb9cbfcbf4d47f97605fb375bac95710120fb82788275f08c7699b200d663f5d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490866, "uuid": "73b4e1f0-83db-40b3-a3bd-56649c8ef16c", "value": "T1E0C329A9F880DE52C6D5267AFB4E418C33231778D3DE7106CE109E3477EBD5A0A7A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490866, "uuid": "b6a7a528-f40e-4e1a-8140-ba19e7f08aad", "value": "3072:/QOo9ZpcaV+KM2uxISzcYEEUAopMWQNwhBiMuGzX3EN1FpAjuKf1Dl:/x8z0xPzcYEEUAopMW6wW4zX8yCK95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490866, "uuid": "2e755267-13de-43b1-8079-42b873a84ee7", "value": 124336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490866, "uuid": "5d49ee18-eddf-4890-8913-f5d001823424", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490866, "uuid": "321357e6-5d6c-4800-a803-a2d4021eaf5a", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a48a831-837b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470231, "uuid": "6bd0dfb2-e984-43f9-8ca8-894cf3a8a9e7", "comment": "Malware payload (Mirai)", "value": "72c1a517bbc61fc5ac1df7d6babbc7cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470231, "uuid": "24287297-ac7b-4a77-9266-df70d4462619", "comment": "Malware payload (Mirai)", "value": "83b1a2347d0feee81edb14b0794589ecb30f527f4de820dd2e2359f47ded2291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470231, "uuid": "051a6b39-98e4-4218-853c-7404287cb934", "comment": "Malware payload (Mirai)", "value": "c25c0ac06707cf9e0fa1927fb91cd870a4dc5427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470231, "uuid": "81fd5ac2-29c1-415f-8f8c-778e4feb98cc", "comment": "Malware payload (Mirai)", "value": "3c4ea10a23b360d6c5db0b32549eebcae9d60bf5f8ad7759e1ac524f25c1176333be9379627c5378965460e99675f7ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470231, "uuid": "2f8b4b18-c4f7-4586-ad0b-19508d0d7903", "value": "T1DEE2F167164EE126C8B14C7FEB281F83BBE7177AE0EBA0BD78301F5880A86835557141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470231, "uuid": "9b1215c0-0a89-429d-bb81-9ec347c9d2f0", "value": "768:4dXd3x3CyKvqr3CNCApJW1+t0sC7rCgVw4JHKs3Uoz0:4nB3rKvOuCWJW177/x1Hz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470231, "uuid": "56405219-1c6b-4e7b-80fb-c49997afbf4f", "value": 33944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470231, "uuid": "06e4b8d9-4ed8-4583-a608-047380275102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470231, "uuid": "76a13f7d-fbbe-4aa4-bcbd-5712adcfae4a", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0aebb8-83a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784487575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487575, "uuid": "d049ce88-7880-453b-8ac4-09f69f2963a4", "comment": "Malware payload (Mirai)", "value": "e558574ed62e9abd1612690a704dbed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487575, "uuid": "c6185c9d-bb4b-4e81-9932-8620f649ba72", "comment": "Malware payload (Mirai)", "value": "83ecf6bfff6205592e60c815b6eeb59ead730f88eab9e1e3a30552853906a0f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487575, "uuid": "2b17223e-9d1a-4588-ae5d-ef9dc6c7a9ff", "comment": "Malware payload (Mirai)", "value": "d2f63d63312e6c87cead79fb6b6e3c7454efd0d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487575, "uuid": "fd3e26f2-76b6-4432-a16d-bef92d7537b4", "comment": "Malware payload (Mirai)", "value": "db68a42164de4781878a36973e2d37340794448eb8c52a01c9d48080f56619ce26ed0246e1a9c2527e092905a3de1544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487575, "uuid": "183758f5-5ecb-47b2-840e-a1e2dd5275e2", "value": "T139D3E709AF611FF7E8AFCD3706E92745248D691B21A83B397934D418F24B28F15E39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487575, "uuid": "b27a7053-4bf6-4b11-8843-37b00b6925d9", "value": "1536:0Iwhb1vXkjZEgpKChXm+PedOBhvFeN89ekc45hdWPmyqT+/ZAo9/wdT3zccfp6gP:aP2EgpKChW+2i3nWPme/EhTpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487575, "uuid": "fe38bdcd-2d3b-4bef-a71f-cae27748126f", "value": 139044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487575, "uuid": "d7204ab4-4d34-4fe6-893d-7dc9766fe29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487575, "uuid": "4213caf6-0389-4e57-87ee-4f5053c31743", "value": "ohshit.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff970dcd-83b6-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784495742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495742, "uuid": "04242852-753c-4ad4-b4a4-7baa2eb03519", "comment": "Malware payload (Mirai)", "value": "274c91dac0c6d00071302b9d240b3235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495742, "uuid": "8c2caaf8-6a0f-41b5-be40-011fde933fd4", "comment": "Malware payload (Mirai)", "value": "84663283b52f26b77e50a02b6add00509d683800de816b73b5bde614d170ceae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495742, "uuid": "52509d1e-0f67-4987-b8c9-17949c8ec383", "comment": "Malware payload (Mirai)", "value": "b7166faa6e1b3857c5632aaec531d61710ed7e52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495742, "uuid": "4377de2f-6835-429c-84e9-c1f34802eb10", "comment": "Malware payload (Mirai)", "value": "76315bc14bf60978588b5663eeb16ddd363076541d2dac04bff7da744e5d2a5546a63840bb6845d066e1c7c8a9ba5da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495742, "uuid": "6703c894-1135-4fb0-9358-cd73f859ff93", "value": "T141A34B47B9C098FDC599C03857BF7236C422F06E1239B69F23C4AE12399DED02B5A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495742, "uuid": "0cd3bed1-2b46-4f36-9a12-c6b3eec07eed", "value": "3072:ret+Olv350AbjGut2knIhiKLWiWHXgiUVbf:ret+O534KIIiWsVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784495742, "uuid": "84c1ff73-d704-42e9-8764-96b2b2653b36", "value": 102608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784495742, "uuid": "b889540f-dff5-41cb-b923-02d2b426145d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495742, "uuid": "9d64ce93-ef2f-4828-9742-dcc4f81d8dd2", "value": "ohshit.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98a753a-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490041, "uuid": "8a432605-5fac-40b8-af38-66f1580fb42d", "comment": "Malware payload (Mirai)", "value": "380e48e510d32574db27554709e0d969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490041, "uuid": "8ba21ab8-c327-41fb-972b-701a34442b27", "comment": "Malware payload (Mirai)", "value": "869480fbaa3c659b331eb523434aa96e031982c626cd8f7e753dafc9e2ab841a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490041, "uuid": "73dfa579-e27e-4a3a-bc22-142dadd63d28", "comment": "Malware payload (Mirai)", "value": "3a3cb65d9d7cd970d5fd9ee9415cb608d373cf6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490041, "uuid": "8140b96f-933c-4cf7-89b0-0ee96a077987", "comment": "Malware payload (Mirai)", "value": "077fc54960de02115e327203a70e9ae1422fa0bd85b659a2d5bdfe29635ad077ce2bfc3da5cee5da462e7b3a01e8d1a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490041, "uuid": "dc43a888-16fe-4610-be34-b13827b889c0", "value": "T11A4302F31A25F622DBA539B15686A35CFE0A1C74D9231B0347C867DAC0D3E155C36F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490041, "uuid": "47179159-3558-4339-aac4-295ec1b32779", "value": "1536:+OZ1Uw/Md2+2huq5hjD0IhSA/34RERpmn+ORnN:RZ1Dklq5NoIhS634iZmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490041, "uuid": "f9102f23-1430-44a0-bdde-9c5fd527e7ad", "value": 60140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490041, "uuid": "62db4f31-499b-4f9c-a356-25bf2760bb48", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490041, "uuid": "f8446bd7-ad6b-4377-947b-2661b0aa77ad", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86b0814-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484912, "uuid": "7e1879f5-4fdc-4b7f-95fb-98c50aa866c2", "comment": "Malware payload (Mirai)", "value": "039eb8843a98326ecf9c782fdef61732", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484912, "uuid": "6cf40b8c-f1ce-437a-af1a-1b5aba05a168", "comment": "Malware payload (Mirai)", "value": "870a29510973180ae6ea615c5115557ad751a2683b20a33a1f83a2b95ea77378", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484912, "uuid": "8ed15d98-8934-4887-9634-fa90845dfbab", "comment": "Malware payload (Mirai)", "value": "71317adec0ee35cdfd576e2a7799acfa1feb87a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484912, "uuid": "8d1cb61e-2400-4808-bde0-e3fb63b169cd", "comment": "Malware payload (Mirai)", "value": "82d63ba105cfb7ea1f9e28f2b9df625398aa4fc6097201cb45b82910f2d19257b8202cb5736e5b937895d0510812ba94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484912, "uuid": "5abbfdfe-88bf-44c9-9665-c2e199a008c5", "value": "T1B9A31AC1FA8B81F5D81788309167F33FCA32E4A55071DA5DEF5A9E36DA335C1A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484912, "uuid": "5cd0f59e-7de2-432f-953b-a429b8f29f50", "value": "1536:29KuRtzaCU4a6uEXyBjI76a6G/daYGlsLJJblEQYWQyKpnGn2NV1yGXlpb18:2YuRM356PyBjIT/Eobh3KpnGnMVLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484912, "uuid": "36e82ed2-a3d6-467a-af50-2b4b4b81c18c", "value": 99604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484912, "uuid": "516f7ee9-c669-4fe2-a985-a4b22c64aa52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484912, "uuid": "52f7d30c-9987-4b04-90af-cf01af3117ae", "value": "ohshit.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169010ff-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784479030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479030, "uuid": "bcbecfda-72e8-4119-9bb2-2403ccb86a90", "comment": "Malware payload", "value": "dc701168ac8bd8adfda30b0d1285120c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479030, "uuid": "4f880257-3b60-43a1-ac96-75d2508f6998", "comment": "Malware payload", "value": "87a2fbd422bfc36691da037a288b6fd151bbb8631081c447e616c6fb55494e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479030, "uuid": "377be04d-bb97-4de7-8507-ef8774f3855a", "comment": "Malware payload", "value": "ea53f33ba22f8311429399e567935067676c2b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479030, "uuid": "5459582f-2a2d-4524-ae68-d94301bc4527", "comment": "Malware payload", "value": "919dc278f6caf2d25b081a5394a4cd7099c72f620c802ecb40f7609de9834787b461bbaac5c2640a0f928d6efa28d31c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479030, "uuid": "6fa8f2cf-8916-488b-ac08-9ca7fb16cb60", "value": "T1DBF3C6066F518EB7C86FDC7306F58A0124CDF4672564377A3274EA6CB91A58B09E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479030, "uuid": "ef78b0b4-699f-4837-8cc1-3d25af7c24c1", "value": "1536:kv0MezJF804uaC1OpZtr2UfGdNFQNUUZE4qv1wT2pmAhTBgGQdsffpgddRO7cnVy:kv0MPQ/FQbtipm4BEuffKddlV9xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479030, "uuid": "16e3652e-2672-463b-938a-2f6f78e18ec9", "value": 171908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479030, "uuid": "0070f4e7-e418-4c44-89df-5b24ca512035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479030, "uuid": "e2604cf0-c976-4dcf-9742-ef2173386dd8", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f972ae58-83b2-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494013, "uuid": "db1dcc8b-0edf-4e94-b87c-e2c6e56800a2", "comment": "Malware payload", "value": "61200aff51ab858158dd5a07f8fa0251", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494013, "uuid": "ed96ea8a-ea99-46f4-afe4-f7faedef4fa1", "comment": "Malware payload", "value": "87a6acf1290e94fb921215d3f38dd4a9cde047cdca269be20858472b23a1efca", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494013, "uuid": "5f36dbc8-eb39-459b-b2af-5d3d04770813", "comment": "Malware payload", "value": "e5a816aeb0797e25bd4ad339c340ee0a326f0f02", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494013, "uuid": "0a7a1f3a-1774-405c-802d-fb9d67b027f7", "comment": "Malware payload", "value": "2cae32d1e7f2af96f469c9135554ab74efa8fad5adb099f058ca43b8502cd471e6719a318ef07ead740a770863959a04", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494013, "uuid": "834e4795-e4aa-44e5-ae96-7eeb5df63e53", "value": "T126922A0FBC118216D0D104BC9272EA7B59B9A8BA3784A5DBF38054DD8C796C1F83A95F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494013, "uuid": "8abf1280-1934-4dc7-8f00-fd434523b75e", "value": "336af67e3c3ea289aa995d883efbf941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494013, "uuid": "92cfb504-e163-41e6-8a6a-e06a7ade6dc8", "value": "192:iK/Nc/JifyHIbgr+o5nq3q0ydUlg9vIDlLjuLWdewlEW1KUShhzQ0o26p7JxTopu:iLiaHJnqaglkmlLVMwZuh587cpHB9ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494013, "uuid": "20a0e6a2-92b3-410a-b944-1995491e8342", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494013, "uuid": "fcd54d8c-09df-4d9e-ab08-950cc350f2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494013, "uuid": "ec37d6e6-9a3b-453e-bb43-5243e12261ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfb38d6-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470451, "uuid": "5e3aee5a-9ccc-4593-b14d-719e4a8ae65b", "comment": "Malware payload (Mirai)", "value": "aaaf2354aa9ea0f5c22e13b6d08dc943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470451, "uuid": "18e75aa5-2a80-4838-9f12-2800a51f4ff2", "comment": "Malware payload (Mirai)", "value": "88250c45df9e6c83521d02462346357b53bdefdfd6bca643fdceb40476c30449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470451, "uuid": "79f42ac8-f1a8-478d-bff2-b53334ca86e3", "comment": "Malware payload (Mirai)", "value": "8f5dd485376d6b751dcf5391dfe6ffedc6849a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470451, "uuid": "81226bf5-8411-4802-9475-3e2e37206e84", "comment": "Malware payload (Mirai)", "value": "974ef1f99fb3579bd4abb06585fc960334da5586d26a2503941386878248a6e0b5d594d238a8f995e0fbe3677dec261c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470451, "uuid": "cbdc2485-4044-4692-8bca-5a5f27d0818d", "value": "T1D95302A5F6C84C60DB97BC987FCBA08155043B403974CADB8BD81B1F6F662B37C50599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470451, "uuid": "34f355cd-6b1b-4dd4-9faf-07775d02917e", "value": "1536:X60FQ+W3RZR2vPD96+NFaDXIC8NALFS/1IkZct4u+qgw0re:qIQ+Wr8c+bsXIZNALc/D6t4u+qgwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470451, "uuid": "e9624359-a7de-4531-a8f8-bfb184a7a3ac", "value": 61880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470451, "uuid": "f940c2f3-6d49-4506-a2f8-b4efeeb97ff3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470451, "uuid": "07d7e828-6af1-44bf-b975-0c907f055390", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0d17f8-833f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784444250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444250, "uuid": "6550d071-2fd2-41eb-a885-a1712acfcf2a", "comment": "Malware payload (Mirai)", "value": "32e93327eece539021cecf5527a02a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444250, "uuid": "e4ac8555-eff7-4947-9845-619c095d2955", "comment": "Malware payload (Mirai)", "value": "892b2f08bef68739f3e4793db8f5d7c3467f8672c79a14d1d025679af46f9a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444250, "uuid": "dc60d4fa-dc5f-47b9-97d8-c957d6e28b29", "comment": "Malware payload (Mirai)", "value": "d0220a3e01f9a5e63080d8668d5956d5d600ab71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444250, "uuid": "6c73aa9e-b23c-4db6-aebe-bc193722d0f1", "comment": "Malware payload (Mirai)", "value": "0389501750041d34fdd51a6b67170c4b7a4dacd68ba34bb20e38ff21c51ecd83807a8dcf1335f130f944f94ff60b2729", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444250, "uuid": "e4fbbeb1-bcff-4edf-a090-8542f31869ff", "value": "T191631A76B9818F26C1D52677FF1D8348335723B8E3EA7113EA156F6137CB82A0E2A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444250, "uuid": "6b20eba9-48c8-4ed3-a2e8-11f4e90e0721", "value": "1536:XfjOjm6KLFw1rAyKsYe1NPSbAb1SjH/LO7RvmABWriZcP1FO1U4ISF:XfjOjmnFI0oVNu+1SL/acg0EE1FO1U4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444250, "uuid": "3e9185f8-219a-4582-973e-6a1afe1c0375", "value": 70816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444250, "uuid": "f96c1daf-0cf1-4db4-a1a8-32acab8f89cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444250, "uuid": "4e36078a-2855-44dc-8e3b-99d874b56817", "value": "43Ob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4a0bf1-8305-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784419371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419371, "uuid": "1fc495bd-5f36-4a15-bbc7-e40042f4f008", "comment": "Malware payload", "value": "39576cc0fa308c776d4c5376fcc8ec29", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419371, "uuid": "282ccdfc-7291-4dff-8f09-3ad3717a5960", "comment": "Malware payload", "value": "896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419371, "uuid": "d51c6fdd-c043-4a33-951f-61122fef7580", "comment": "Malware payload", "value": "249a07e3a0b3d780f3b5f0f8267812512441e06a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784419371, "uuid": "644b3b94-2b07-4d4c-8899-fa88eae07fb1", "comment": "Malware payload", "value": "da5b97c0c7b71c34c514ab4d5b14ae36badbf8b5c61b79168923b63b8eb0b1f330fb67e4fc41d87f6340702f4b2b3342", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419371, "uuid": "40437d9c-bb87-4f65-93b0-36e0766d01b3", "value": "T1CAC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419371, "uuid": "ee2e674d-f563-4e3c-a3bc-1931cc7364f6", "value": "768:g8vCB+25j6es8Rs99FYpMSUpi+20qUpi+20YQX:g8l25JWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784419371, "uuid": "484242e2-3bda-45d7-b124-439e2d0e0435", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784419371, "uuid": "dd7dcc95-f848-464f-8fcb-de1f206e33c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784419371, "uuid": "d1a06030-270f-4113-b215-228606ec399b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a8cb71-835d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784457261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457261, "uuid": "cfc6e65e-c743-4b66-b31f-b51a9b056afb", "comment": "Malware payload", "value": "cf5ca7ae7ab8a1ce15601bc1f726f22a", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457261, "uuid": "579c4760-67da-47b3-aceb-e1dc584a435f", "comment": "Malware payload", "value": "8a70365b9d9d47e98c7d1c3ec61f7c93eed237e79481bb1d69373c85934a2648", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457261, "uuid": "649a8537-6135-409c-822d-c22d4f88bde2", "comment": "Malware payload", "value": "22a5e10dc0b5a1be0dcd155adddd3397a48655f3", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457261, "uuid": "aa757bf6-faee-47eb-92cb-e4c656e91d81", "comment": "Malware payload", "value": "1d221c152f7605e8d1b54c61c77a2c2688ec90768ac742f5c36ea4aa9a0a95134565981586b855f0f25aeb6fc962e8e7", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457261, "uuid": "d140c4a0-db9f-48f8-94f0-81a6bc4d00f3", "value": "T11F08335A191EC71DFDAB1C750F22E661E702D3770978C80D16391DA2BDE3B8A683C267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457261, "uuid": "8de5e86a-1e82-453e-a02e-ca8fb79db5d3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457261, "uuid": "0a5beb6e-ade2-489a-9ecf-0d9e00ebd1ba", "value": "1572864:St9IKPw0nv6YPvDqkrIKxGYFlGmWlwPDOuUJ5UsyuRuGDzp67dzmo+WI7:SUKRnSKL5/cYull+q/FyuT6hzFXI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784457261, "uuid": "1386a4e1-5a17-443d-bf13-53c317ed5acc", "value": 83027553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784457261, "uuid": "9666551a-f211-4724-b724-a801fe199b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457261, "uuid": "03e36e07-4c10-4b35-81d0-a35948d3afce", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745745dc-8316-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784426788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426788, "uuid": "39d4fd3c-02c3-4d3b-9a50-e5ca6b4fb92a", "comment": "Malware payload", "value": "883f15985088fae4dc40a742a8f5eec0", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426788, "uuid": "08cd0a74-0481-4d84-a455-40f8c10ec6b3", "comment": "Malware payload", "value": "8c582d4d3d953bdcd6a9956a2d928bc3af0889b73b19b8e573743840f92e35e0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426788, "uuid": "1a149639-e946-4327-a9dc-c054148f76e6", "comment": "Malware payload", "value": "315d75cd79288a91bc89055d7402b725c7bc8257", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426788, "uuid": "f0e3d805-4f3e-45a7-aec8-1b4f04f65d0f", "comment": "Malware payload", "value": "b863cc95588e2468b7a4539669def785dbe77f28df6a82751191deab9d2c2a8c289593116582bd40951d6c2cee6eb8f6", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426788, "uuid": "c9af2763-8e74-4fbf-9dd1-cf1756bf4897", "value": "T1C975B016A3A801FCD077C2B4CE57960BEBB2B44A1334A6DF57D09D962F23A715A3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426788, "uuid": "2436095a-1880-4159-a203-4ea123b1fcbd", "value": "94e1c85e15805e1e413bdf491fdaa09c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426788, "uuid": "77f5808f-4057-4317-b3ae-770c14c32a02", "value": "49152:13bWFJs0UztTKmUDr9J0bxIjGKB0RhbF7J:UFy0U8YxGeRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784426788, "uuid": "1c50b5e8-4348-4848-b312-e501d28c5f2d", "value": 1682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784426788, "uuid": "55f04379-6304-431a-a40d-17914a882df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426788, "uuid": "e6d0c35c-8142-4996-8d1f-a3f3d93d9ced", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd9da0b-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467014, "uuid": "d786609c-1b4b-4860-bae8-a75bafdd7e00", "comment": "Malware payload (Mirai)", "value": "6e49ba658d504f17b11ab01561ac8b5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467014, "uuid": "ea39ba4c-5ba0-4a28-9e64-9a74d1a3c887", "comment": "Malware payload (Mirai)", "value": "8dbd3383a88d2e4ed1060e576ef253964e6eaadfe981b5ff63747d33abfdf5ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467014, "uuid": "a2c44fd8-1dff-4199-82f2-4be532f0c50c", "comment": "Malware payload (Mirai)", "value": "24fec7deaa9c247d0bbb8ded23f158a6072ca46c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467014, "uuid": "be684dc8-6c4d-4be0-a437-401b9e511bfa", "comment": "Malware payload (Mirai)", "value": "334729392216716cfa7c0a49c051d8f1326b3ef3f9d1509131df93a57e00eda91ec820cddff60a06062ebda5a191e80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467014, "uuid": "0e2a5773-3d3d-4be9-8ec0-6aed6644cc34", "value": "T19063E80AEF510EFBD86FDE3749A90B0231CC954722A43B393574D92CF65A54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467014, "uuid": "d9d219a8-2170-4541-9bb3-78db2060c6cb", "value": "1536:yHVWkvjQYLcdUv9vbLygdaVHX8w44JIm17irRje:yHVWkACBLmD3f4je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467014, "uuid": "93383603-541a-4578-935a-41296b8c7ccc", "value": 73140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467014, "uuid": "be276568-396c-4e62-b394-d97ff206b473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467014, "uuid": "ee85e738-656d-4d24-baf1-82fa9be98927", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1016e85a-837d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470858, "uuid": "3ee97889-bf28-4ed9-9d00-74a6db2c4c58", "comment": "Malware payload (Mirai)", "value": "ee4d7f0f4fc33f4f433bf345e8bfd630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470858, "uuid": "1ab7d63e-c894-46e5-9803-029d45432c4b", "comment": "Malware payload (Mirai)", "value": "8ec3a5eeb2249aad19b85e78e23d799109654cd56c7e1caff3881a0d3f97f208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470858, "uuid": "1e99b7cd-d54b-4472-9231-d4e039d06717", "comment": "Malware payload (Mirai)", "value": "654919023d60ba2d43eab1edc9337bd64ad26af5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470858, "uuid": "8cfc8ded-7a2c-439c-9148-36ed0f72b523", "comment": "Malware payload (Mirai)", "value": "1dc8ae204cb5d3aa4c6261ff46afaab89516b21a237df4e15fb399e24f6420d0422011861975ed13fc6ad50fba0da3cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470858, "uuid": "bc81774a-1a41-4809-8225-2dde58dc7aaf", "value": "T13F536BC5AA43E8F6FC5601705177EB378632F53A1129DA87C7A9ED32BC52900EA2735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470858, "uuid": "30731bc3-c0ba-4cd4-9c75-1871e165fbe9", "value": "1536:/swxYLBG2V8aKvyq9zJGYJqq2sQYjgS9eA7qX8eCFiTGEU18F2WarYXSE:EwxK02V8aKJuQ289Rs8x8Trc8QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470858, "uuid": "f338f2fa-01a5-4952-b523-b84a5b398408", "value": 63072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470858, "uuid": "f6b8a4fe-9b93-4dd5-aaaa-41535d99c5df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470858, "uuid": "641c16a6-24c7-4801-b911-1a77f8404050", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b68a5f-8336-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784440640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440640, "uuid": "bdc236c4-a116-47f2-88b0-7a388fcff11f", "comment": "Malware payload (CoinMiner)", "value": "692772873985269ccfa0c3df17fa15b4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440640, "uuid": "aeecf2d6-837c-441a-a22e-b8966a24d143", "comment": "Malware payload (CoinMiner)", "value": "8ec920a35a7c6dd60e4aeb3b1ed09cd344f4c5191d4314a05ce72bf757377c86", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440640, "uuid": "e054136b-cf4c-465a-a930-ed3cd5c4e8c8", "comment": "Malware payload (CoinMiner)", "value": "d95acbf73d039116d444cf854648ee879c8be027", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440640, "uuid": "c8825645-aedf-401e-a4ac-c30dfd46e270", "comment": "Malware payload (CoinMiner)", "value": "184d22c3fc30da3a776d2785e9d29d46df58bd4052ff54973412ee0e9a34bb8c364404ee7b627dcdd15c5cf3f04cc3fd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440640, "uuid": "8c61598d-5642-49df-b90b-394bfe9079cb", "value": "T1897533829CB4763C97B4FA2998E483F2A539AF81355D77D0983FC84A604D2DE2F11C27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440640, "uuid": "e7faf214-afdf-415d-8ae6-ab81c6c8c8c2", "value": "49152:SnjgDyUstKVSXfgPFqBDFv+QGGdL/hn+YZUU:gghstKVcIPOsQR/dZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784440640, "uuid": "dd1e37ec-f682-4117-b506-fd31f9bbe891", "value": 1684968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784440640, "uuid": "a9fbd83e-c566-48bf-9232-11db51d651fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440640, "uuid": "03fa3c85-78ac-4788-8ca7-010b11223016", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b28a79d-8393-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784480487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480487, "uuid": "e4cf267d-4694-487a-a343-3d714a311702", "comment": "Malware payload", "value": "79bf3428c09f50ab55871aff5d6fe67f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480487, "uuid": "bed77b9f-4b69-4498-92a3-cdffaf577ab3", "comment": "Malware payload", "value": "8f04100e8545056820957f9e010c3ffd83f248329cb369487e6d04f4a19c4385", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480487, "uuid": "76bc8139-201c-4de2-b501-af3821832498", "comment": "Malware payload", "value": "848377aa3ef6b26846a0fad5b9e1aff3d8198258", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480487, "uuid": "21b5c1d9-dfb6-4489-95cd-38abe201f606", "comment": "Malware payload", "value": "2b204a9fb9801b6a83f5760051937db8252f331676da242ea601c760a83fef4df48315147e4dd99ab7fb921c384a9ff7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480487, "uuid": "e12df30f-f6a5-418c-af6a-5c2c613d623c", "value": "T155D3E7B0F21031EA7323C65971D0FD862619A153E6664EB7F22F25E88F845CB1673F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480487, "uuid": "2f65be85-e77c-4bfa-aa46-8af812d9cfea", "value": "1536:Cw/a11IuiHlq5m/8lDbNmPbQBt1XOfN1NIp:qnMTQ8+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784480487, "uuid": "090c642a-39c8-4ab5-8cd5-a4b7a06b3391", "value": 134961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784480487, "uuid": "321dc066-1343-4371-bbf7-ea316b9f919b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480487, "uuid": "c1c9a11b-bf23-4982-ab1c-4bfc22a49af5", "value": "Purchase_Order_Invoice_1025.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005cf979-83b7-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784495743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495743, "uuid": "e648a124-4e73-4350-8883-9fb4e1e6ef10", "comment": "Malware payload (Mirai)", "value": "d67717dfe2ef86bf41898282441ecc87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495743, "uuid": "50e41cf8-4243-4aa7-ae84-9229a933c466", "comment": "Malware payload (Mirai)", "value": "90619a191808a0490e66813818250dbe66f36aed2abfafb162704027b0aa9adb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495743, "uuid": "6b5d0d0a-b307-44cd-877f-d2a9d10275a6", "comment": "Malware payload (Mirai)", "value": "0f9012c4c7bbd363eca84cd0fc0b5bc653ee73c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495743, "uuid": "08a48e29-de1c-4699-ab42-4056dd58a587", "comment": "Malware payload (Mirai)", "value": "450a55c19168138a9bcaf3e4e346b5bc6ba65317817774e37e564464d38b7656976e485be9cea2d13e8f88e9bfcae83f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495743, "uuid": "32a3d808-6bd6-42e5-a8a7-c3765179557a", "value": "T1C6D3F746BD518F13C5C321F7FBDE429C3B166F6DD6EA72029921BFA027864D60E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495743, "uuid": "4905f64f-5848-48dd-8637-bd9c1d6193ef", "value": "1536:/vNexCDqAt5BPJ4Vg5I7Ajnh0lQlOLRPQog9AlUvwywxqofQ238Z5VODcpKqvtRS:teIDq4RJ4gIkjn5O61VttRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784495743, "uuid": "46bddf59-8cb2-4ed7-94fe-dd210008a354", "value": 132836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784495743, "uuid": "ab0e404f-17fc-48b0-aa51-cb45a31d217c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495743, "uuid": "0ca28d7c-61fa-40ed-9880-67742b7d79c0", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309035c3-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470483, "uuid": "b42cc8e7-d869-46ef-a3e5-5d01037bff17", "comment": "Malware payload (Mirai)", "value": "8436a989d72b0f7117e6019c125c034b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470483, "uuid": "89195b5c-aaad-485a-969d-2f274a87b1b9", "comment": "Malware payload (Mirai)", "value": "907c11d72abe232d52a504e12e0a66ecf3157c4928f2ad1a65889f15eaa09071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470483, "uuid": "1aca7dd7-b062-424f-821f-e46b2285992e", "comment": "Malware payload (Mirai)", "value": "d516a39b2068adc2aeb38bb696867388c10b35e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470483, "uuid": "005a77f2-3393-4285-a1af-db7a6ce46ffa", "comment": "Malware payload (Mirai)", "value": "2b5f349d5f31cca56a7467d4969069eba680ddf06f2e7589bb8ce51e38a87f8c9166aeb2d36fc741df0c2a8cbae2aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470483, "uuid": "a91cde47-1a93-44b2-b729-54fa791cc31a", "value": "T144B32B99FC80DE52C6D52675FA5E128C33235378C3DA7106DE209E3477EB99E0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470483, "uuid": "b578edd6-e6fa-44ec-a8a3-d5a78019d455", "value": "3072:xo5zeklio1i0cyUQ4g8OlCuDhJAKswbLdk4Pf1Dl:xaiklKyUQ4g8OAuDhAwbLdzP95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470483, "uuid": "1a7204a4-02fa-46c3-87ca-6ff3d95301e6", "value": 116140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470483, "uuid": "6cb699b0-8e6d-4266-8749-d2d497a8ee0d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470483, "uuid": "3d53b6a4-bc40-4240-a5eb-128372f463e5", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fd2ed4-834f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784451145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451145, "uuid": "e25e1276-c3c7-44aa-be66-b6669adc0ff6", "comment": "Malware payload (RemusStealer)", "value": "1d5d1b7406549c196c99ffe32c45cb43", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451145, "uuid": "38860ef3-52c6-4067-87d8-9a8af7c1b6c8", "comment": "Malware payload (RemusStealer)", "value": "9165775115574e755cc95bd2aa1a0b3efe2b20c720fb056cfe90669bf8c1d6ec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451145, "uuid": "3547429e-e38a-43a9-8cea-733a904da36a", "comment": "Malware payload (RemusStealer)", "value": "8d8af8f0a95d80022f0a4927da4dd8ba436ea765", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451145, "uuid": "efedb9ef-bc87-4b7e-8782-2742b400063c", "comment": "Malware payload (RemusStealer)", "value": "a224ded43c58281079359cbcd87d53a5f9884db469f8f64dd16758df4472e511c436ae7175c1e3c12d76cf8791743b51", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451145, "uuid": "20716b0b-05e5-4617-aac6-c9dbacf568fc", "value": "T16FD54917ECA158E6C09AA331C9B79246BB35BC081B3227DB2E90BB782F727D05D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451145, "uuid": "b437deda-8995-40e5-8908-1d0657ea960d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451145, "uuid": "75fc40cf-ad45-43fe-ac93-ec301f98e6e9", "value": "24576:uKoxM2ZJ+jXWjVmSORwaZ1rvpjToqlRzBZoNnmqALBL/4vAoBele5I9DPKSv1Jb1:uKoxhOjsVnORbtRreAdL/bNVbD1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784451145, "uuid": "ca0bf04f-b212-490f-b014-4cc83c0c3f7c", "value": 2856800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784451145, "uuid": "92bfe361-8809-447d-8373-a2406b3de12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451145, "uuid": "cd40901c-cc54-4af2-a52c-3413aa865120", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f3f119-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486037, "uuid": "5c8a5e2d-ecfb-44c9-9b00-7ecd2836b233", "comment": "Malware payload (Mirai)", "value": "77e868bd2272a7b27a909cbe05da22e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486037, "uuid": "c4e932d8-e23a-4af1-96b5-60f709cd38f6", "comment": "Malware payload (Mirai)", "value": "9175a9708efa0242a02ad042a9d235a73cd4f691cb90258cc78d24a58e5f235e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486037, "uuid": "c9f1cdf2-d1ce-467c-8c8f-b123654d2aaa", "comment": "Malware payload (Mirai)", "value": "fadc63ec0ed581218232cdb8bcdb937702c4ed83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486037, "uuid": "8771419f-c6cb-4cc0-84ea-f2a16808011f", "comment": "Malware payload (Mirai)", "value": "748b8e1036e48c0449104c3dc024fd3d6d3b6f9ce70d0174dfa8c4d788a268da15b0eeed2e6d1044bd4e2374cc0f7097", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486037, "uuid": "5ca4ccb6-ff7e-437c-b7be-561fbf6de078", "value": "T19B4302758F21BC20C440C4B6472B1715E6C82FB9E7F63B72B76482D59BC8917391C99E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486037, "uuid": "ddbf7326-2a6d-41f9-a169-bf600ef807b7", "value": "1536:GNv7pF/TAeipa+WKIEDyDD4uvacBKHFSf9:0v7jse6a+W9dlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486037, "uuid": "02c84232-cffa-4aff-a76a-09df761d98e4", "value": 56492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486037, "uuid": "9fcb4fbc-a6a6-4891-9e83-2c0510869630", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486037, "uuid": "de92bcb1-3447-4edd-ac58-3a5f5595b8c4", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5ccc0a-8307-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784420440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420440, "uuid": "c4aa9ee1-1b66-4b41-960b-462f3b423338", "comment": "Malware payload", "value": "7bfe8025aaaf2415a90f3dfd88fbcb52", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420440, "uuid": "a006950a-a346-45ad-9ebe-673352552e3d", "comment": "Malware payload", "value": "92a629ea255b2deff884e40577915f56665508defdfe78cfb85c6a12dfe1fdc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420440, "uuid": "b1295361-3dcd-40b7-81fe-40811a3f50a4", "comment": "Malware payload", "value": "d83c747211a3b639fbb42e66dd5d2b7fe441edb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784420440, "uuid": "6f22f29d-e706-47da-8629-fb0c101492f5", "comment": "Malware payload", "value": "58d27eadf8a48c46bfcd82567ae157cf4faff67cd3f0b61ba1879af8f24f92374c86bb72559bf0e6740412b2349c4bb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420440, "uuid": "9abacd33-005a-4d93-a359-5fff4764548a", "value": "T13DC27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1224942AC3D8B3C71DC15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420440, "uuid": "dc7410b8-cefd-430b-94d9-7edfa523a99a", "value": "768:u8vCB+25j6es8RL9FYpMSUpi+20qUpi+20YQX:u8l25Jdd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784420440, "uuid": "c041cb83-0fcf-475f-a920-28a08a9b34c3", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784420440, "uuid": "63b41bd9-5aa2-4390-942e-845c7ca4da94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784420440, "uuid": "34dfb196-2c1f-422d-b584-0e4726bb2495", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fa0b4c-83bd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784498569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498569, "uuid": "5a07a15a-2a9d-407c-bddb-585c449da1b3", "comment": "Malware payload (Mirai)", "value": "faaf40134b1b9b479e1540e86c82705e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498569, "uuid": "37e9c979-bf71-4227-95ad-30c7d74ea1e5", "comment": "Malware payload (Mirai)", "value": "932e3c4ae1d5404ceade8dfd386182800b91eb93794c914b7f09b094996b061e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498569, "uuid": "bae9de61-fbda-4578-94f5-4caa667b223e", "comment": "Malware payload (Mirai)", "value": "16cb6e9c55652f71f5d0f7bb12c02fe2af2edbfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498569, "uuid": "a7fd32f0-fc5b-438a-9f3c-407e348928a9", "comment": "Malware payload (Mirai)", "value": "31ebae9ea9f41de06bd4f327af86d6196d4eabadfa6a502a4521509a8f26b0ebd0c04dfe8c6b5b70a1635ac6d88da675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498569, "uuid": "db2b3dda-c4e2-4d1b-809f-c2bc0f4409c6", "value": "T154C3190BFB600EFBE81FDD3705A9174A35CCA55622E93B767634C92CB64A14B09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498569, "uuid": "a6bbd2a5-348d-46cb-872c-41567dd2fc2d", "value": "1536:t/jxpfpkJSkipJREqofJoiLckd5uw4uTEnxm5CgRjB0I63lVLXP8UZDl3xRhjBRh:tdhpkJUWeiqss1VbprdRwv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498569, "uuid": "e49e5551-b00c-4111-bf27-d30974a544f7", "value": 124480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498569, "uuid": "68bcc5ac-b3fa-4343-b701-5480006b5a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498569, "uuid": "8d3267ad-a52a-4dcf-b025-e3104986501c", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b98ccb-839c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484454, "uuid": "e3fc4d3d-608d-4c62-93ff-76664b99035f", "comment": "Malware payload (Mirai)", "value": "5aab77c3af537065c5f647b0e7d4200e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484454, "uuid": "d2f23f60-fffd-43d9-b25c-8ff2719f25fb", "comment": "Malware payload (Mirai)", "value": "9374b0d04862ace20dc17aa4130f84d0afe19dd15723d09af6d843bb995c3d8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484454, "uuid": "cd8e9cb4-4a8e-436b-8138-535b511f479b", "comment": "Malware payload (Mirai)", "value": "daf0275daaf6679eb8e5c1447a4df0418fd9b249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484454, "uuid": "d90deca2-ae6b-4e8a-a651-9069d600b74b", "comment": "Malware payload (Mirai)", "value": "2528b43d59c500eb159a52256feaa8127f8e20836f2e8c799710be56e7a1fef3513ec9591beee8ad4a49c7689500f29c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484454, "uuid": "b862efb9-ec9b-4838-937e-52a49e9b794c", "value": "T12AB33C85F8829612C6C5177BFB1E618D372363A4D3DF3203DE259F22378A59B0E7A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484454, "uuid": "3f6a090e-8269-41f6-afa2-842ef5a5260c", "value": "1536:QN1HKw+RYx04taIYGQOXLAmVd3Gp/vpcPpMwarOlkqoG1CUiqW:QN1qBYrQGQIHtGp3pcPpP63r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484454, "uuid": "eddacbea-19f1-4082-9cac-e4146991fd4d", "value": 108008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484454, "uuid": "a34cdb7e-1ed8-47f1-b15b-dbb8f2d37c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484454, "uuid": "f8767f09-5535-48e6-915d-1704be5e84fd", "value": "ohshit.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5a0412-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489668, "uuid": "5e4926fb-956d-4fc7-a908-c661e432846e", "comment": "Malware payload", "value": "ceab8765b1f8d4f9462b59d0ed9fbcf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489668, "uuid": "2f531e78-215a-429f-bba5-fe0be16823de", "comment": "Malware payload", "value": "9471876685d848dd775e3d61ced8b2dfc9d8c01b6c3e2f574d98cebe13455285", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489668, "uuid": "4aee4243-f23f-4e1a-a7be-b4974db7eaf2", "comment": "Malware payload", "value": "6c902ee354667845be2ae9d58e2ccf895a0b89e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489668, "uuid": "4b246498-0b9d-42cf-a574-5eb1a84a03f1", "comment": "Malware payload", "value": "e4d74f57a5757ff8184d673dd91d24dab1d3ef7cb81eb0bedf56f9c1dc42e6be5b53d1e8af78d9a828c2c17c8d2a88aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489668, "uuid": "c7d8271c-4770-4ab7-984c-fa1d743f2104", "value": "T19904C506AF518EF7C86FDD7306F58A0124CCF4572564377A3274DA6CB91A98B09E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489668, "uuid": "4663f5f1-f803-49b4-ae7a-1e510d20d79e", "value": "1536:ZuGGBE7I/8I/OyhzSw9PnhEi3LVf6WVFZdJQZ9gS/IQfqqBJFya02IDnNIJSQ2hH:ZuGGBE7CGy2W/ZowQ14a0PDeJe5Has", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489668, "uuid": "63d08db3-9926-4169-91ed-aab8b36f7a61", "value": 189452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489668, "uuid": "57addff1-2648-4baa-88f7-d1f1cfbce3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489668, "uuid": "098f4edb-2095-4b95-bd99-8127dfe5eeba", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2665a796-836d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784464024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464024, "uuid": "c950643b-2a1d-403c-8e9f-ea6c001e113e", "comment": "Malware payload (Vidar)", "value": "c863cf4f6ef72b469692d903d80d772d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464024, "uuid": "80b1e213-28b8-4cc9-81f9-786496840103", "comment": "Malware payload (Vidar)", "value": "94df53908e7c6d0bcced95241d450bcf49105dba9e65c0277ba9a9ac579c1bcf", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464024, "uuid": "9c93c48c-cdf0-49e8-b7b8-90f373775392", "comment": "Malware payload (Vidar)", "value": "8163d42ee581acf346183c7d548dde0dbbcf679d", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464024, "uuid": "b2363924-41ef-45ee-8055-92b443e39515", "comment": "Malware payload (Vidar)", "value": "35ad9e7b933a679d13db333f598d41068d244696c1a7382367853e8e24e82409507de163f30d95c7650dbdc441a4dc73", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464024, "uuid": "555608ae-ad92-428d-9937-00c6cae9a7b5", "value": "T1DBF73380439A8655D0CB6FF8613F1AE39F1B1DE0B71960EB16A38472F5E946BC98C14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464024, "uuid": "bf4ac0e2-2138-4079-988c-c57fcf7f92a5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464024, "uuid": "b336ccb8-be5f-417a-b379-7c494920f413", "value": "1572864:iLdk+MF/wFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7z7:i2+MFIaABZVPArg/bXeB7z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464024, "uuid": "47965991-773a-400e-8943-c470c25e08cd", "value": 72516156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464024, "uuid": "caac97b8-766f-4fa6-903c-fc5c2f46921d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464024, "uuid": "4fae74ae-f7db-4b76-86fa-86a026d85c42", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d451cc-83b1-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784493462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493462, "uuid": "66f5514f-14e4-4f68-b418-7496eba39d7d", "comment": "Malware payload (Mirai)", "value": "a7cb22030e246aac879bc30d6f1ab703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493462, "uuid": "d0de4ce4-8470-47b9-8e7c-a5e940227085", "comment": "Malware payload (Mirai)", "value": "956f66bf9a0d796c9913a9b9cd255e8d1c49ab1b3de29d5418fd01b485032430", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493462, "uuid": "5839e706-cf40-4e08-accd-d682b57c4a9d", "comment": "Malware payload (Mirai)", "value": "f37fbbaa1c3df7947d1ba0b3b5a0c80d0e60f206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784493462, "uuid": "06b03f26-5b3c-4045-909a-55d8802082de", "comment": "Malware payload (Mirai)", "value": "17e051de4f615df01fc776bb0ca2137a7ec7ec95671ae9c697492285581356d9e1c3450ba8a6d13fbbf40394c1ae5951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493462, "uuid": "c63600da-d8c4-4b1b-b8bd-39aad0ee4fc1", "value": "T188D3D60E6E318F7CFBA8823447B3AF259698739637E1C585E19CD6052E7038E641FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493462, "uuid": "26bba187-0d4f-4360-83c6-15fa779cd50c", "value": "3072:CQbL95ryATDubUeYUnFlCRiw3qWdoXDUPvul:/5rfTD2UeYUnFlCMLKoAPvul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784493462, "uuid": "8ab2af49-ecb6-40f4-8965-44273de361e0", "value": 138084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784493462, "uuid": "fef4d078-6128-4aee-86eb-f48faa2ed113", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784493462, "uuid": "c8e6863c-2d07-4ac8-a80e-3a6b0439d90b", "value": "ohshit.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9a752c-837d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471150, "uuid": "6b1c817f-ca99-4369-b5b4-9588dfc122ee", "comment": "Malware payload (Mirai)", "value": "2af2fde4dab614ae29c07bacce6d0910", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471150, "uuid": "d689c4f8-1efd-402f-8990-ca1d91fdffe4", "comment": "Malware payload (Mirai)", "value": "9596a1e85f5148a13aafd997f56e58f3ff90385d242a21d7885fbaf9a1408e59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471150, "uuid": "3e45035f-dd46-4c97-8ac0-427425438fb2", "comment": "Malware payload (Mirai)", "value": "4268c21c30cf22ac21457448dfd8fde47388e39d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471150, "uuid": "94239f18-0dd4-4eb9-8f90-e92cb2f9c2fe", "comment": "Malware payload (Mirai)", "value": "4a07beec9542dc7067b36436460b0ae8da1f9fb644ff310edbb64f0ccb8d79083f71aac080a295739e3fbbf6d4671ff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471150, "uuid": "2c9a340f-8f6d-44d6-8760-17f0d0d7cca3", "value": "T18963D74A6E328FEDF66C833047B74B21E7A963D523E1D685E29CD5001F6034D586FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471150, "uuid": "898c5006-e830-4dba-92a0-4bae1a7036c6", "value": "1536:4w2jV7ZlvmGY3VcAPKdr5DGYeR2ZmmcRdRl5C:49V7TeVvPE5G5H1l5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471150, "uuid": "5263a8e9-84bd-4d72-b43f-8f0adc9c0a9b", "value": 72916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471150, "uuid": "e953b398-4935-448c-8d8f-2e6202d07992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471150, "uuid": "08837c7b-10c0-45db-8b88-0ca3f902b959", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd1a6d4-832e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784437166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437166, "uuid": "2d059e3d-4f8b-4f62-86ac-0eb44567543c", "comment": "Malware payload", "value": "ab74efb49d28525ca7a8e7c18aeecd93", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437166, "uuid": "cc5fcfd3-3b06-4236-8f41-a8a9509a346d", "comment": "Malware payload", "value": "95cb1c8fd44e767c9f24c823ded9b242376b87bd37874f2e3b13c94231860481", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437166, "uuid": "3e9f1f5b-78c7-4c4c-baab-b1fa96bd7877", "comment": "Malware payload", "value": "2252f10e992d81567700834127a06a8d20b4a925", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437166, "uuid": "5df4f60d-13fb-4990-a2fb-4945db030fdd", "comment": "Malware payload", "value": "9cdc26108cc8c9e680ca505307720ee753d0d724b1a3f684be75ac3fa748ddd9413652ec7e340f1ba26bad4c5e0b1744", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437166, "uuid": "80ec9fbf-c365-41bc-92bb-5cb1f6d75538", "value": "T1516523857BD000EAD87BA3B89AF3225367757CC547F993CF624086A92E338C4617B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437166, "uuid": "55709ff0-edda-4347-a170-82d3df0c0fbc", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437166, "uuid": "fb8aea0b-255f-4b76-a526-5887d7fc17ec", "value": "24576:ArsRcbYKNp03n4gZWmA7OABU5CpU8xPhuyHyCH+8xc9jeYu+gXTk0ky:ArsabNNp03FWmA7O95iUUPwULH+8Ff+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784437166, "uuid": "bc4ecebe-c439-46b2-a6bb-d3c26b3a7692", "value": 1522688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784437166, "uuid": "10e37f89-5faa-4903-85e4-593e86f94848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437166, "uuid": "6661d495-d7b5-4a12-b6cf-8b603c7842c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e416d8f-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477862, "uuid": "08b9ebe3-b6b1-457d-85d6-3389ac462d5f", "comment": "Malware payload", "value": "dfbae79d8a5110e00fa321e128cc424e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477862, "uuid": "a9d5b7d7-8731-47ea-8420-6602dcbf3e68", "comment": "Malware payload", "value": "96256d3c137ab472b97707c39f21d716536e440075eec33b640fbd7585974f1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477862, "uuid": "84ec94d9-0414-49b1-9ef0-9343e95969b9", "comment": "Malware payload", "value": "081297c1be165ae39a82873ce76118288ab4daf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477862, "uuid": "6ff8b5bf-abe5-4df6-ad99-82266fb7c822", "comment": "Malware payload", "value": "830ddfff75e6f3b2b9eadd2412a3afbfbaac5968955cf9b50e6afadb5c4eb327719d7461c300c278c0795e91cce5341b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477862, "uuid": "08a2090c-cc43-4f74-8c59-64cad76caab0", "value": "T1D6B30702770D0E07D1633EF03B3B2BE097DBFD5629A4A280702EBDC992719F25545EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477862, "uuid": "957c1451-dd8a-4784-957c-8fe1f50dfdcc", "value": "1536:QMy2YDNLxxOqrALcMpdRoLmHdSvAqIdYBrpG82ixgfqHycjU:QMynLxxGJproLqRer3dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477862, "uuid": "50cca171-da58-4a47-b942-2a2394b6add2", "value": 117144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477862, "uuid": "b37f271b-c906-46de-81e5-82aaa7ed7810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477862, "uuid": "b5e7b86b-ed95-4e62-95cd-54702aa5f622", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95731da6-8340-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784444883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444883, "uuid": "d42190d3-2d21-4df4-b3aa-3a6cbd7ef41d", "comment": "Malware payload", "value": "fdef7810bd6a0b153761d92806e051a1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444883, "uuid": "1d5e2941-04f5-40d2-930a-b918e1e403cb", "comment": "Malware payload", "value": "9731b02a6cee4d3db1a29285bae92962617dfcad8055c28e5b25417b1ac93786", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444883, "uuid": "f2ecc7f0-6dac-4374-b2ec-e8fb15010d68", "comment": "Malware payload", "value": "ec49ab9e19aa333c7eafaaa9b021e3c1ed361be4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444883, "uuid": "c6bde3e4-e36d-480b-b24e-d8121a86edeb", "comment": "Malware payload", "value": "3a6ac1a09d63dc8ab2877b83e9d9ba3fb651365b3fd7e50cad51cf32661c662ceb9e0df5409ec04aeaa82d89ab6d7700", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444883, "uuid": "309740e8-b95a-462c-8dff-06309964edfc", "value": "T17A235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444883, "uuid": "4548c331-a545-47be-ba11-bc4613f9f7da", "value": "768:m+O9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:m+bcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444883, "uuid": "dbc505a9-e126-4fd2-afd3-55e0bc9faa34", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444883, "uuid": "6e596e28-b76b-4e17-8345-677235215068", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444883, "uuid": "4201fcc1-68c6-49d0-ba5c-d4eda7af955b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02553bbe-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445066, "uuid": "fb4388d3-b570-45ed-aa1b-1e32658fc820", "comment": "Malware payload", "value": "37f81a605446c842ff6069d1fa26de12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445066, "uuid": "0468513b-035d-4284-88b1-8502a8a27d93", "comment": "Malware payload", "value": "9826cca77d8ba2f478a5e338ed4ecb4c2accde968e0b89a9ccd4295beb91b207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445066, "uuid": "8604a329-8d1a-4ed5-9a03-0768c0b665f7", "comment": "Malware payload", "value": "99f3cbcce8c62d2c743a73cdf948798741e3948a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445066, "uuid": "becea1ed-06a6-48a3-aa1e-38f37e259425", "comment": "Malware payload", "value": "381da9e3dce67f45c94b2bf4096e2c0b0953aa7bb7f419c5ccc44c430a5b8a82e31fd5e1b507347480e2728c9280bdef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445066, "uuid": "bc4b4af5-1ff3-4edf-98b7-4d08e6f860df", "value": "T1F552CF12A3B0CE7FCD3C477844670B3091A6E55852B243232B14F6352FA3BA4AEA7DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445066, "uuid": "66cd4b6e-4a42-4f12-8343-832038ae3b4c", "value": "48:RsrYCTTV7pB+B5wQZwLQ0GxnpmyaTl067ILy6W2oKUFh:RAYCTT/B+B5wQdnpmyapjc02oKUFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445066, "uuid": "088e375d-7ec9-4c4a-a08b-027ba6d958bb", "value": 14080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445066, "uuid": "961758c4-18dd-4654-adf4-9155d75a040a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445066, "uuid": "fe4013ac-2ac7-40ba-a876-0b46323298ac", "value": "skiddy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd304cf-833f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784444251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444251, "uuid": "6f095ef8-d7f8-48af-8d6e-fdd4ba12167f", "comment": "Malware payload", "value": "0f2bed7e2745f6acfc757168db836e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444251, "uuid": "b1d75268-78d6-4df0-a192-4c37260141b5", "comment": "Malware payload", "value": "9a7aa7bbed24a5ca404e3fd328ec9761b057fcd4ba88c092685a5afa29440aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444251, "uuid": "b3614210-f2c1-4d48-9675-28047b423464", "comment": "Malware payload", "value": "0c9ab63f4f5b22ab5a5a37259a8d8f61c2cf8b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444251, "uuid": "e6eca5c0-8741-443f-b5ad-7f5575bc2f80", "comment": "Malware payload", "value": "addafea3fe58819486cb21d122e49ce632dddeabae371b61d302066faed1e6a7afd9689bda13862a870ad045fc611879", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444251, "uuid": "4e75cd20-8663-4d58-9e06-7128a4362f6d", "value": "T1F363F967B9818F15C5C1167AFF1E934D331367B8E3DEB213EE142B642B8B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444251, "uuid": "1cb8e498-427f-4850-ba60-1e03dd73c91c", "value": "1536:FonaD+7SjChOKprlQj80gnIvleczDq3V1Hy5RAOIi89XyryhYIF:JD+7SjWTrU8ij/Q1HyHO9Xyry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444251, "uuid": "56b9ba3e-2a72-4bd6-b9c5-f8fab1e4bc50", "value": 71040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444251, "uuid": "4dbf16aa-3113-4d8d-aad2-e72c2b672ca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444251, "uuid": "6e468f35-3c5d-4886-9f68-d0889441a672", "value": "rU0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8f1426-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490205, "uuid": "0454d772-af3f-4147-8eda-ac6707d41d2a", "comment": "Malware payload (Mirai)", "value": "f26addccbf8d095d20cd70d8585e3d37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490205, "uuid": "c41fbce9-53a5-49f5-8adf-d52ea53bc9fd", "comment": "Malware payload (Mirai)", "value": "9ab7748034bb8bc91a054e7f544ac080a3ad781f7ccb329eb88e66432ff90873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490205, "uuid": "4a3537f4-6fb9-4ccf-b558-a35b25a73e22", "comment": "Malware payload (Mirai)", "value": "756e244501a95deca1eda4347bf26a0efcc64b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490205, "uuid": "87ec30b1-c1cc-4dad-81f9-59f442af78d4", "comment": "Malware payload (Mirai)", "value": "9a836012f088418610ef4233534e7ec557c2757ae0f1bfe7555ed7ce024cc423789e82cdf7773d49b46edb493c6abb31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490205, "uuid": "9f65e38d-0ffc-4f31-b19c-bed413467aae", "value": "T1F3D3E6C7FD01DEB7F80BE37648A308057530BFA609525A73726738AADA390D91467F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490205, "uuid": "aba3dd3e-aa43-45c1-a06c-b3732427f817", "value": "3072:Vh+vJj+8WwU6GL9xS5ujzVvjbirLF9klQyE/0VuD:VG+8Wwq9WujuLXHyEZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490205, "uuid": "9ed41f42-6ff8-4174-a4ba-9a66ccc3a703", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490205, "uuid": "83e06616-1f2b-4e5f-ae4c-a6561ebe22a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490205, "uuid": "a5a9ff22-dc79-4b6a-82f9-7b77fa9c6a3b", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921d76d7-8383-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784473654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473654, "uuid": "5ba93d04-1f23-4016-917d-a6198e1dfecd", "comment": "Malware payload (ValleyRAT)", "value": "d9e46a18e22a6541b420c7237736454c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473654, "uuid": "deb655f5-170d-4411-95c9-a8f46bbfb526", "comment": "Malware payload (ValleyRAT)", "value": "9af907bf12ea8508106e0bb99239dc71fa54cc6ac3a31440a9e04166a46283a5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473654, "uuid": "0f11e961-ed19-4310-b519-20ef9075e3f0", "comment": "Malware payload (ValleyRAT)", "value": "bbfb2d7e89a9e160236b5232c0f956711dab5279", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784473654, "uuid": "33ab7b20-1478-4810-8011-5bb4bccc6722", "comment": "Malware payload (ValleyRAT)", "value": "d9ac7b0c1819fc02896094c1fd09ca4502398944e124488162d9f210cf76642d4172a0583775d1747197119e7fce020a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473654, "uuid": "1f90c81b-4f17-4b77-8615-962ef4cf94fc", "value": "T1DF96339178892B70C4CBCBB6A663986E7E493FC03A354C52BBD97B0019737215BB7346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473654, "uuid": "f75e42d9-171b-4b3f-9c1d-4f65aa2d0ba5", "value": "196608:EUma/jnjGy+VVtlFB2E3/SiqSXsEcnd9E2yWT:ELaTwVVXtKfd9E0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784473654, "uuid": "60530d0e-6975-4d5f-9db4-1e3297bb109b", "value": 9134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784473654, "uuid": "f657b8bf-dc39-40be-be2c-02876b2742b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784473654, "uuid": "c79d9b49-c057-4131-9530-dbf9521d9e78", "value": "installer.8332566019.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec8100b-8345-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784446858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446858, "uuid": "4c8caf7f-1e57-4db4-b5fb-218e01cf73ed", "comment": "Malware payload (CoinMiner)", "value": "1a99ba4d3c42a0c75bcdc390fae345cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446858, "uuid": "9d7dd03e-49dd-4466-b52e-bf50a05ef50c", "comment": "Malware payload (CoinMiner)", "value": "9d6d0bce1b37cb65deb9b158edf41bcb9c44ae07634de8563b53a05f158955af", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446858, "uuid": "e0543a98-1422-4e51-becd-4f46d5ae536c", "comment": "Malware payload (CoinMiner)", "value": "d2397a74a6627fae5411f19be3cbf9b72ffb67ff", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446858, "uuid": "5e60c610-2f2f-4de3-af4f-75a48c6911bc", "comment": "Malware payload (CoinMiner)", "value": "12a4c4cff066da987be6067fb58733dd689dfc9f56e9f5cbf695f53585f23cd1097bc6b3f14e60f41fc7b66d5a2b9f88", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446858, "uuid": "46555e1e-c2f9-44a9-b5ee-5f49520cd277", "value": "T164065B81FC41CF52C5D43A7BF66E828833530779C2EA700A9D255B7467DF99A0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446858, "uuid": "2133e8e1-0070-4c7d-824e-b25265879db0", "value": "49152:8uVMdIfhkqtpYiGGctvfCYRZNpKUGMMdipj:LVTfhkwXGGctyO1GMMYpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784446858, "uuid": "46bc68bb-63e0-48aa-aae9-567f8de934b7", "value": 3904272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784446858, "uuid": "ab22685d-288b-4b29-972b-49cbf4918265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446858, "uuid": "7294ea8c-60f4-4232-9ffd-d3fa60049aea", "value": "f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c110db4-8349-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784448545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448545, "uuid": "26852da1-ff52-470b-8543-82d627bbac2c", "comment": "Malware payload", "value": "570a7da5e2e94aebe63789224abadefb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448545, "uuid": "98f74b33-7743-48e1-9f8b-7723753a9e14", "comment": "Malware payload", "value": "9d930798d115b6862313e3616d3ed02a7a5c4c673390fe5fed4d85472cf906f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448545, "uuid": "7f21f96a-9f46-48b6-8e8a-259e82a74e95", "comment": "Malware payload", "value": "b89a90fcc4449428b6a28c2f627e15130638b4fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448545, "uuid": "6c95661c-670b-4cf7-a71c-8fe0d85d4800", "comment": "Malware payload", "value": "52076ecc92845465511e83cd664185817a56c4dd61166e0f8a3fdd0059eb2e198293d86584cdb03c68ea9b8a2e546471", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448545, "uuid": "728e236a-1286-46e0-8b22-9dce53a89672", "value": "T1E8C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448545, "uuid": "45ccbd15-36b4-49ee-acef-d732e4ce7263", "value": "768:i88vCB+25j6es8RO9FYpMSUpi+20qUpi+20YQX:v8l25Jod2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784448545, "uuid": "a697296e-7e91-4ce6-b897-1339c0ee400a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784448545, "uuid": "12652a23-d859-4876-b8a3-892c54dcda75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448545, "uuid": "fdf7a4cb-de5b-4d4b-8920-8977b5cd8ce6", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ace31a-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489663, "uuid": "d1efe81f-94f9-4262-a005-1a486ff5d960", "comment": "Malware payload", "value": "771794958e6b1a4a3743cffe56ea4e5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489663, "uuid": "eab7e123-c37b-407a-8205-4378c4634e2f", "comment": "Malware payload", "value": "9e16b159890b2219ea10543fdc43e96943f448578405b80433bda7e4d2333d64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489663, "uuid": "686437c2-d2ee-4727-82dc-97cd9d1365b8", "comment": "Malware payload", "value": "b3411da2c76a1456ce836885694d40639d88115d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489663, "uuid": "04dc2d43-f9cb-4c33-948c-6ec3b5ab657a", "comment": "Malware payload", "value": "2a25dd1354aad6700aae5b0e84f20b6d142e0579d671a6cdd2b5df93b887ec7268d539aa5eefeb333513abd5b622ce8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489663, "uuid": "05c1ce26-e9cf-467c-9a54-6fff0d7d0547", "value": "T159356C5AF2F370BCD067C030439BDB62A835F47501226E7B65C4DA352E66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489663, "uuid": "54f7de10-1f80-4684-9fc8-fbadb63285ce", "value": "12288:/M4IufFjNZtVZ1Yeutt3Xp834n0Xc+q72uJpjdYAAwmypCN+hWCDz35k:/8ufdNZtVZ1UhXp8on+c8uLGzkq+4Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489663, "uuid": "51b64402-01f9-48d2-8db7-908bbd5883ef", "value": 1161160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489663, "uuid": "387f8150-e893-4537-b212-cf981a35c776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489663, "uuid": "d937e81c-c41d-4284-b255-0924412295b8", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e79189-832e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1784437211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437211, "uuid": "ab823143-9fd0-47a3-b5e9-bb21a29907c8", "comment": "Malware payload (DCRat)", "value": "e7e02b0ee625cc44711555fc32ab0b6f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437211, "uuid": "6a5cd8ac-d3be-4085-989e-7e855660d87e", "comment": "Malware payload (DCRat)", "value": "9e3a4d73345f068d9a6142ca75b6d0ad17b68aa3187fd57fcc55157308adc554", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437211, "uuid": "ffec1de8-5db3-435b-997a-cc8903879543", "comment": "Malware payload (DCRat)", "value": "fed379603b4346281cf420229c79feef97d6ee23", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784437211, "uuid": "8f0f7824-4657-45cd-8b6a-bd7d36336cd7", "comment": "Malware payload (DCRat)", "value": "dea0e497329343a57c1e55c6f1ae6acb161d649e1c7d13990e88fd3f1a8b649ddef2438144f708eba5f3e5b391388322", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437211, "uuid": "662d8b57-1783-467e-9adc-8309f9cdefcf", "value": "T1A2C57D2839EE502AF1B3EFB59BE47896D96FF673370B945D009103864713A41DEC263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437211, "uuid": "edfe9e0b-bef8-431a-83ba-d730feb509f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437211, "uuid": "dded243d-27c1-44e1-8bf4-5ea0e13b5256", "value": "24576:ZCTn72tmNlgEJMA+uCw7sULqP3NJV08P5Np6JZlP6+cO7TT6:sTn72tm3mA+IUP0lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784437211, "uuid": "390b2c7d-933d-4f96-8939-597295db0236", "value": 2511360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784437211, "uuid": "9ef9637f-2674-4d72-9ec9-84ae36a4542b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784437211, "uuid": "f0aa19d7-c63e-4354-8915-e3a9664d27fe", "value": "E7E02B0EE625CC44711555FC32AB0B6F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a687df9-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784464460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464460, "uuid": "9971d09a-6b30-42ab-b56a-0a563d687938", "comment": "Malware payload", "value": "4fd4890c52ae0b9298c74aa79c37056d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464460, "uuid": "5938276d-c92e-42c2-b779-7a0b67762d22", "comment": "Malware payload", "value": "9ea9289865075cf08ad0f8c62f150a81768b7901073b95f4478f2e92993291c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464460, "uuid": "ff5bd986-1b5a-4878-a2d7-a1dab0752490", "comment": "Malware payload", "value": "fcf629736dd10518f2bf286f0eed8dc02b630dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464460, "uuid": "16944ed6-e5f3-4405-a644-9da725b398bd", "comment": "Malware payload", "value": "e1cd9aa76a8b0ac43dbb318b838165f9a78a92caeddf506f4fd7df4165d404bfbb9258bd0da10cc58912f3eca6c2a52a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464460, "uuid": "bd200121-5204-4c2d-b396-55e2aad70fae", "value": "T103432999BD41A612C6C155BBFF0E428D7727039CE2EA7303AE25AF21378B4670E3B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464460, "uuid": "5e8ede92-fd22-4ebb-96ce-048a03396b92", "value": "768:qwytw5D7+c3Q5/GWlFeQ0DVVwDjYtEMtaUw7lOEOFN8bvfZYyV01JFlsH4hDWJvM:19aWQVD0sDctabOEOF2fZn0QSCvhrR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464460, "uuid": "34bf70ae-2ca8-49cc-9e2c-ea36eb4db864", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464460, "uuid": "f854a9f5-dfb2-47c9-8602-1bbcb38743bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464460, "uuid": "b7f93528-1302-428d-8e5a-29502f8bdaeb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c9e5a6-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784464392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464392, "uuid": "41f52fe3-0d5b-4d2b-a98a-041a11cabef2", "comment": "Malware payload (Mirai)", "value": "f0fbbed3cae4b67d22864b6be19558e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464392, "uuid": "0fc7238e-5c52-4b7f-ab24-b48876a31688", "comment": "Malware payload (Mirai)", "value": "a17b696705e4cb096bc9dd5eddf96ab4cace396173db7df7dae0357270769902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464392, "uuid": "2e8d9edc-4aaf-4790-ac0b-c25a6d629eb9", "comment": "Malware payload (Mirai)", "value": "f64350906fa6dbcb7bb61b1379035479ad69fc2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464392, "uuid": "764dae2b-7c13-4a35-a962-e59a9e9b1c7c", "comment": "Malware payload (Mirai)", "value": "090e4048e1f81189e68bfb26898545df9e1a5c5e73a6b578c8d89d8bfe6edf6ac08bddf1ce1a76123b94fef2c2f550d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464392, "uuid": "b0446087-707e-482f-aefe-74ed4b100934", "value": "T1CE4301E7D1647919ECF66833BC2A2344273E0A74B2F7B630D1D60AD1F4D009B97B9986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464392, "uuid": "290b08db-730d-4e73-9fd3-85dd67aa8234", "value": "1536:ymrFESqmttjSK//i2oEc4WupWKRkCHHfLAVoNgfa:HrHqIjSKy2xpWk/LAVtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464392, "uuid": "d0887db4-752e-4e4a-a5c2-0010d828de82", "value": 55524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464392, "uuid": "5154d884-a71a-4bc3-858d-8e489c8d8a69", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464392, "uuid": "0f7379cf-0447-49c9-85c2-65ed554cafcc", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cb8629-8315-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784426410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426410, "uuid": "89f466c2-15d3-4049-88ac-988c5c19c248", "comment": "Malware payload", "value": "55b8ff7fc8ab06df6d4fb5109ed76d36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426410, "uuid": "ec62bd4e-e81f-48c1-958f-615156009b38", "comment": "Malware payload", "value": "a3adc3ba9fb493396d33ad6b5c49aabc27c3d95d42451636c501b5f6b1a431a3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426410, "uuid": "7568dbae-8796-483b-b9ce-d44916f037c2", "comment": "Malware payload", "value": "c7d77f41b65aa440577377716f6cb85929615f36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784426410, "uuid": "2cd6b787-bb54-4bfe-9c4e-771b28075135", "comment": "Malware payload", "value": "a24a9aaf46e826c6adf55e7f43cc053090bbf8e27231cca371106c8b517fc4a567bf3e19b9881b6eeffe120113e18fb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426410, "uuid": "1bc04b9e-429c-419e-a615-0c42dd1c6801", "value": "T10D01CECAE150991040DEC51D33975458F871C3C7164B8BB4BF6CA43E9B98E14F066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426410, "uuid": "bfb2153a-6ef5-4bff-a184-1ae0e17a0c7b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka9Ccn1Cu1BCIBFC9gwXC//6X:kXCKysE2hi0ziQvZoha9NV/TFeXm/6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784426410, "uuid": "c2f70c85-95ea-4e0f-8af2-8fbd6cf6457a", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784426410, "uuid": "9b699790-0efc-4b4d-b19f-44f40cc6c99a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784426410, "uuid": "d90936de-1df8-4166-a8ba-1cc8cb6e316d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e177fb89-8339-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784442004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442004, "uuid": "8dca043f-56b0-4b7b-a6e3-aeaad989e62e", "comment": "Malware payload (CoinMiner)", "value": "af764b5e68436e284cf8f62ba5c77063", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442004, "uuid": "8496c0dc-d355-4ef0-966d-e5b388305964", "comment": "Malware payload (CoinMiner)", "value": "a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442004, "uuid": "aeaaa7d5-5876-4d41-9e53-53c23ce7141e", "comment": "Malware payload (CoinMiner)", "value": "c7486078d2244a800d7448645a561a8313f1b747", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784442004, "uuid": "1c3e5aa5-990a-4e91-958d-eba0a48a9842", "comment": "Malware payload (CoinMiner)", "value": "d7fcdf498eb9449df7803a7779b7e686ccf87db1d149cd6f00f45cbfacb959a88976610f12d53bf8e1701257a338d845", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442004, "uuid": "e5a8f1e0-7766-4819-b9fb-93208fc9a044", "value": "T1B68533E6E0CFF8E1D4D6E3F26918FCEE814E4139A492276B618D213801792B5DF97784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442004, "uuid": "b0142e4d-3d5c-4dc7-8465-5dc9f2d24323", "value": "49152:nNbFLX0ySfJohjSO314KEEB+wCAzS5ASRWYy:NBDafGhOu4KEEB+wCL5A6W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784442004, "uuid": "79a4cb67-d385-4751-9540-64c91b0c5a8f", "value": 1795844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784442004, "uuid": "cb19c6de-7830-4338-882f-aa35ff515f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784442004, "uuid": "300f1460-3698-4407-9cae-ce463fc22089", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a93041b-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784489854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489854, "uuid": "538257c9-25b2-4760-aba8-3113ad3fbe47", "comment": "Malware payload", "value": "87334424311ba7f8abf2e695b2837289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489854, "uuid": "d6bdc1eb-83ea-4249-9da3-748e74adbb11", "comment": "Malware payload", "value": "a4bbca400a2ded32b393e561dcbfa151738d695ec121c5597795c2fcd2ebdcad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489854, "uuid": "b33c7b86-499b-46d6-9eeb-ef6984796f9f", "comment": "Malware payload", "value": "b9fcee30e50ccdc36cc6debac64fbbd5265990c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489854, "uuid": "d0d32f1b-7572-404f-9c4e-4242317d89f3", "comment": "Malware payload", "value": "03e2a6db34345abf522404f822d89f7f4c7336cc27fa01c5c2e98cf3670e387cffb7ecbd6b138479abdc531af6efaf8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489854, "uuid": "a203cef0-b308-420c-8807-d86426607fe8", "value": "T183C30702770D4F03D1633DF03B3B2BE0979BFD5229A4A680752EBEC952719B22545EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489854, "uuid": "e8a59e56-1a2b-4ce5-bf1d-ed5a66f40993", "value": "1536:GVsWoDFED+xkcme+aB5oye64fvzW4YGzvANimSdAKRqmEjhqCeBch:GVsW+qD+xg+IyP4fvyrNNgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489854, "uuid": "9650d4cd-ee64-4774-9302-f9111a433160", "value": 128428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489854, "uuid": "cb6e0a0e-c9f5-4bca-b049-65f6a558e2ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489854, "uuid": "a35be95f-78a5-42de-8bad-409208d10e15", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b592c833-8336-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784440642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440642, "uuid": "16991084-fe6a-4060-9d8c-006cd0a69876", "comment": "Malware payload (CoinMiner)", "value": "59ed6584c46d0acf17196546091f4f17", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440642, "uuid": "7033520d-a9c7-4f9a-94e9-01771156918b", "comment": "Malware payload (CoinMiner)", "value": "a531f3e6224862abd00091c4955d535ace2bb886df53bdcd59c3a32b44c93629", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440642, "uuid": "ce1fd73e-49bf-42b7-bcbf-6ded8503493e", "comment": "Malware payload (CoinMiner)", "value": "854a1b0645726d7d1e5d090a67cdda53396aa7d4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440642, "uuid": "2705065b-f322-4f9c-8f3d-4410b843f196", "comment": "Malware payload (CoinMiner)", "value": "beede5218dc55b025fc58106f5713831a83f0fe7da10de81a7caf9ee4a1fc6bada121b37399850a19b46ce35793783a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440642, "uuid": "095a946d-69e9-4316-a08a-5639d765fa6f", "value": "T103953308CED55C5E90583F653C9197895EB49AA2BE17F3FF2188584BCCE1D23ED8306A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440642, "uuid": "a156cc2c-3bd8-4015-bd2d-15f7f58d0052", "value": "49152:TDAsg2ugVOgzI9YCi4fU38JSz1mUZX6cw6m1ox7i+:T8sgucgzI9PTMsJSz1RZUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784440642, "uuid": "1a0ac0fd-ba33-463e-86f8-302788eb7748", "value": 1954892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784440642, "uuid": "a0394f5c-1520-4fbe-84df-ee65e232bf2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440642, "uuid": "54ffa1cd-b91b-4d93-b5bd-769f2d886690", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edb34ba-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467125, "uuid": "b7466df1-b462-45fa-8298-72e8342633f1", "comment": "Malware payload (Mirai)", "value": "57e44bb74c63f63f75d4ea9bf947633c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467125, "uuid": "7255ecd3-6135-41fe-8fb5-c7bfda757cb9", "comment": "Malware payload (Mirai)", "value": "a62694b9dd36c5e9ebf016125df88a879c248383775584d67471dc3bd93fa68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467125, "uuid": "cbb1cb4d-3d82-42ec-b677-bf01cb32dbbc", "comment": "Malware payload (Mirai)", "value": "6c0d27b40bf2c64cb2bb4d1f54d8c0c04af5d6e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467125, "uuid": "bb1cd5cb-5513-4edb-9d2f-a3e4da58eff4", "comment": "Malware payload (Mirai)", "value": "c91f3a2825a9feb9318c606140ea1cdadda523331fe0b4cab474974fd90994dc25ff5523c407c1c274a51276b3e580fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467125, "uuid": "65a512f1-7b05-4347-b63a-c5652b910a2d", "value": "T1F5F2F1F060E814B3D6F11ABAADFD4B592D312F6CA1CC75124DD8E0AD59EEC0AD5329C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467125, "uuid": "4d860565-4892-4ea7-a2df-764faa6b5042", "value": "768:ygMLMPbAOGlA5fpSWyrw4h4sw6vDf1LWP/Oq41dLDis3UozM:zMLMPRWwmf1LEWN1dffzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467125, "uuid": "15e1e1aa-0634-4039-a42c-3ed894d3b8d5", "value": 35652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467125, "uuid": "56da44e4-12e5-42f1-8d12-4e5fdfb3463d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467125, "uuid": "191bdf95-fcff-4702-b041-1300f4fb537a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e191f839-83b5-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784495262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495262, "uuid": "71b750b4-e14e-46f7-b844-1cf6c5c81c39", "comment": "Malware payload (Mirai)", "value": "f10d1ac254ca576e7da8d2e98512660d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495262, "uuid": "b34e1476-a8b4-44b5-8626-e7bd5b5bb7f2", "comment": "Malware payload (Mirai)", "value": "a63024ccab17767582caa9f95e9fae11d24a437b540b42f1b6f9145f4085ff01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495262, "uuid": "ea0dae07-7084-461f-97ac-e9efc65b2ef4", "comment": "Malware payload (Mirai)", "value": "e297151c6f0ba690730ec95e76b4269479f451e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784495262, "uuid": "d41a50e2-eb43-4cbd-a6ec-905cfaed1b71", "comment": "Malware payload (Mirai)", "value": "ad1e687b98973969755f32035ec57ca6382276a736c21a3056f3de251143c9eb9b018377cc49d74963158aaad619ed31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495262, "uuid": "d7b8258d-875c-45a5-822d-7d9eb697210e", "value": "T19EC32999F880DE52C6D5267AFB5E418C33231778D3DA7106CE109E3477EBE5A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495262, "uuid": "4a9883de-4029-4729-b59a-3ba18551873b", "value": "3072:hH0Q8oVUpSaVDSMcMZIBTcYEEUAeMMWmNwhNAfSsXMFNKFpAiucf1Dll:hKUeHZwTcYEEUAeMMWAwoasXdiFc95l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784495262, "uuid": "cfcee8b7-6b27-4dbc-9dcf-864e0744659a", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784495262, "uuid": "6338d1ae-cfef-4620-b18d-d9c4139ddacf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784495262, "uuid": "92124986-1269-47fe-8638-448874984fcb", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6b9753-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489666, "uuid": "5a39eaee-e87c-4ac2-bb20-1a574ef2c9d7", "comment": "Malware payload (Mirai)", "value": "d6f4c9781d835b24e057b89a58b8a668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489666, "uuid": "3c7ec024-06b0-4e17-96af-e16e000af44d", "comment": "Malware payload (Mirai)", "value": "a66cd63346b06752f30a8639336bc717537519d86d1b339f8390d1b2f87856c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489666, "uuid": "287a71f1-0d7f-4112-9b77-afede9c2f1a1", "comment": "Malware payload (Mirai)", "value": "818b3d7accbe0220d3156c77fc9b306c15302b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489666, "uuid": "0a890bea-d456-4cf8-ac4e-93bd00cc06c0", "comment": "Malware payload (Mirai)", "value": "a8b2f7424f87662867e673131928cf58c7cd8a9f16e9ae82deaa0cbcb92d6dece7b748b9c2ce43387cc6c49962f279e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489666, "uuid": "e9131eff-d9ec-4681-b255-e7aca05a490e", "value": "T15FC3F749E9429F01E4D731FAFB9F425533536BA8E3F97101DA206F6023CAA9B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489666, "uuid": "7e23c96c-ec19-4aef-97e3-ff86672e6300", "value": "3072:PZ0wE7gzPooQvSjsb5aGz9TP26eTP/k6JH9fow2Qv:PZ0rgEpvAsb5aGzN260/RJHNow2Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489666, "uuid": "f171de3c-b641-43be-a81a-ea2738605dfa", "value": 120912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489666, "uuid": "44e4617e-90f0-489a-83e0-a25cd9b3bfb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489666, "uuid": "093e4da5-1d51-4de7-bd24-3683da4dfba7", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fe7045-83a6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488744, "uuid": "f7bd0f4d-c88e-4a09-b427-98cdeb1a35f9", "comment": "Malware payload (Mirai)", "value": "09e01a398be685be901571f74c8a7e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488744, "uuid": "86c42ff4-2090-4599-98f9-a7f745fa30ae", "comment": "Malware payload (Mirai)", "value": "a7464b81d90a404e7111f960f53d67970478b08cc0c088bba96863eecd516cb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488744, "uuid": "58a316bf-ab48-4667-8643-a210c24a5dfc", "comment": "Malware payload (Mirai)", "value": "b986734f30db8f2155c8d19d50eb41d55a5d463a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488744, "uuid": "5c14bf7a-c8dd-4eb2-9863-93f16bedebfa", "comment": "Malware payload (Mirai)", "value": "501968eb6019faab22421b7d70dd76b15ccc35f44d595e2b5f55ee54fb4984f90741ebf879ef73e8ccd44f75850a528c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488744, "uuid": "29706782-4984-4f0f-91b7-137bbab56609", "value": "T1A3B35BC6B401DD7EF80FD6764463690AB931E7611A831F336727B963AC721F15922F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488744, "uuid": "b02acaa5-7b7b-469b-bfe7-3c30eb56ff2f", "value": "3072:EWe3H5JgDT5ZERxWTvyYhRmrGqQRXribS5e+:A3HwDNjLyYPmrHQgbS5e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488744, "uuid": "11fd0228-276b-4a0f-aa80-0f244bea7eb8", "value": 112800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488744, "uuid": "356e2eca-a1bb-4694-8750-755f8c27d7ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488744, "uuid": "1c4abee8-29c0-4b3d-b475-b37c0eeaaa32", "value": "ohshit.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0139bae-83c0-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784499984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499984, "uuid": "9b21bcad-4229-4a05-a17f-12a1015e9194", "comment": "Malware payload", "value": "2279338d70c41939fdf34740ab1871c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499984, "uuid": "ff1dc19f-22fb-47e5-ac8a-9866b10fac17", "comment": "Malware payload", "value": "a832528ba9cac310fd4e5bcb7f8523865a6a19b2c95891515f323009910f610e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499984, "uuid": "332f6b6e-ccde-4a40-ac9b-a22f28b3763b", "comment": "Malware payload", "value": "edca14f6f023ac919a5a55495b95c51a5d7fc33d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784499984, "uuid": "4ecd8fb5-f3f7-4aff-9f97-852ab0fc8aca", "comment": "Malware payload", "value": "fe5a71c3badcf2e078f51d082e06a69aeb9e0393e3c2a3f47eafdf96f76a13fd869bea36fe9172765c49f2f601ae7dac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499984, "uuid": "a660b683-d5c9-4ccb-92be-4502ec3cb338", "value": "T1ACC3E749A9429F01D4D735FAFB9F425833536BACE3F97101EA206F6023CA99B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499984, "uuid": "5df7887a-70f9-423d-bb15-345ce4bae82e", "value": "3072:hV/OR8I3fQOon5rJUGaxCwYNXmt5Waq/DsAMYjLArC:r/08ali5ruGaxCw4m5S/4ALjLArC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784499984, "uuid": "89fef6ab-450a-4f81-9f80-f49adc04c727", "value": 125064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784499984, "uuid": "23b4e063-9d49-4dc4-ae07-8a24b7c6cef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784499984, "uuid": "214d30ea-5312-47c9-846c-5c331a3dac6b", "value": "SecuriteInfo.com.Linux.Bot.14621.11299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9537aa64-83cc-11f1-be1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1784505012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505012, "uuid": "cd015652-84c8-472e-af15-ae9db889bf35", "comment": "Malware payload (Amadey)", "value": "5d11d7b9b175695c197014bc6aa2fbdb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505012, "uuid": "ec6c158a-5f4c-4ee7-9ca3-76ec1bf75cd0", "comment": "Malware payload (Amadey)", "value": "a86c023a02f1454738b39f753f50777c238b4ea296ffc76cd41c3059f216be10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505012, "uuid": "f09ebb65-ba1c-4522-a2e6-57cde2ad187f", "comment": "Malware payload (Amadey)", "value": "c25b20a5f15a0f69e0343b539bb4408a4e3739db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505012, "uuid": "c6e105ff-c111-48cd-8b0e-dc51262b0e84", "comment": "Malware payload (Amadey)", "value": "1ed84df2d19ae76712b87577937b9a336dcfd284752445bd12c8f5ef5c23353a944b31e0ab84d96d18b9ea6cf4126fb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505012, "uuid": "33eb4de6-cd2e-40c5-9025-85b0c18d834d", "value": "T12BB44A5AA25943FDE07BA17CD9535E42F639744703B18AEF039005772E532E2AF3AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505012, "uuid": "398a2d9b-899d-4a8f-b8ad-009e8e9be5ea", "value": "8db30f7f23140d78d7f34e827c0f7dbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505012, "uuid": "cc95d39d-1d08-42e1-b9f4-0e0f69df42fc", "value": "6144:LyB4DWmxd3DH+SOe3I3qEQ1kRtFlHvNzubRDePTRBhUCaraPOlfj1ohEVL8On:Lyi5h+SU3VQ1kRDhv0ibRQnoaVLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505012, "uuid": "578967ed-c239-4590-b54c-dadf231b2b3c", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505012, "uuid": "f22f60c8-6f87-4453-bf7b-134633d3784f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505012, "uuid": "95f6b1b1-860d-49c9-b7f4-34ae413e9a57", "value": "a86c023a02f1454738b39f753f50777c238b4ea296ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205e4a4f-8329-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1784434808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784434808, "uuid": "63f22d44-53df-40b5-a032-c7d4d01ce581", "comment": "Malware payload (RemcosRAT)", "value": "8fdf2c3d7962b6965751537f1a8e0e62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784434808, "uuid": "c69c8258-39a2-40fc-b45a-40389b8fb723", "comment": "Malware payload (RemcosRAT)", "value": "a8fdac79e70234cd7d6745e3777bc6c1c3e984a4931efc9f12210aac4679f30c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784434808, "uuid": "32292bed-cc0e-4eb2-9239-abde2493f4c4", "comment": "Malware payload (RemcosRAT)", "value": "6c7ace9b70f5a76e54a834e9dbc53e39ec343a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784434808, "uuid": "dadf0db5-afab-4694-9a6c-5d66a9dabb51", "comment": "Malware payload (RemcosRAT)", "value": "0577fdcec9435b50940e4d5a504cd054b1319d7b35734e406e8ec464deb65c803b7865edd54ab4c8dbf5fd042354ff3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784434808, "uuid": "73d5f7da-aba8-4186-a9f5-f488074eb4d2", "value": "T1E5B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784434808, "uuid": "4f25625c-48bd-4c77-8daa-098901653586", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784434808, "uuid": "72783012-c490-4df8-89f6-3628fdd82469", "value": "12288:1lQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZS2j/:1l0GcNUJV8i4mHM9/DZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784434808, "uuid": "7d953f63-9154-4dd5-b729-2c551b16b6f7", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784434808, "uuid": "a87c5da3-3b45-40d7-9476-45b1f9bd810c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784434808, "uuid": "c69a6a5e-7eab-4a28-9d0c-ef56ef1898f8", "value": "8FDF2C3D7962B6965751537F1A8E0E62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a720f438-83ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784491728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491728, "uuid": "6910d637-ef5b-4758-8aff-30fd0ebdbf47", "comment": "Malware payload (Mirai)", "value": "d46d290101175696f9f5e9ad15a16876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491728, "uuid": "df9803a8-9524-4c75-8d17-94185a912679", "comment": "Malware payload (Mirai)", "value": "aa91037d96973b8a145864fe4784cf74e3869ca4afdd51aea0dddc0a587c1aa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491728, "uuid": "73b90fbe-3bd8-492e-9539-440526e3eb71", "comment": "Malware payload (Mirai)", "value": "35b3fef9564ab0600cfc3b4e55c544a6af8491d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491728, "uuid": "d4b5c925-d056-45c7-8b64-4643247e644a", "comment": "Malware payload (Mirai)", "value": "4c066b8b37f6c4afa871e4666e344dacbcdb028f18bc233f3fe6f7255591cbe3a496d4b764f815f500976dae39cf9d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491728, "uuid": "c21d55a2-5f75-45ff-bad6-42c3c49b5ea3", "value": "T13EB32955BC829B16CAC2567BFF5E42CD371723A8E3EA3116DE259F20338B51A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491728, "uuid": "31dd23e1-dd2a-491e-94e8-488f6e716e94", "value": "1536:LbPbzSbj95kJIIIaVQy5d0SmiHgyhYmqdQLyZwsMhK6abGOZVLEGVKpiBwv/X:XfSbZ5uIIN5d0tisdGsMhKLBLG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491728, "uuid": "bb393116-bc9f-4d12-abba-2312b8fc4c85", "value": 116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491728, "uuid": "4570244c-0daf-4239-905c-a7743a3192e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491728, "uuid": "a675a4ea-b742-470e-ac50-a5a99c611841", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9568a71d-833c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784443165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443165, "uuid": "d2aa55b9-9d6a-478d-af40-51b9a743b01a", "comment": "Malware payload (Mirai)", "value": "1b39b3ea8b97cc1e62c33b0de0c2529c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443165, "uuid": "602e85c5-6336-465d-8792-e6bb2379a861", "comment": "Malware payload (Mirai)", "value": "aac6ef60a60f046d62353333ced62918c793560bfb2adc4ba63df0547eeef409", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443165, "uuid": "449d51e3-0ce2-450f-bec3-1e734bc1ea29", "comment": "Malware payload (Mirai)", "value": "0d27d6ae2e1df2ead628367d7b14a98556e19200", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784443165, "uuid": "a8315189-7ff4-45e9-b801-1eae380ab15e", "comment": "Malware payload (Mirai)", "value": "2484745b3a944cf000c66034ba084576899ba3eeefe6e0e0be2693fdf617270b08ed6ad8f5e50475fa6e363378079fdd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443165, "uuid": "c11c812a-1edb-45ff-aad3-2c2624092361", "value": "T12A016FC9A250D5009029D46D669761D0B870C3C7454B4B687F9C953DEBACE18F06AFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443165, "uuid": "905154ab-eae3-495c-8caf-b6fcd5613e95", "value": "24:kXCKysE2hi0ziQvZohaz1iQgMYTq1XfFycJW7:e9Qp+MsJiD/avFyck7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784443165, "uuid": "11cd5d7d-8589-4d52-ad9c-18b00c39d94a", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784443165, "uuid": "265773db-134d-4abe-a94e-fb0912a0fa2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784443165, "uuid": "c696af2f-2045-4761-b60d-f1041170b9dc", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfc8827-8372-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784466130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466130, "uuid": "5d884673-5b8d-4a77-974c-7fc45d9366a6", "comment": "Malware payload", "value": "51c846a5c524f9add94faf42c1f8f643", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466130, "uuid": "c28caf6c-000c-4f42-a5e6-469d59c2fc7d", "comment": "Malware payload", "value": "aadaed8083581afc4dcb28d5ee6d4e9f43300f5bba195684dbca235ef778e785", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466130, "uuid": "de35865e-f123-4b47-9c6c-11b89146e577", "comment": "Malware payload", "value": "22cc9b73c404e3ea38580ab20f562d1bf71e1c13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466130, "uuid": "c13a628d-43d0-44d0-9c0c-d01746147752", "comment": "Malware payload", "value": "9ddc23da865df66294f90cc67a6c4cd94238414f1fc4c8d8c56b7e280e5fae1a2a1276ae25d102b54084afab893c519c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466130, "uuid": "b2af4861-5f02-4619-96dd-b91c4fd1af73", "value": "T18A236D6516857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466130, "uuid": "727e8813-6bb8-4561-85e0-e4f3143b5724", "value": "768:GXRWNGxVk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ilxbcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466130, "uuid": "b5755fa1-8589-4e30-9f2b-70915acf764a", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466130, "uuid": "705d4f09-bf4c-43cb-a6cb-eda12d440628", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466130, "uuid": "b8d0730f-bcf9-4623-b5a5-8604b6d1e27b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a229a4-8375-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467678, "uuid": "ddc74351-c1e7-4f3c-b117-4ac87147b797", "comment": "Malware payload (Mirai)", "value": "3da21c39d41987fdab878c3b510e4be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467678, "uuid": "394000d0-b8da-44cd-aa34-a8fc427ad8f5", "comment": "Malware payload (Mirai)", "value": "ab4212d467132bdd2441a979f1680707b0d6bc222b6bb0f713a66999d5dc1bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467678, "uuid": "2ca837cd-c421-46b0-9741-6a3d19d1e8ab", "comment": "Malware payload (Mirai)", "value": "eeaa594dd9dc2fc60ce57aef9b1e5f83bcb8b71c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467678, "uuid": "dc1ae7c5-fe4c-4bb5-8325-e7d25dc991c7", "comment": "Malware payload (Mirai)", "value": "cd6e02ea7ccdae00b4f394b945a21c283555e7acef3b6b3d6562eb8350128201251e9cc5cfe42af5eabc99092679b6a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467678, "uuid": "764b1483-0cd8-4641-a129-ccc9afe2cd98", "value": "T1E8F2E0DDE0D43A43DAB76FA02E88FEA477A60F07370BDD416142BA2367A14741712ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467678, "uuid": "413276d7-ead9-4e34-a32a-0d525625211b", "value": "768:u5Ugcx5jvTu2m8VBgTEwDxmv1SkQ2vOBq4lwxhXO54uVcqgw09J:u3c/j78EwD4dBWLwXI4u+qgw09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467678, "uuid": "87ccd7ea-c128-43ea-8470-0412bef34216", "value": 34416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467678, "uuid": "206bd4da-8893-4ecd-bb7f-c92e4ea89b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467678, "uuid": "f237bc3c-461d-407b-ac8d-8f86f202f211", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9d243e-83af-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784492487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784492487, "uuid": "f913a78c-f1a8-41c9-8007-9ec729c77c4d", "comment": "Malware payload", "value": "70da50be5979a5f67cd9c6414f972658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784492487, "uuid": "60fe56d6-50de-4e44-b0a9-57818e3a3a41", "comment": "Malware payload", "value": "ac4b0373be4ff4de4e778f1363a4d0675a672d16fd11e8aa5b202701e2a6b747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784492487, "uuid": "c8bd720e-36cd-4ad1-87f4-b4ad114544ca", "comment": "Malware payload", "value": "7634d40c05790e0f8105d3b2ed20b0b18b1d8d10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784492487, "uuid": "a3eb41a6-a506-4ad9-843d-8c0edc7e4c15", "comment": "Malware payload", "value": "60116317d64b558b57f3a8c7893338c5caa6ed59b0d5736d93d853aa92b2c902dec23fc1fe8945a8c1d1bd7047aeca98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784492487, "uuid": "e27b7a7b-54a0-4a30-8e79-7d462f271691", "value": "T1FF356C5AF2F334BCD067C030439BDB62A835F46511226E7B25C4DA352E66EB01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784492487, "uuid": "038e8f2e-275d-4f0e-acd5-d0816beffe9e", "value": "24576:uXhFzvL/+vu0IZghKwWNnoURpxlpzf+P9d:8b/+vurZgcxNoURpxvz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784492487, "uuid": "92a9b02b-25d8-4f12-8a73-f56f828bfb9b", "value": 1161160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784492487, "uuid": "23bb90da-48c0-4297-a99b-acf906708fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784492487, "uuid": "c821ff5a-6675-4028-a2c4-1ebd23d286f6", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2424c9-835c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784456999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456999, "uuid": "85c5318f-4947-4901-85cb-e5c529806c95", "comment": "Malware payload", "value": "ac108558ae3c869e43266664e70d20a3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456999, "uuid": "728409cd-9dce-47fd-9f22-d1f97a589276", "comment": "Malware payload", "value": "ae89a8bbb5dc1d716edbc2d8a9bff87906ecfbb4c74f63f3aadf58b935189b54", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456999, "uuid": "a2731a4e-0a99-4482-ac10-a8a97fa32c74", "comment": "Malware payload", "value": "68d5a2459a4a19af4e0e7f60daeb8c662f14a912", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456999, "uuid": "7e8ff7ff-25f9-4f10-86ce-b727b212dd9c", "comment": "Malware payload", "value": "34db23ac3c074f9e9b3f3bca74d18407a5b35d5e521a4ada1c6cf9213fc58fdaa7acd33a5eaa1e3426985a8265da4876", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456999, "uuid": "9bcff776-7f86-4cf7-a5fe-6402d058cd12", "value": "T1C92733A668262E83CA6026BB23531702BF310DB33B1187512D79F92D1CBD1FA5B5D35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456999, "uuid": "fe8f3a93-9241-42f0-8461-4c0d7841925a", "value": "393216:kncN/pyn3S3glJQv87upm4GCAKUd2Cu3et11GCaTSLiY:kU2p+06NA7dpIetOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456999, "uuid": "18cc542a-2ced-48a3-9f0b-d42ee4b1d0f7", "value": 20361216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456999, "uuid": "81179d36-644a-4221-8564-233544065c8a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456999, "uuid": "b0fd959d-b22f-4c91-a5fa-79e438c8df3a", "value": "TROLLBUSTERS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b328fc-839c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484452, "uuid": "c35cf81a-3e01-4535-9fd1-d96e06e9ec72", "comment": "Malware payload (Mirai)", "value": "851f0e298caa000a8eaa9d6f12df8a6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484452, "uuid": "2ddad8db-f1e4-47f3-a911-16763ee86463", "comment": "Malware payload (Mirai)", "value": "aecbb022d48c5f5849325f0c04e1e1881d132841c071ebd5fd52cb7baecdb322", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484452, "uuid": "9395bd2e-4de8-4a80-8c2f-34261f25ca9f", "comment": "Malware payload (Mirai)", "value": "769e249bc558ee020f3bff6c67e0161c2f9d2e07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484452, "uuid": "3fd9b1f6-1648-4cd6-959c-8d4365415f09", "comment": "Malware payload (Mirai)", "value": "16ffba7f912033f55dd2449542ebbc70c1443801411c094fc0d6e161c86e3e7207945476b6603eb8a6add1af59d7712a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484452, "uuid": "16e02473-9e5d-4e2a-a8b7-1921db93a71f", "value": "T1AA93BF62C8292C88C56441B9A0B8FE7E5B73D6005AD36EF7199BC976E047EDCF5053B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484452, "uuid": "63868e98-d2c1-468f-8481-b68413709ec5", "value": "1536:r/B4aAcahGSxYEoSlxpzwPkKlFUHbyyR7CZdWPeloNLU:rJ4aDOqE3lxpzwPLlwyyR7C6qo5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484452, "uuid": "c74b4362-4769-4d84-bd3e-6ec83d972b9c", "value": 95776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484452, "uuid": "a2b92b5b-50c9-4f5c-bf74-b8d3d6fb94e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484452, "uuid": "7340a33e-3363-45a2-95be-2a1edc41c56d", "value": "ohshit.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9cec2e-8335-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784440328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440328, "uuid": "99860fc6-73dc-43ef-b075-0c974ae15f51", "comment": "Malware payload (Efimer)", "value": "b11becb33bc7b8085b930a394b7ba9d7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440328, "uuid": "639ef20d-3e15-4c31-8219-9bb752fc20d4", "comment": "Malware payload (Efimer)", "value": "af1d19bf26f31a5f31b2ae4ca5afd32760e2ade17e8bc90baac8ff4adcafc782", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440328, "uuid": "047d0fcb-1c1d-40e9-a5fe-a0f7782a258a", "comment": "Malware payload (Efimer)", "value": "81f9e240d7fd58297dc17791248d93accabcbb0c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440328, "uuid": "56af2811-13f6-4e22-9e26-9b5a49ad6e5c", "comment": "Malware payload (Efimer)", "value": "aeb8f6c507e4be8c088d589cc260773dfcd007284fa92e7c9386305b45f3d168e8c533a1a12a7e612bb2ffb261bc62c9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440328, "uuid": "b2061295-1b00-4603-a37f-df8847064676", "value": "T19AE6334CBAE012FEC6634138EEE16156E46974E25B72CACB83A84371AD077D0AD3C757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440328, "uuid": "9e0aeb9d-624e-4def-84c1-991bd8ce48d5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440328, "uuid": "6eea834e-a202-40bc-92fc-a0d3a7c372ff", "value": "393216:R4mR4E0KHnw/tCDJuzg2b4VyHoiXMCHWUjXLcuI3/PGTAI:Rntnw/tCkzg2sVyzXMb8XoH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784440328, "uuid": "1e4c700e-7abb-427a-9f4a-6e0a142ab72d", "value": 14320010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784440328, "uuid": "43a0aaae-83ba-4f2a-94fa-a9b17aca21a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440328, "uuid": "cb05c53e-c767-4501-86f3-17edeca79a68", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6d5162-839d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484761, "uuid": "ad459c0d-f2ad-4780-a452-ad9b6665a05e", "comment": "Malware payload (Mirai)", "value": "44ec8db910afa737a0c28e128fb14c88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484761, "uuid": "ba07c560-e1b8-4e8c-9bcc-af77ff56eb78", "comment": "Malware payload (Mirai)", "value": "afa22b3cddcf3a13e640b124568fb4be163b4198456007bf4594d77ff17a2176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484761, "uuid": "cf319418-2ba6-47e0-a1b8-acf6092668a6", "comment": "Malware payload (Mirai)", "value": "418fa0d9a1d8bfa8e29c2a37a97647524bbfd6a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484761, "uuid": "06200233-7443-4d54-b9b2-73df1c55d0d1", "comment": "Malware payload (Mirai)", "value": "68354ce6df33ce143997a33d28c0d621c122df04458c46003913c2fcef000a3f90c7c44ffabc4d2a8dd24f15b601d200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484761, "uuid": "dd7722d1-dd6c-4374-aa44-a9a6e3c29d7e", "value": "T12A530174EA057C70E7ABFCA65C21D20036E84F831E229DD53FCCFB612D85365E8A6981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484761, "uuid": "bf8f2706-e6a5-40a5-b4a8-b28f79531465", "value": "1536:WAFoD1au9rP+Dmyfu/yPeXTVNueVjes8bz7SGfpPF44u+qgw0rC:W7Yyb+DB26PeXWgMJfpK4u+qgwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484761, "uuid": "a2ca5369-97ee-4938-a821-97bf0a7b90a1", "value": 64068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484761, "uuid": "c94ab750-7112-43e2-b0f4-43214705cc64", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484761, "uuid": "c1a79ad7-0b11-4dd5-9f7c-6d58f089f7b6", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99dee56-83bd-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784498604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498604, "uuid": "e73eb858-b8ff-4e78-8e53-c9f3585001f2", "comment": "Malware payload", "value": "00e4147f5e232c04d27d48fff55abf96", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498604, "uuid": "3990edcb-2572-4d12-ba85-02c2e48d6f21", "comment": "Malware payload", "value": "b0f43bcb2af128106bda1ac0495f70028d364056e4a9521e4e06f1b83769e022", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498604, "uuid": "19391660-09d6-4f86-b9cb-711b065c65ca", "comment": "Malware payload", "value": "794dd38cf7afcd86b2420ccc3d65c7b2bc4aaba5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498604, "uuid": "63b8e297-9569-4e10-9ae0-0fba7c6f4739", "comment": "Malware payload", "value": "fd29767a609bc319a0e296ab37b1fceb6fdebf256d7828e9c571ea98b50838b539e888fb5a26d015a84201c8dd87b35e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498604, "uuid": "4e618369-3ea3-4e82-a8f3-68122dbe1a14", "value": "T18C852353A7E88163F6A6377CA8F11323B2793CA01B7393DF5A406A9C29337C65531726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498604, "uuid": "a24e5123-bffa-40de-ac72-d760cf318b1f", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498604, "uuid": "8653ae7a-7ee8-4495-9ee3-ff3d934d4c6a", "value": "49152:HkfovDwaxCH/WmLWoi3xS0TASv9hiXScHQ:DEu34crv9YScw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498604, "uuid": "1a13e5ae-36de-428e-9015-30a3913e2dff", "value": 1768960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498604, "uuid": "b1153c5a-01dd-43c9-b5f1-9c835d5dcd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498604, "uuid": "ecb70bf9-316c-4dce-949b-0a760cd96a06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8815e2-8398-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1784482746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482746, "uuid": "5b8093e0-a5e8-4cae-a06f-6635769a9f56", "comment": "Malware payload (Ladvix)", "value": "aa673bd11a0754c0946fdceaa5edc9cd", "object_relation": "md5", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482746, "uuid": "a1bce35a-e654-4903-afb7-5b161a64c11a", "comment": "Malware payload (Ladvix)", "value": "b102c576c6439fe1d571fd2274a6927c3d064ff7a677612818e74202743a7e67", "object_relation": "sha256", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482746, "uuid": "cdf9fb53-d184-4b06-be8c-ee52125aa6d5", "comment": "Malware payload (Ladvix)", "value": "868b02fa9a3a8f6a2bbed7a7126d5e7fe03d573a", "object_relation": "sha1", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482746, "uuid": "30d8d771-7961-431d-a75a-4490e9a10aa8", "comment": "Malware payload (Ladvix)", "value": "78de1e8009ec05e5767bec556e1eb0b2bf8a5b9d7d025c8b6183e632ce0bc56937b7ca6074d6b1d1a7393ad56b0695b1", "object_relation": "sha3-384", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482746, "uuid": "b24faad5-55e7-43f1-8246-aee619fb230e", "value": "T1DBC34ACFAF79C92BC99C473048D74A345737D5747B428B1BA294E5B858033AC9E4EE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482746, "uuid": "5eaaffa6-c66d-49dc-bb7f-22eb386177b2", "value": "1536:GTqRR4Wl70kf0lxdUmxlVtxaUToMmRydSjjyCjk0lMRWr+8cu5ZcD/jHfdtfhxff:62R4WlmdKbXyIyCjkvqH7cTTvfTpLU6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482746, "uuid": "d9531bcc-e210-4864-9998-23edc4b7b5c2", "value": 127125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482746, "uuid": "b6d573b0-d535-49ba-b60c-310b864dede0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482746, "uuid": "aa121179-9db8-4f96-a6a4-8dbab03f4ac3", "value": "so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022be708-834f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784451078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451078, "uuid": "c193b2b7-d152-45b5-84d6-f5df3c6139db", "comment": "Malware payload", "value": "d0cec1850a2d55308369f58291d1f362", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451078, "uuid": "cefff7b9-8e1c-425a-907c-89c5ab473d8f", "comment": "Malware payload", "value": "b1287ab346d488cf587ff52932119e02113403b9b9a7231e5c95fa0143de1a39", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451078, "uuid": "f4ce2d25-f4d6-4cd1-a33b-a71202892cd7", "comment": "Malware payload", "value": "7ba2ce48b3f4c2d9745f74e6ac60208d92f0332b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451078, "uuid": "6006f597-3781-48eb-9ae2-e7c402f02281", "comment": "Malware payload", "value": "70897933d80c96f38a4796a174b3ac075a3057d0b15053fff64234f0d7e3276e12fd64bce410aca8d84c49554828a1fa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451078, "uuid": "121151e7-c1f6-4df4-ace0-193276f06542", "value": "T1C753313AD630FCD0C75D327086662D9A21986D56C7B34D64DB093DFE3D32B81EB29688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451078, "uuid": "11711181-f1b3-4df8-942a-a2541cdbdba0", "value": "1536:xHNGxoDRx3280h8ZAOc5ROeqNKHASY80h:pgROdKHAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784451078, "uuid": "c51786f5-85a8-4e5d-9af5-82eb0bc249a2", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784451078, "uuid": "948f6978-12b7-4edd-8fee-0b08e0146c9c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451078, "uuid": "3cbf1acd-0aac-4993-8597-1e8fe76f3d32", "value": "SecuriteInfo.com.Other.Malware-gen.19824129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b37cafd-8373-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784466663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466663, "uuid": "5150a651-c419-4723-9158-295f1cbe0cb3", "comment": "Malware payload", "value": "c55a417f8f706a443e171e2bf33ab86d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466663, "uuid": "df7052d7-acb5-4431-bb60-ae22e26f226e", "comment": "Malware payload", "value": "b133491e21676bfa27da7ce00e6114cba07a6df61ebb44a351c4ca9ec901bb13", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466663, "uuid": "9af2ebff-bb78-43bb-bcdd-b37929331025", "comment": "Malware payload", "value": "9287f5f24964cf3701233981b656ddecdd0038eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466663, "uuid": "3c392b7a-22f7-4301-b15a-0e18954deb20", "comment": "Malware payload", "value": "8c5d8f5db23405513e36f5d035159c261b607f6fb0f6ad335b855746259ad377633e7fee3bb85c8f9eb3ce1459baab82", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466663, "uuid": "c4f40213-d2ee-4206-bd3b-9d49813a0880", "value": "T14D235C651A857C24AA98C4361D7F2F0CB9AD43E6320452EE7FCF3CF28C5A6AD910572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466663, "uuid": "dbc02065-6e79-411d-8f36-83c63d5a74b5", "value": "768:p6Utd8/k9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466663, "uuid": "cad516a2-c77c-4116-8c28-d51e0b0dfee1", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466663, "uuid": "9c00a348-1834-4468-8ffe-a5b445db8cf2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466663, "uuid": "bfec46d7-13ef-4503-bc5b-fa8d7e7ceaa5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c265977-8372-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784466315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466315, "uuid": "587639b6-fd6c-4250-82b3-b1fec40e1817", "comment": "Malware payload (ValleyRAT)", "value": "04bf243799acb592533811b6c84b7218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466315, "uuid": "c188abd5-ac43-4764-b448-e3c7797a8ded", "comment": "Malware payload (ValleyRAT)", "value": "b1dd9ebb57480de3da86e683639b328e9dcf291b4bd2d4816986d1b0cdfa9342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466315, "uuid": "81065c38-b5e4-4e0f-8a83-996250f4aee4", "comment": "Malware payload (ValleyRAT)", "value": "708fe04eb5e82ecd6414bd33cbad95fb88b3571f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466315, "uuid": "a64ac22f-1f23-4d85-8778-9d1473c405e2", "comment": "Malware payload (ValleyRAT)", "value": "393ae1e3dd6c92c537acfeb2d7d04619db07fa64548c389c83ec3c7ac6d6d407d1c0d45dcac9c2e94726e85e5e124eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466315, "uuid": "aa516958-e8c4-47f5-8e22-925124e5d9d8", "value": "T10E16023BF28BB53DE06A1A397A72D110943B7A21A5164C0696ECF48CCF255B11E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466315, "uuid": "d4d5d275-150b-419a-b453-7f462249adfa", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466315, "uuid": "031b25f2-9133-467b-956a-632d8cb79d47", "value": "98304:R5OkzgrwE36tsUxnvtJCpVmfoq5X/gL7kBO5WIw0XDR6PktV:LOwdtsU9vtJC2oUXI3kG9t6PktV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466315, "uuid": "adf724eb-26e2-4a50-ae32-76a72f190fc0", "value": 4104140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466315, "uuid": "043e1bd6-6ede-4635-9baf-8fdb525ba5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466315, "uuid": "dc6fbc16-93a4-4288-bf3f-7283b8435d01", "value": "04BF243799ACB592533811B6C84B7218.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef0f748-837b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470239, "uuid": "3009de99-a35e-48dc-9176-cae36388f7bb", "comment": "Malware payload (Mirai)", "value": "ad0cac94cc52a2e5949eb1de839599d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470239, "uuid": "48efda26-f33e-4e20-ba20-e869b0d859b5", "comment": "Malware payload (Mirai)", "value": "b289a64659752061d00dda2194e4c81fba3d987998393883f312b26db71fc2f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470239, "uuid": "c2e0eb6b-ae7a-48ec-8867-2dbe1d7a5600", "comment": "Malware payload (Mirai)", "value": "1abd3cab526501abaf0fedeae106675f2b04b9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470239, "uuid": "5a670961-47ea-41ac-a9ae-1d9ad6ec41fb", "comment": "Malware payload (Mirai)", "value": "c4f16aa7521afa919f1f06893dde55a39f87fac0903d8b0af0ce2f12ab20ac77d5306c08a2e9331185d64c016d507d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470239, "uuid": "25f831cc-364c-4404-9b1b-0327b3201c23", "value": "T1E1632A91BD815B13C5D1227BFB5E428E372663A8D2EE72139D226F21378786B0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470239, "uuid": "5b39e691-493a-4294-a25e-7181d0a10832", "value": "1536:5CSyiaYDGeA6rCrGU3LyHC+SLDi7oZxs/Ar:5CLKQaU3ThL8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470239, "uuid": "5453d9e8-7ed7-4e6e-9252-6e3154c2bc41", "value": 71848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470239, "uuid": "4df01434-da92-461d-acfb-a96751c6d075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470239, "uuid": "2c55d837-f24e-4064-ab6d-2e0b8b829e48", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b8a34e-836b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784463486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463486, "uuid": "6e6eaf64-283f-433f-8e71-097b8c681fb6", "comment": "Malware payload (Mirai)", "value": "50108fdd987f84be218e9119ef8f6c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463486, "uuid": "2c7ae2b8-a60f-4007-abce-fb71040fd8e5", "comment": "Malware payload (Mirai)", "value": "b344517661f610615e73e816fd83bc81168dddbd086dc19098aa801bbb5462cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463486, "uuid": "621bfec3-f90d-4ee5-80f7-d720e488e437", "comment": "Malware payload (Mirai)", "value": "688e3923f9147837b39d7fbe4660111a3e826ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463486, "uuid": "9b2d81df-9ff7-43e1-8020-0024f941d8dc", "comment": "Malware payload (Mirai)", "value": "550e68b03d54d2a67ae3c2a64d6956a959203a2561b7d32c370d572690d9d321ff599aedd651ac7228e501ca387880d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463486, "uuid": "bbf06f15-3e69-4290-9b16-1ddfa4c9c134", "value": "T15C4302E6D1147C15EDF27833BC6A2394673D1A78B2F7B63082D506E1E4C40674BB6AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463486, "uuid": "9c59eba5-20f1-4019-8c9e-bc4b685d81bf", "value": "1536:ymrFESqmttjSK//i2oEc4WupWKRkCH8rNHfh:HrHqIjSKy2xpWkAHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784463486, "uuid": "797c632f-2ddd-429d-b5d8-c496238109f0", "value": 55524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784463486, "uuid": "83ee9f22-55ee-49c4-afdc-7e6c4a9154c9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463486, "uuid": "9669828e-674f-413f-8a11-467f55ef3f02", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36412912-83ba-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784497122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497122, "uuid": "f4aa4a1b-9811-4e25-95ec-b4c76720a077", "comment": "Malware payload", "value": "6ace29aed82b0ee150304f3e13b267a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497122, "uuid": "12048a8d-9936-4762-b379-6bcf99797f49", "comment": "Malware payload", "value": "b4349af6cf33e548e2578d98890571592fb67d5c4bc6a89ab5ae43e838c327e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497122, "uuid": "fe77c939-6f94-4eb9-8926-2d7a3f817ae4", "comment": "Malware payload", "value": "f745d2ec598300e575f4ba0cb8d857ca32010e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497122, "uuid": "99b18647-33f9-4c30-bdc2-292efb812fec", "comment": "Malware payload", "value": "211f0405ca03f3a38c12107d0ae3de247d8e7a6d987531ed90d4ebfa8cd90db96aca7137667c23398d977ac39b6f7089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497122, "uuid": "244938c3-ee18-43a1-85c8-290fce78fcca", "value": "T152456C5AF2F370FCD067C030439BDB62A835F46901226E7B65C4DA352D66EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497122, "uuid": "c8a97fcf-5b70-470d-9140-c11b353b0673", "value": "12288:zhylQa9o2DYvYwKAAltEJCyivWd1DolqoDOupFdmy96+FGVPA45k:zja9o2DYxKAmtEJCyxdUqBai+sFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497122, "uuid": "7b3eac79-9860-4061-9346-56f38b535537", "value": 1169352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497122, "uuid": "faf9e1f3-99d9-441b-9402-769f5379f837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497122, "uuid": "61a4510a-0791-4e99-a6e0-4fc2f468b5c1", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cd4c6d-8372-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784466164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466164, "uuid": "e18d2682-8507-4d2d-93bf-1493032f71ec", "comment": "Malware payload (Mirai)", "value": "63822a299a93885cd41c374d1b9dd217", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466164, "uuid": "aa3699f4-8230-4223-9313-370517ab1f0f", "comment": "Malware payload (Mirai)", "value": "b5399be2be15939b9cd5a84b48d40ed1338b30c6a146f987c3f1b6daeffce0d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466164, "uuid": "c8e77ebc-33e4-4e4f-a3d1-d1be2808e102", "comment": "Malware payload (Mirai)", "value": "495ceb7b669020a49f3213e5f911632195549d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466164, "uuid": "a98d8a7b-4f14-4a91-ab98-4cbac3d36d07", "comment": "Malware payload (Mirai)", "value": "d0ade3212e706defda575e6fb0d4a9481ff0d93d308cf77382d895cbd03489d0a6254cc62eeb1636b8fa4fa3b6bfc87b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466164, "uuid": "fbb03c90-9426-48d2-b59e-648acf9430b1", "value": "T1B7C33B0674A154FCC16BC434C76FE937EA31B45D13343AAF6784AA712E22E751F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466164, "uuid": "a44fbf79-253b-486c-8f93-c85a72912818", "value": "1536:kNmQAEUxS4zJ0Ln8wigyiGPZPxRrdMAsVv6E8CkjRHC/hsvvQLz7HG44Nor4X:kNmP3o4zJ0L809GxbsVuws3s7HG4Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466164, "uuid": "ec9a4b11-de97-4be5-8865-39707352fe21", "value": 128888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466164, "uuid": "fb70b68d-d731-455f-9866-ca3288390367", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466164, "uuid": "6fdba0db-9888-45da-8c4f-913b87ff27e6", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda83993-83bb-11f1-be1e-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1784497805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497805, "uuid": "389b89af-ebfd-43b1-a58b-4958f546758b", "comment": "Malware payload (RedLineStealer)", "value": "8c21b2fbded2faeb6db2e7a20c513cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497805, "uuid": "6a8d37f1-2b38-424c-ad65-9f552b822305", "comment": "Malware payload (RedLineStealer)", "value": "b59653f1e2b8dae784ca4211199d2887ea676d27e7af9d057a625cf9281c17e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497805, "uuid": "d4860907-37df-4141-a152-e603f8f69a1f", "comment": "Malware payload (RedLineStealer)", "value": "38b837cc5fe814ca9580f9029386aa405f8e94df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497805, "uuid": "4f6dabfd-59d2-4d8b-8760-815556b266c1", "comment": "Malware payload (RedLineStealer)", "value": "7f3aa4bc816d7a0724effda2ddadff69eb5305762c8a3e15927baab9e5b3654d4cc054832981e94a854091d426bb370c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497805, "uuid": "86b69024-8862-4411-a9c0-78ff552d7319", "value": "T19DA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497805, "uuid": "31f0a29d-50da-4725-9e3c-a3c7d2781dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497805, "uuid": "48019ae3-731e-45e7-b0d5-d05724ae3514", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2z3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497805, "uuid": "eb84006d-e85c-4b3d-b0dd-b257f6858d9f", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497805, "uuid": "9f8e7a82-ad91-46e1-9e52-d1d6e2e44a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497805, "uuid": "89067b21-4928-4c07-9f9e-c49acd905eb9", "value": "8C21B2FBDED2FAEB6DB2E7A20C513CDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0027a8a1-837d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784470832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470832, "uuid": "d8f81cf0-95c5-44d7-84f7-611004d50f5f", "comment": "Malware payload (Mirai)", "value": "295a93b1d67d7b3eeaf1f6845b89770c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470832, "uuid": "158ea1c8-781d-46dd-a176-03963f731b6b", "comment": "Malware payload (Mirai)", "value": "b5d5834c3f8b74d7db5dafaf82e22fa0f2782a5c176e8d12e0aa50e31adc496e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470832, "uuid": "bedd4b42-472f-4aed-8507-736d90548e6d", "comment": "Malware payload (Mirai)", "value": "6616e47ceab0426c605daa4f9d9812be518c95a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470832, "uuid": "88806c1e-5f8f-47c0-b028-59094959bfb0", "comment": "Malware payload (Mirai)", "value": "d1323d0f5ef72a6fe93a0b0307e2ad14a60fd6133d3ef9b40a4b96c2059810e6eef709ead9914d4b00a028f39a6f26f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470832, "uuid": "ec8c3106-c5e8-4908-85c5-4f44888870ca", "value": "T1F8E2F23023EC6087C10E0235A69A7ACDF5B3A4321FD6CBA66DBA5F10EC511B54FB6652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470832, "uuid": "6149b0a4-6918-4c0d-9d07-ca38d0220905", "value": "768:IfrGFEyCF8Y6bZoHTwhEw8X/dpENDukRecmr1S0ZfvL:5FETx6iECtdkH0IaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470832, "uuid": "8842435a-410c-48a3-bf85-e0fe636a1e99", "value": 33976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470832, "uuid": "e41ea78f-a584-4f9c-a1c1-d28987b25301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470832, "uuid": "252413a9-ad32-4cc9-8cb7-c71b539baca4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad20d0-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494712, "uuid": "d1dfec58-bf11-4271-be0f-08f8bf85b141", "comment": "Malware payload (Mirai)", "value": "749a4e458da178fd35017300e7415e2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494712, "uuid": "109accde-93ff-4c39-a3bf-00391a24b12d", "comment": "Malware payload (Mirai)", "value": "b651c6d5c7499a41b6e3d840c0254fe53db6e8d0ab298fd2327f10b3c6892e5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494712, "uuid": "5a630212-4c25-4c0c-a097-11647434f0ab", "comment": "Malware payload (Mirai)", "value": "89f2db9310df174485101df9c81497e16736504f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494712, "uuid": "bef4258e-4aeb-4f38-b713-96f322775574", "comment": "Malware payload (Mirai)", "value": "c20eba59e1b217494b2aed7c5d49618a778411e3c0c4f6690f5e38ae8cf55ee3e6a55223ec2a99261b7f5d664976e91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494712, "uuid": "ef37400b-a23c-4764-91e2-92e5521eb57e", "value": "T10F933A88B981A626C7C25677FF0F428D371657ECE2DA3302DD144F61378B92B0E6B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494712, "uuid": "09c1e177-0d23-49d2-991a-ce7ac97e0512", "value": "1536:+CVxmRhPrMZoGdTz9TfWUNiLoHDiLWAY1nqBohjhPm5gjgfj1ryAdJ+GbvY8ZYao:+C7mRhzM1dTzIUNiLoHmLWAQnqqPmgkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494712, "uuid": "73965cac-df1b-4133-9b5f-5f87c1b700e9", "value": 96576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494712, "uuid": "5f604d01-4ac9-4110-bd5d-3460f7e43a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494712, "uuid": "027fabd3-07b3-404e-823d-96452f4c76f6", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35178f19-83a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486812, "uuid": "d8344e94-493e-4609-b0b1-c26d4d16fd9c", "comment": "Malware payload (Mirai)", "value": "aaf2680ff60c0f58a731574c9753801d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486812, "uuid": "6e5c99fd-ad7f-4886-97d4-c3ad5692b9a9", "comment": "Malware payload (Mirai)", "value": "b65f46923cfeaccb0287f6603d5f02d901dce5aabb00246fcb9a96bb215b17c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486812, "uuid": "ee623a4f-5eea-4d1e-9e65-b062a89089e3", "comment": "Malware payload (Mirai)", "value": "3a56ba1778417171b37e1a893f13a30edc15ed45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486812, "uuid": "5a5f670f-15d1-4589-89c9-96449b06e1f7", "comment": "Malware payload (Mirai)", "value": "4710e40dcc836795e10ba5ba0120e4adec5bd2b7c41e903d3fc45d4e368001ba44f5b9c0d64a6a4dcbf1d5dd13f503ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486812, "uuid": "e77fcdec-86e2-41f8-bc20-1de36eba434c", "value": "T17AB33B56F8819B21C5C712BEFA1D618E33131778E3DE32129E186F31738B5AB0E7A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486812, "uuid": "26d29d45-914d-4625-96a0-430862b6cd36", "value": "3072:dqXlZU6xyXNuEHKWNgaP6rn2IdnePhLn4Z+:dqXPkdhHKWWaRsnehLs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486812, "uuid": "af2ce3df-8d8e-4fab-97d9-8bb855c1343b", "value": 112092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486812, "uuid": "e9639e68-d475-4d63-b2f1-3e26a100cdf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486812, "uuid": "3298a00b-bfe0-4784-b60b-767426644ff9", "value": "ohshit.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd6c855-837e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471341, "uuid": "f8a7b5bb-87af-4170-a351-4943d974d40c", "comment": "Malware payload (Mirai)", "value": "1f7f06c435403be07634cba48045abfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471341, "uuid": "b611f078-b56c-4336-8122-a803d38ed034", "comment": "Malware payload (Mirai)", "value": "b6b9753bf156d5eb5dcbad43de9ab651146a819da27fe9d2c031097ca10619d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471341, "uuid": "9ef57781-7cad-421e-8956-a29d2c32cb8d", "comment": "Malware payload (Mirai)", "value": "c9ee86ef2d102d5e467dc2bdb3c48f0e9390bca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471341, "uuid": "82f8037e-88e0-4fe5-bbfd-980e4589c0c8", "comment": "Malware payload (Mirai)", "value": "0200b0cdcc4cb5325ead03b9eec469967c2aa5a38ce99d031935f1a44d7002ba3820c8d2325f1403cd6f2af5a612e598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471341, "uuid": "534c2aea-dfb0-44da-9080-16ff06cdceed", "value": "T135D32955BC82DA12C6C2167BFE5F82CC732623A8E3EB7117DD255F25368B91B0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471341, "uuid": "c572bc36-ffb0-4a25-bc9d-43c9cda640bc", "value": "3072:Ockg40qNvfsrtxzNeP+ZqEDn7B8Af2G8R9FlnbUT:Ockg4tN3ib5RqKmY2T/FhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471341, "uuid": "ab8f53f3-ea44-4d0c-9e9d-89069bda8aaf", "value": 132428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471341, "uuid": "13e9da43-321e-4a2c-8a88-83fc2f7e0f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471341, "uuid": "1ca68e7b-64d8-4b89-8bcc-2a4ab5351286", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099dfff4-83b4-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784494470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494470, "uuid": "1acda130-9aa0-4340-a8e7-bdd72cd18f43", "comment": "Malware payload", "value": "495c4e40e6dec6b9d65319769f853af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494470, "uuid": "5014decb-0b17-413a-8798-f0340aafcc0f", "comment": "Malware payload", "value": "b75b7abaf40b80bc41974504c34e78804339d229eb5ab145e447b16017e3f123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494470, "uuid": "c16fd015-86a3-4fc9-9187-b51db12aab29", "comment": "Malware payload", "value": "e7f926f7c31ee1ca975c60f5e7734ae464c9a8f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494470, "uuid": "579cb492-7591-41d8-8caa-b27ebe42ee3c", "comment": "Malware payload", "value": "cbc3221260bc31e13cf4f9fdf1f16d25992f8ea65235232009a15531738ac65c56851b1246e09bc7314f765b9d9cb7ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494470, "uuid": "ef15a3c3-2098-4416-9d68-afb98483dd31", "value": "T13B631A76BC419F26C1D52677FF2D4388331727A8E3EA7113EA156F6137CB82A0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494470, "uuid": "81eefcdf-2911-4c29-ae3a-bdf3394b0d70", "value": "1536:/fbOjmB6L/w1TAyKsY4vNPSbAb1SZp/G7iMWVYZchZFq1UqexOaGF:/fbOjmo/IcotNu+1Sb/GuMeKGZFq1UqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494470, "uuid": "829ec7ba-d3d9-4875-b569-c6a13ff4715c", "value": 71316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494470, "uuid": "32339f89-9d3d-423b-8e04-39b92c3219c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494470, "uuid": "01cd10c5-070d-44ed-8b2c-98d5aea9219c", "value": "MfzI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd9b6a8-8373-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784466583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466583, "uuid": "c8f21718-c4fa-417c-88c0-893de1f9a61a", "comment": "Malware payload (Mirai)", "value": "5ce8e737436c271f939b379a3d88046f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466583, "uuid": "194dae0a-fba6-4bfb-ab97-3bc87a2a508e", "comment": "Malware payload (Mirai)", "value": "b8045ef43df0ccbd3cfde0fbcc7e51e11ed44a09098e0652ceed1bfebc4feffd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466583, "uuid": "fdd3859e-4946-4a5e-a449-854d47a1a903", "comment": "Malware payload (Mirai)", "value": "ff805da79f50c1af46159af8a67d9825c74baf9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466583, "uuid": "af48536c-a70f-45df-b760-230ce16ec2b2", "comment": "Malware payload (Mirai)", "value": "a765e8b3b77331da4acdaac3cc30c9d838d2e494a74a37af0f7f5967f5a0bdc2dfb5d7ac908d67826f0321417a436465", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466583, "uuid": "0a70296b-6e45-40a8-ad16-a5071077d026", "value": "T113042A49BE652BE7C05FCE70162D830721DE944EA2F6A73EE67CCD4C389A24859F3854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466583, "uuid": "fd91424c-e5f5-4d99-9339-94e801491924", "value": "3072:FheGUbjmsykhXxKYSGxXh+cHxUVnotHI69r94U1DvU:/xUbjmsykhXgYSGxXEVnotHI69ySLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466583, "uuid": "8ffd835a-69d8-4ef7-a103-34ec7404fc8d", "value": 183768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466583, "uuid": "7cb16bfc-4189-471a-848a-d558b5e0cf92", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466583, "uuid": "e801f05e-69d0-4eaa-935e-1e2dcaf08bac", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc47a92f-83a8-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489669, "uuid": "b41765d7-c174-4740-8696-701ff057a0a2", "comment": "Malware payload (Mirai)", "value": "43e23df28d8817de8abf651bee3487f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489669, "uuid": "277d4ab5-4e83-414b-89e0-7f3f9ddeaa88", "comment": "Malware payload (Mirai)", "value": "bde278961bdbdf0294c3f66114972c9258e7f11d3e9bc7fb9f837a27d8189b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489669, "uuid": "78fda3b4-b19c-4c16-8156-748662cecb64", "comment": "Malware payload (Mirai)", "value": "7e7916ccd5098c25b31abcc5bec8f4e456200e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489669, "uuid": "e833b14c-5c44-4bd4-a86d-5a766c125716", "comment": "Malware payload (Mirai)", "value": "dd176d878936778715cb973bd61115de0001f62250e7c8a85495cd90d85cb1bd74681b64339c1e58b12e933432e03841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489669, "uuid": "4ed50fd4-1327-4829-95fc-ce9f60f16a16", "value": "T1A7B30763ED269F16D116E0F0B2F24EB41F93BD6649431FA9A532EAE44183CCCB5057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489669, "uuid": "874e9d66-b70b-4683-b2fb-203b73d4a230", "value": "1536:xlso/xlsa3C4KtMIh7usHkOvs/siu1diWSCGR7vjG75gtayh:zfsa3it7JkOvXfMWLEq1gtayh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489669, "uuid": "88f2551b-44b5-41b3-98c7-10d328963be6", "value": 111400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489669, "uuid": "6fea9521-d8fb-4186-847e-8ec3ef9f88de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489669, "uuid": "1c2904d0-87f1-4ac9-81b4-fbf4e5efafe7", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4a5aa5-83a1-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486446, "uuid": "f33adcd6-a147-403b-81ce-e92c88e833d5", "comment": "Malware payload (Mirai)", "value": "a8195cf48d6a5f8beaa3beb4af054b24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486446, "uuid": "3ebc2730-4cd4-4940-9ab7-a555097fbc52", "comment": "Malware payload (Mirai)", "value": "be45e9deed6d9f3fae1a875937880ab8e4350058f2af6df9237dda8777c7cf57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486446, "uuid": "40f38b5f-f5c7-4458-b1f1-14b7ee711c36", "comment": "Malware payload (Mirai)", "value": "b27cd81d46b126c15a1310d0e8b4d212a932c7b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486446, "uuid": "38547d02-4179-4dbb-9267-0b23b1ccbe60", "comment": "Malware payload (Mirai)", "value": "c2ca2c1ceef3d680534f26d9d7dac9a2abd69aceb5ec764c95c991b5399697c25829cd90fb9d7293707b11cb070aadf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486446, "uuid": "767c6443-ba47-485e-afa4-9921d47b37e8", "value": "T166B37C86D743C0F1EC1606B1143BB3678A36DD354035EE86EBA52E72AC23F119A1B76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486446, "uuid": "b80d8bca-b0d4-4fed-b14c-dcfd94ee4746", "value": "1536:jfdiTQLCLZi+CCrSA/mKJSkcz1FKiMhqc9tn8yTxhyAW0LzBNrLmrTIp9yVX:sTQLCLs3KM/jKiHc9ayVhyvcz/yIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486446, "uuid": "52cf1c52-506d-41c1-9df8-2790989d2dd5", "value": 115824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486446, "uuid": "7c6d03a1-ac15-4bc1-ac50-d2432a144dcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486446, "uuid": "0c54eaee-ed67-4213-82ae-ba184fa19975", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd52b5b3-837d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471203, "uuid": "e3e969a7-f581-4d3f-9c9e-3b99076d5607", "comment": "Malware payload (Mirai)", "value": "74538ce9ee84bc191e31508a1f095d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471203, "uuid": "4fd94677-8b47-44d0-adb8-5658d07042a4", "comment": "Malware payload (Mirai)", "value": "becb06a6690d4066674d9d67a2589d29e8667700d640dd1c5bfa862c23d7103f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471203, "uuid": "ba2cb46e-e23e-45d3-a006-b90c0dbd2995", "comment": "Malware payload (Mirai)", "value": "18b1f2e1b7f33c84838125078319b9cfbe2abcbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471203, "uuid": "9203bd8b-2ce5-4e99-9351-a455e88c2b95", "comment": "Malware payload (Mirai)", "value": "f9931999d98718deeba6ecc53d2f954cb2f4e255c85a7eb98cf4a4701de59109ad2ad7b399221d7951876f22dd14b390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471203, "uuid": "e2c01cfe-7a30-46ac-b9e2-bbb53f8833b6", "value": "T177C33A99F880DE52C6D52676FB5E014D33231778C3EE7106CE249E3477EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471203, "uuid": "27977d80-116f-475f-a4ab-8068038df4c8", "value": "3072:TGHNyFbxvZNVNdVop9T66cYEEU0zv7p4x2M789vNt7iUAFI+Of1DlLi:TGtOdMu6cYEEU0zv7p22QyvNtQLO95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471203, "uuid": "53106bde-6103-4bbb-a9b6-afb3fd663d79", "value": 120232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471203, "uuid": "2a49e164-74e3-4d96-b819-08f92c9cf751", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471203, "uuid": "6306fe72-294f-40f6-b682-9bde8fd32f97", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495631c4-8369-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784462365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462365, "uuid": "f9c13469-b043-44ca-889d-92013954578e", "comment": "Malware payload", "value": "674ef18597c4c0dba438ea5afcdf633b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462365, "uuid": "073b9287-0d24-4c91-8130-0561a8d33baf", "comment": "Malware payload", "value": "bf70cfa5cd5fc2b5c4f8ebb4d8dfba9451e113a21ad3b32cce20566f7eebedb8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462365, "uuid": "c86ffb49-c1be-4cfb-88f0-73412f641b08", "comment": "Malware payload", "value": "46012f3c458d791cafeb16fc8bb4130c61daa42d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462365, "uuid": "dc5c6c29-5591-4f1b-a963-40596b83ed82", "comment": "Malware payload", "value": "ef5de7543130cd5ae228019eacd5cb559dd58cb063c43d55bd3f11dd90f834f7ee70ff2e714cf5831bf7a3bc0bee4414", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462365, "uuid": "aeec7334-eee1-4cfd-8eef-82be796b6808", "value": "T1B1C27D966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462365, "uuid": "82df4f1e-d942-43e9-956f-d1669388f905", "value": "768:D8vCB+25j6es8RPC9FYpMSUpi+20qUpi+20YQX:D8l25J8d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784462365, "uuid": "83b19567-c03d-42d0-b662-cd890e0f1ca0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784462365, "uuid": "a30b721a-226f-47ca-bd79-c9d2044efe3a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462365, "uuid": "1935869c-a81b-47e1-ba63-1ef7aad25b31", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c42120-8368-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784461931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461931, "uuid": "92afc0e8-74b5-4897-b40d-7664b54632b5", "comment": "Malware payload (Mirai)", "value": "7e24bd65cb248b7382d8ea6e33224f88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461931, "uuid": "5cf9a0fa-a942-43cd-9ff4-14d1e043fac9", "comment": "Malware payload (Mirai)", "value": "c044018dd433ce580b3cabdfe6535b253125d80c3c5b58bf6be4348239ca1cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461931, "uuid": "46fb7a98-57b6-4b2f-901b-737ee0e85a76", "comment": "Malware payload (Mirai)", "value": "0459bdd292dd33d2e698ad8d6bbb1ce8d195e0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461931, "uuid": "729599f6-2012-439c-9bd2-5e04ae455502", "comment": "Malware payload (Mirai)", "value": "89c5927c7969cf5c71ec50e932c25314cd37fcee9bcc9efc7f68944e20960edeaee9e3fdaf44ad6a100dfa318616b516", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461931, "uuid": "e4fbeb1c-7baf-4531-a00e-16e3678d9c9a", "value": "T1CDD36BC6B20D7EADE5972E7CC1021717AD1C9A519C83910190B6FE072EB36E71E369CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461931, "uuid": "03f6c6ee-b5e4-4845-b182-c04e9391ef98", "value": "3072:QHTsz1phjF8sPR9VQ4IuBJre/OFovRZFaCQLLjyoO6:Fz1pJR70YJr85vRZYCQXv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784461931, "uuid": "d44552f9-fd81-4f29-8be4-605c0901882a", "value": 133472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784461931, "uuid": "b8d5193e-a027-4194-ba75-2b4e37175f73", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461931, "uuid": "fcf330fc-d52b-4c8d-a654-69430a2b0abf", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a160bb6-83ba-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784497236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497236, "uuid": "4d2ffb68-d053-43f1-bf5d-d52023d6a6b3", "comment": "Malware payload (Mirai)", "value": "7474b4c7ac35e9e8b208d382c97f3a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497236, "uuid": "22920a12-4fed-4bbd-95dd-127503b8f958", "comment": "Malware payload (Mirai)", "value": "c0c1d395712071dc9c34a3681a02c3fb16ffe6ff24c418f94ea694d48c168b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497236, "uuid": "168863f5-06b7-437c-bade-cf03c34fdfd3", "comment": "Malware payload (Mirai)", "value": "9331fe8d3a6182eea49093c925f9dfa1bcd12d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784497236, "uuid": "7df77beb-0580-43e6-a954-1f3395e653fb", "comment": "Malware payload (Mirai)", "value": "543b25fd8689fa3a016f1e5a94415940cbd2f2d7fa65afeb6c49ee17dfd1206f984159070ea5068fb477830b70e77d37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497236, "uuid": "033ef9eb-6216-47d7-aba4-d4a0c6662244", "value": "T15B936BC6A683D4F5EC2202711177BB379A77F13E2079DE83D798A936AC125C1E21639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497236, "uuid": "2f52d354-670f-4804-852f-c1ac851645fc", "value": "1536:+tBoxpxvB88K2SfJg8cTIkErr2BzDH8hbO9KwmeikF:+tBoxpfYJgtIkT3c9O7iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784497236, "uuid": "e966ffd1-9f32-49b4-8d5c-ed78f52a1364", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784497236, "uuid": "daa13dc6-2710-4e63-8ee4-d5510a9cfd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784497236, "uuid": "620f4f9a-1cc1-441b-9990-5578a7e7eb69", "value": "ohshit.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7555eb86-8362-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784459432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459432, "uuid": "cb00a7bd-23b6-4023-954f-64bb832c2f18", "comment": "Malware payload", "value": "cb00b4e56738f07d2eea549b82127610", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459432, "uuid": "d0dd063c-7500-498b-a596-fac29486caac", "comment": "Malware payload", "value": "c1362fefb284dbfedf198fa211204b3283179ca0d0b7a5797fc9ab4961d3605b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459432, "uuid": "62e2b80e-29b3-43c7-b08e-c745fdfeb558", "comment": "Malware payload", "value": "aa80a5ad5d73c9a45faf56fc60dacd00a10a2673", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459432, "uuid": "6ece2758-b3f0-4a97-898c-0bbe132a4cdb", "comment": "Malware payload", "value": "527188a1815942b8d69dcd56ee7b6be6ce9ba93fa13d7560e5c5febdf922d85c5bf2743a8149136c1315ec12806a2d72", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459432, "uuid": "84bceb63-1d43-4222-aade-c23832b73645", "value": "T1C608333C5431D048EA1991B720E5FD72F388C212707548AE4A689BB46BEF8CEE1DD797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459432, "uuid": "5de44161-5ce2-46a6-ad6b-a12bdde7fa9d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459432, "uuid": "ee06713e-2413-482a-9337-25cdd917a703", "value": "1572864:jt9IKPOb5z/RWYV2IpeL+QvGRJMpuoF3bI3IRVAIa5KU7:jUKK5z/RWKHpeLDGRaRBbI3ik5KU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784459432, "uuid": "ce3b8075-1f78-45e1-a6f0-9d719a19e38c", "value": 77397708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784459432, "uuid": "62e9dc7f-6b3f-4bee-9e08-8d7464851d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459432, "uuid": "d63dfc11-6a00-45d7-9bf5-395b36701d76", "value": "App_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae78ce-8369-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784462298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462298, "uuid": "845c02c0-df1e-48d7-89fa-389f84e4924c", "comment": "Malware payload (Mirai)", "value": "862d8e4ee44bb70cd6e7ee7709ae4189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462298, "uuid": "06bac045-bf64-4878-90cd-35485288b5fe", "comment": "Malware payload (Mirai)", "value": "c1c9c2e2936bf0492c896647531f6212d9271f1881c8b95d692d4aee48b4d472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462298, "uuid": "ac278561-d64b-4916-827a-8080cb880b67", "comment": "Malware payload (Mirai)", "value": "6acb6689f46a6483279610a61c7329d98915d331", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784462298, "uuid": "b7a315d6-a365-4088-aa36-e62c057527d5", "comment": "Malware payload (Mirai)", "value": "ba4aac390b330db06cd68de52e6b6b716bf0ee2ad70c3c320eec98df5f47d71252f5da5072d21aef99116f9e5a20f62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462298, "uuid": "5d2fa6bb-c22c-4520-a9c6-40631ec4bb7a", "value": "T1C9340965F880EFA1C6D42A7AFB5D428873130778C6DE7102DD245E3477EB8960F7A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462298, "uuid": "c06dc803-6abc-47ec-9139-64ae83487209", "value": "6144:zJRZiAPqo+c3RKxwQNIJwM5tAq56lJ09xKE2b6mh:B3+c3QxwQNcqq56S+6mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784462298, "uuid": "44e28b17-fd8e-46d1-9732-eac7086f40ca", "value": 249292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784462298, "uuid": "949f81d2-4059-4ea7-abf5-1c39c7d0fc57", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784462298, "uuid": "a66c5ebd-1f7c-46b3-8ed3-3361d1207ea3", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c64ddd-835d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784457335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457335, "uuid": "ac7eec0e-ce65-4aec-bec4-7beb1544ae44", "comment": "Malware payload", "value": "5cc34f1b14c69f0f277de5f32294e366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457335, "uuid": "de93b225-df85-4a79-bdf1-198e1ead97ca", "comment": "Malware payload", "value": "c2544d40ca76e3112a1ee78a80eac4a321bd540bd4c0c8a93fe14062e1796db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457335, "uuid": "3359693e-2072-4598-9d4b-98308959afb3", "comment": "Malware payload", "value": "6d0b339bb7cb20fbe368e0dc68accb901372c31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784457335, "uuid": "dbd5ccdb-1fe1-4780-8180-38e7e88a5b19", "comment": "Malware payload", "value": "a6b8cf0ad2a4c3bd7605d537566f5fe19b8aff912a725605e2343ecaff266d259ab91278d95d1584a7a77e792b12088b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457335, "uuid": "4dee1326-d0d3-4980-bf24-7522a0176398", "value": "T12566D62BB657457CF16A853AC39F8B04D8F3BD745B7281E3368C0368EA42BD44E7A524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457335, "uuid": "5e1cf2da-dd12-4877-acb6-9d96cb2cb334", "value": "84702c834326954655d1118866ba2cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457335, "uuid": "07610740-6aff-48c0-9fdb-a94b72a7b0de", "value": "49152:OHKQyy9sC131rhTEzs/0vMSkYxkmbXwvRJ4m3m9Z:OHhi8Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784457335, "uuid": "24f21ac8-793a-4534-9b7b-ce3a7c615a41", "value": 6598000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784457335, "uuid": "4ba864b5-a993-49df-a4b4-5e981d2b0d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784457335, "uuid": "00c32a1d-b385-4a42-9b92-ddc743c8d666", "value": "Unix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514008e5-83ad-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784491584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491584, "uuid": "b80dbcd5-ab2e-4f61-b05f-4605346b9874", "comment": "Malware payload", "value": "5326aef18a0cf2c5a0214b395ba510e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491584, "uuid": "5331a9d2-d3ed-4507-990f-c334e31e8583", "comment": "Malware payload", "value": "c29da327855142577dbb802096148c8c805595809bb3f8a89ed96b785fa45ac5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491584, "uuid": "329d8dd4-ea6a-4b50-ac57-8405579395be", "comment": "Malware payload", "value": "02d4fc8f297fa8df39f10f2134e952523e5bb077", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491584, "uuid": "68ae9651-61e8-4565-9b46-c90720e9b112", "comment": "Malware payload", "value": "9a1060b8887fd746c14c06315f20971e0749764e3e6093e421aa43ad1a85607a40d10b45b45a0c1fa7eda03b49e60f9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491584, "uuid": "3fcda23e-d96e-4072-81b7-8d5505f7e9fd", "value": "T1D7C27C956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491584, "uuid": "30de8929-9e3f-4916-96b0-659b51b42a01", "value": "768:G8vCB+25j6es8RG9FYpMSUpi+20qUpi+20YQX:G8l25Jwd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491584, "uuid": "d6f453a5-b8af-484e-96d2-3acb7e0a32a0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491584, "uuid": "bcbd6bd9-4569-44f5-a6f9-ce2300eeb355", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491584, "uuid": "52283dd0-a188-4909-827c-085bf0b71637", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65f70fc-83cd-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784505524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505524, "uuid": "cfa427d0-6226-459d-9caf-d360e6061390", "comment": "Malware payload", "value": "b6362cd5c7110adfc5a80b1729afdea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505524, "uuid": "e5f110c8-39a2-4af2-ab86-bd96fcdc2622", "comment": "Malware payload", "value": "c533aeec0e53aca326d421c3d1483e742c8476e4e17125ac6267de6bc8df2dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505524, "uuid": "36e3f822-0bfd-4da8-b55e-7af3b4574688", "comment": "Malware payload", "value": "3f756adc090988135422868e17ff8431c6288ce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505524, "uuid": "dced953a-85a8-4ae8-9fee-274ae138fca0", "comment": "Malware payload", "value": "08bef1cfd8424a61e76f51aefe17ecd44833f10ce6424f4ea53fcfe690f5fac4c75103052b72384e76caa63481cc1210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505524, "uuid": "62b357a5-4084-41b5-af02-47ec86a75ddf", "value": "T1CAB312774DAFD44186D1125F60424982F88AF6A69DCEF07735B3791933EBD4E20FA260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505524, "uuid": "9c486282-b49a-485c-9886-d3f0cdc6148e", "value": "3072:uoMkRyvQZ2h6JzWPgMLiKziw3IAgOIIr9k8o:uoqoOHP/LiKmw47m93o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505524, "uuid": "5037755f-823f-4486-80d7-acbbc8a28a49", "value": 115360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505524, "uuid": "c6973b4d-c0f0-44c4-9c94-14d8cfdd9105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505524, "uuid": "480e005e-4f6c-41d1-aacf-f75f55f14fa6", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dba935-8309-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784421038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784421038, "uuid": "5969d7f3-76d0-4e62-80ff-96ee1dfc4f72", "comment": "Malware payload", "value": "2862898599775e54c61c8beb8c505fc5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784421038, "uuid": "00c82ce6-f1d8-48b3-9847-0b0c9cc0ef04", "comment": "Malware payload", "value": "c60861d98b3aa236c215d5ce2a4ec571c2ec8a8503dfb57472eb2d3cbc6e6c04", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784421038, "uuid": "7ddccf37-c320-4612-a426-40f4af3d7cd2", "comment": "Malware payload", "value": "73cbf954fdb64e76f8125e00ad4e52a76a9a2290", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784421038, "uuid": "04ac23d8-3b0b-4186-b3c4-8f90ad287ec8", "comment": "Malware payload", "value": "d64c734a45a79a523a240c1154ce22f5549d7d2b0f59cc0f82bdae492a5edd0e8a8f73eef67add5c1a9d591153683e51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784421038, "uuid": "bec0802f-7397-4a69-90a5-f3ffbbe6aba9", "value": "T162C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784421038, "uuid": "44cdfda3-fe43-4e66-82ec-223a84ca98f3", "value": "768:Y8vCB+25j6es8RGr9FYpMSUpi+20qUpi+20YQX:Y8l25JG9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784421038, "uuid": "7be6a9ac-b335-45a5-b6ad-f8ffa62b5a6c", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784421038, "uuid": "f6c34dc5-82ed-43d4-8768-8c7b5a5f6902", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784421038, "uuid": "22fcfd06-e875-4bf1-9ef8-b1416309dc5e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d6fb43-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784479034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479034, "uuid": "2040219f-230c-4afa-8f43-2676bf34b6f0", "comment": "Malware payload (Mirai)", "value": "6b39d934791618c00503dff1e600638f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479034, "uuid": "25d1c42c-6f9c-4a50-a9a0-53d2f2d9ccc1", "comment": "Malware payload (Mirai)", "value": "c66b83d2e4f021f73b630d23f3dde7042358e0447b42ff3c213c6ce61d11a58b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479034, "uuid": "0f5ea084-b3ed-4951-9d71-9f1cbbd250df", "comment": "Malware payload (Mirai)", "value": "ffa0f96da2c4a10b52d0deba435de1149c0b3049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479034, "uuid": "6507cb14-c900-4852-9e42-2ce8f67808cf", "comment": "Malware payload (Mirai)", "value": "5947b8c99722aa07515e391157a64f25f6b89fa179ab9654546238d9d7b49a55fa879bb89cb188457009042173a0b11a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479034, "uuid": "1eabf181-3c4c-4c86-8aa8-8ed4ae00a217", "value": "T136B3E846FD418F13C5C721F7FBDE42987E266B6DD6FA32029925BFA0334A4D60936212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479034, "uuid": "c5d51712-2437-4c6c-a539-e6a4adebc4e9", "value": "1536:oMc2nH8c9BkU4ViuN7+FnM7QOaMHsEXlR8wywAFaPqI+MX1McOfln5Jvbda:NnHjf49NSFmzMJpIfIbda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479034, "uuid": "42977af7-595d-4bcc-a59d-c8501320b5c3", "value": 114748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479034, "uuid": "0424750a-e603-4b61-90b3-c9887b8a2be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479034, "uuid": "5c97de92-7832-4039-927e-6184bff341f0", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88bcc25-839a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784483677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483677, "uuid": "670f7105-1971-4407-94f3-8fed83514855", "comment": "Malware payload (Mirai)", "value": "245d1c6cba8c5e6851680c984669a128", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483677, "uuid": "800580c2-cfdd-4bef-9a40-91890c5b181a", "comment": "Malware payload (Mirai)", "value": "c6c566cb8470a7bd45dc37d15bda27eebcc8f4a60ab6ff4b5fef78371f370491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483677, "uuid": "7c7c1821-1cff-42a8-b023-e7b8cdf0e558", "comment": "Malware payload (Mirai)", "value": "9a1c77f7c195c7cbe91234772b7294fb73164ea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483677, "uuid": "f45dee28-6395-46a7-97ed-76aa21e9c21d", "comment": "Malware payload (Mirai)", "value": "780e6bdbbc55fc5deb7665545ee148d7cfe030c7a3760674a1e2de0743d38c922fbc40e2dc8bbfbc544578fb0a1af7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483677, "uuid": "d5e5ccd4-ba0c-4130-8a8d-3421eee50372", "value": "T120B3F846BD418F13C5C725F7FBDE42983A266F6DD6FA3102A8257FA037464D60E3A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483677, "uuid": "1a7a508f-790c-4cc4-8f75-d51f49291bdc", "value": "1536:6BOsPB82Pd4VKbK7F9a17DrCOX0NCLxleMlywyw/7EnN509riOKdvZtwRH:6BXPB74oK59yC80YmKwy0wRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483677, "uuid": "972a1202-8887-4e32-9baa-f86a76dd5161", "value": 112236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483677, "uuid": "79679e7e-c876-410a-b189-f382031971a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483677, "uuid": "806a8e85-0816-4e4a-9d94-efe2790e9948", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d19bba-83bd-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784498441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498441, "uuid": "0c886f3f-52dd-4560-8def-44300558edb6", "comment": "Malware payload (Mirai)", "value": "d7b10af0ce884e8fd49c240eb2fdd249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498441, "uuid": "b69c5808-5572-412b-873b-ddd42d959209", "comment": "Malware payload (Mirai)", "value": "c7e7d77602c121ebe2785d8e4068b7d459abe975ad9e3e8471ba28e9783b8dca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498441, "uuid": "bdc5a9d7-44ce-4f62-bc95-0f7a8846493e", "comment": "Malware payload (Mirai)", "value": "a81d2162ac5bb8a757d0e95be268f6fa73d9b9a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784498441, "uuid": "9f4279ce-0b7e-4c20-a409-c137f1866cb1", "comment": "Malware payload (Mirai)", "value": "2d34284b26f8bb278057eae3bb754b78af197f62df94715a2305cc97715c215b5d6dfe1e66142a2c90d0c8801b825f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498441, "uuid": "2f3d7f43-e098-4650-9f1e-36643791d2eb", "value": "T1F3A329C5FA8B80F6D90748309027F73FD632E9798071DBA9EF559E36D933581A216388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498441, "uuid": "c788f3d3-9290-4c13-b01a-eb0e59524e86", "value": "1536:pu8JYvDni1mLnTWZT+9TGZ7VGeIpgGp7EnW2W1sSZFfDZd4sP+l6ik4qt88:s8xsLTIOTG52KGp9uSZFftd5iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784498441, "uuid": "f4f34f0d-0012-4d1c-9ba5-48fc0b3e8bfb", "value": 103700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784498441, "uuid": "269badc9-7e42-43c1-bda0-2d85d242cb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784498441, "uuid": "e5ab8fb6-e29d-40c0-b845-a9c99cc5a4a8", "value": "ohshit.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd501907-8346-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1784447527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447527, "uuid": "f610b329-7557-442f-a34a-0694fa1d846f", "comment": "Malware payload (RemusStealer)", "value": "028444fa140270d784a3420187cf1b29", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447527, "uuid": "81964d54-6897-4881-90ac-1e5f428f2fcd", "comment": "Malware payload (RemusStealer)", "value": "c8f4ceb5940e99ce6cd30cb9f67202c1d853b19d8f4c83882823d1647a2971d9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447527, "uuid": "6ce87a7f-86ec-453a-a7ae-8037dfdb7416", "comment": "Malware payload (RemusStealer)", "value": "af748d49b26e8692579768c451c354e851f98830", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447527, "uuid": "eb38f8e0-473c-46c9-b425-98e0cfc63739", "comment": "Malware payload (RemusStealer)", "value": "910717641fb587875206d685699946f4dd75eb106e17ea2bc03a4bc47bb30c435d36bc6b6765d0f05207330374744c8f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447527, "uuid": "e474f04f-011e-4822-8ffe-515ba0fa06eb", "value": "T130657E2027E96159F57BAE36DBE6B146D67FF3626A069F4F0144834B0523B02CE83D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447527, "uuid": "967101d0-010c-4942-9c72-6737adeb268e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447527, "uuid": "02d93bfb-f53b-49c2-a956-ad996c42881b", "value": "12288:LC5keneuZPiYlzAoZd78qSb/elY6SlWF76ogH7sOxjkS4Y5Q/mrOToM9+PyPuOve:LeZZ6YlT18PvlUOogbCYFRE4qnXE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784447527, "uuid": "c8b55dc0-3762-4ad6-8c82-e34f92ef6a3b", "value": 1467904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784447527, "uuid": "33928e7a-7fff-4a03-a3d0-c459866ab856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447527, "uuid": "7ec79e61-6f16-4d03-87b9-e84532d909a5", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5547b83a-8398-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1784482571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482571, "uuid": "996c957b-cda2-486a-aae9-26fe4842f75e", "comment": "Malware payload (Ladvix)", "value": "5f4e868e86afb5703f883968451a8330", "object_relation": "md5", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482571, "uuid": "56273b8c-a8f2-4627-9d7c-b0fffe0c06c3", "comment": "Malware payload (Ladvix)", "value": "caf1fbc26581de43de4a12d2887a55436216013432172d2333cb95809dfdc365", "object_relation": "sha256", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482571, "uuid": "ffc4951b-31f4-47f5-895d-142b826885be", "comment": "Malware payload (Ladvix)", "value": "259d034caf17eebc67809f633f624fa88426d2e4", "object_relation": "sha1", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482571, "uuid": "ae08ee48-c95d-4d69-9dad-be117dd3cdd3", "comment": "Malware payload (Ladvix)", "value": "c88cb3dbdba26ab963e41b1a01da6111781a331a1331355664e2dbed4ec9156fd192da2b35a52f9fe49224fb5420bb42", "object_relation": "sha3-384", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482571, "uuid": "87081f92-566a-4d0b-85e3-a53af9b12057", "value": "T1FF063913FCA555E5C0AEA1358A629252BB717C492B3123C33FA0F7382F76BD0A979354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482571, "uuid": "50ad1994-50de-46cf-a94d-347b4a3e10b0", "value": "49152:6d9LsbtZd1GZoxrzyqHcmbD9YPrw1ezRBQoveA5nnqKWK9KIs/QL9s8V5Er:oZgTQ6xv7zyFR1N9soL9sMEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482571, "uuid": "95ea914b-830e-4d39-b8d5-4350750a2d84", "value": 3989903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482571, "uuid": "258d2085-4542-4128-90ee-7062cf5dd2b2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482571, "uuid": "630071ca-3380-4b79-a46a-6dbad1cd57d6", "value": "socket", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009a6926-837c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784470403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470403, "uuid": "65b3d502-ddf9-4dae-bc19-52c08b9fe17a", "comment": "Malware payload", "value": "7042f098d2aae5bf3f837a5fa5d84773", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470403, "uuid": "89a5f7c8-b579-45e5-b2b1-fedf832d2742", "comment": "Malware payload", "value": "cb8a0983480154e7618ac59b47445c7ddf4b95634e6d2760462d2bc6fb95f3a7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470403, "uuid": "52e628e5-dcc8-4edb-881f-922633abdf64", "comment": "Malware payload", "value": "8b965639a7807a0b0bd98b71f6b980c6e076e5f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784470403, "uuid": "75c54c8f-73f2-4408-ad25-268aca7a3393", "comment": "Malware payload", "value": "630231869a6c751c2e89d2992dc1759e97e19428b45d2a45b233bea98bdd8a5c42c023e34a15dff75d4c6663fe52477d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470403, "uuid": "1cbd596f-af3e-4f6e-b3c4-67d75620cdc2", "value": "T17914290872DB23EDF187D5B204E89D23B22458D3E26144095D2BDE7816B79AF736A3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470403, "uuid": "580af8c7-a3cb-4d08-ab33-f77a3cbbdc69", "value": "d4ad4e6883878549cd313f3fbb5fffe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470403, "uuid": "88d6e922-60f8-4c89-b4ee-6ca80d590977", "value": "3072:2+wATP44xZEBICk0ErnyU6fBxJ/P1vJ2IE7whnJ///////+B8ok7TFZBQmRU7iT/:2+z0cZwEIfBT4whkB8ooZTgihO8yCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784470403, "uuid": "a4e6944a-c0f0-4623-8b69-e939c9f52f7d", "value": 193723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784470403, "uuid": "837dc207-cd12-476d-8f4c-5a4f8b00bb5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784470403, "uuid": "0817779e-e59e-4e41-b240-762072670e33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7c6dc4-8370-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784465564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465564, "uuid": "96983fda-1163-484f-920d-0437741f0a38", "comment": "Malware payload (Mirai)", "value": "f0c3648f0ef900e98e860e52d349b570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465564, "uuid": "d2accfef-fb6d-4503-a76e-0eb589d4aec4", "comment": "Malware payload (Mirai)", "value": "cba985038a22c0619c1437bde02f52205d01c9fc8e10cc0003880327369b5cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465564, "uuid": "b624bcd8-b8b8-4340-a45d-893a95e3ce63", "comment": "Malware payload (Mirai)", "value": "c7921010d51dc357baf48fd7eb3991e3d076fe88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465564, "uuid": "2f135cdb-f82b-48c9-b2ce-c325b1a72ebe", "comment": "Malware payload (Mirai)", "value": "2325dcf81ec202484d7ab79b2bc15972dc1b586daad147fdf73462d71db21cd5044fb08d69f7bba1172fc96094d618bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465564, "uuid": "8d891d6c-157b-4507-b233-0284964cd698", "value": "T15DE35B48FA57C1F0E5C345F1063BA7AA963A99226237F5E1FF563B61F871302588932C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465564, "uuid": "9e6a6b45-d675-441c-adbe-4ab7f4d53cb3", "value": "3072:oSjnQzcCh+exb5ioE2TafOw9WIU6sG91r:tnMb5CovGN9e6LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465564, "uuid": "9d4943f0-7849-419d-8e93-6702a2c5768a", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465564, "uuid": "0cacb453-b63b-41b4-bb12-9989327edab4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465564, "uuid": "f5d89b02-1be9-4aa6-bc27-61d67c1f5d1b", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a50d41-831c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784429529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784429529, "uuid": "c1e05e0c-43ef-4908-9a93-2711caaf2bfd", "comment": "Malware payload (Efimer)", "value": "1fb9a6424d7eef704700dd64ed2e7f42", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784429529, "uuid": "3f64f181-738b-4a86-911b-1a50c2df21eb", "comment": "Malware payload (Efimer)", "value": "cc2ba5d5272e640a2ec9caeca2f92cb4606c84bd5c0b9a394b960879b28a7e9a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784429529, "uuid": "0162c001-2faa-480e-9111-bb5462406ea4", "comment": "Malware payload (Efimer)", "value": "2264cd64033ee93b15f5d6edecdb47cda8dcb55b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784429529, "uuid": "24f7da59-6101-4d1c-9661-41e4c3b5dcff", "comment": "Malware payload (Efimer)", "value": "ae77a7526e0addd179ea2780902b3e39c059046c558a7e904802a8bdf6e9736d26e31292c8503c1a68c57718c8d3dfe8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784429529, "uuid": "150ca826-9ea5-45d7-8e46-8bea624cccdb", "value": "T1DFE6331819E403EEFAB3407DED91A981D1A5FC690376CAEB0B9C4661AC771908D7CB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784429529, "uuid": "0449855e-4515-4ca2-b9fa-2bd5f76165c2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784429529, "uuid": "3eebe97f-3ece-4417-9250-7e32ac7d57bf", "value": "393216:SrOEG66I57C4CPVvAblm7r0ZpXMCHWUjXbcuI3/PGTAI:SP3C4CpARmv0nXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784429529, "uuid": "e182e917-11bd-485e-b244-3e005a57f01c", "value": 14289297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784429529, "uuid": "6f8ef23b-de04-42d5-8c5d-f77946b73c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784429529, "uuid": "3d54591a-435c-46d4-ae4a-02c90cc5af39", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b71c46-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784464717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464717, "uuid": "62178bcb-668b-4ed6-8476-04936f42d7aa", "comment": "Malware payload (Mirai)", "value": "9c341d1fb0c5f81bd7b319e80a8f406c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464717, "uuid": "0cd985c7-ceb7-48f5-9af4-cef21bb2a8f5", "comment": "Malware payload (Mirai)", "value": "cc711306374cf12ea3758f72f55a43d4123618f0c2d5196e6c87d6be1888cb0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464717, "uuid": "1059f1ea-66be-4e84-b3bd-8ac79553609c", "comment": "Malware payload (Mirai)", "value": "a16b390de2580be47c6fa0ac31bd54691db262c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464717, "uuid": "03dc2849-24bb-41c9-b024-23b1b61b3eea", "comment": "Malware payload (Mirai)", "value": "038a65f90551a04cbf47542f11928aae2b6feffd21e2a3918c84197bb15401719358574293af1d079a3cf6909582b0e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464717, "uuid": "a2414c57-1e40-4864-a49a-0fe066ca7d98", "value": "T1D904295F7B10CF21C729C53046B3CB9656B926522BE28989F31CDE047E24349B92FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464717, "uuid": "acca81f7-0dd6-4ec9-80fd-b568f19f89b7", "value": "3072:m95h62R/gwLLLnuNxNTOLKWSt87aWbU+ZQe1DIjBffY:WzjRIauN3TkCK77ggQcau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464717, "uuid": "0146a25f-31fc-484d-8265-80bbdc8ac526", "value": 187732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464717, "uuid": "78305669-fb61-4919-8b08-475bc8c4b567", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464717, "uuid": "f289c062-b17f-44f5-997b-1a753bbe1339", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cb6194-8390-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784479023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479023, "uuid": "097d6cfd-60fb-4547-aec1-37a66d3c299f", "comment": "Malware payload (Mirai)", "value": "06e4c56aa94a7689ce453a1b96a98904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479023, "uuid": "ee247f2e-39d7-4668-8e60-f1f1a3b3af7d", "comment": "Malware payload (Mirai)", "value": "cdb52f1a26c5bd9a4955a1e6732038070232e684af6ebd1ee01c123ab836617b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479023, "uuid": "80100ed0-3cc2-435c-81fb-1a11d814943e", "comment": "Malware payload (Mirai)", "value": "b8fa70a4504ac28403e3bc41b557456dc2964dcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784479023, "uuid": "78dbe88b-3fa1-4280-887b-1d38a385ea57", "comment": "Malware payload (Mirai)", "value": "846b653be352abdf8107e836a8e1cbb56a299553fe7f35ae0c605288d7f6102b4ba8ffb545a29886feac1c47066f36c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479023, "uuid": "3649deb9-bf60-49a6-bdb3-f3c367adace7", "value": "T113C3F906B5518F12D1C221B9FF5E425937136F78D2EE72029D24AFA0778A8FB0E7A116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479023, "uuid": "1e8fe96f-ad1d-4b14-83dd-f20e051ec2a7", "value": "1536:94nJuSYxLhhRhm2QXy2ta/5aiNuB2ViaSOEKY55jdZWS5b2fF40m0Nu5cI4SE5fe:2Y3hqpXOBaySOEKY55j792f3DnHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784479023, "uuid": "9e236cac-d1d6-4afa-8354-b0a43bf7736b", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784479023, "uuid": "224848a9-24a6-4b2a-bb88-7ff224db1894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784479023, "uuid": "493fa53e-ff98-4461-bd25-97b64cfc9243", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98febad4-832d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784436728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784436728, "uuid": "6deebb27-a958-452c-afd5-57272c784f24", "comment": "Malware payload (Efimer)", "value": "262feadc9466f2671c8c3590b98b4c79", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784436728, "uuid": "69cd483b-31af-4c52-a8bc-7bf8fe8695c1", "comment": "Malware payload (Efimer)", "value": "cdd49f00660b51b4857c6a10a06f71a535073036d441b72c6a044e2ebcda178e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784436728, "uuid": "9cfaa74f-a975-4840-8ec9-ade76cab6a19", "comment": "Malware payload (Efimer)", "value": "95466d93111f7f63616ad8f1e39ce18dc3a72aa1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784436728, "uuid": "8c7494bf-99ec-41ad-bce1-03c800944373", "comment": "Malware payload (Efimer)", "value": "539667b9fa352c19b42ba105e94527f657e3e9da5fc05e858096f9ebad53eb2145dc924a0d2bb62551dca639193c7889", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784436728, "uuid": "031eb5d1-89b2-4479-9971-42a815b41e2c", "value": "T1C2E6334CA9E102EEE5B3113CEDEB99A4C16474791732C69F4BAC97653D070E2493EA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784436728, "uuid": "126201d4-f6b3-45e0-b6f6-e52f42cc70a8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784436728, "uuid": "f4537716-43db-401d-a9e9-960eeda965b8", "value": "393216:IkWg2cqbqAlLP2vsT9PCeFQFXMCHWUjXFcuI3/PGTAI:I+qbNQqCeFQFXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784436728, "uuid": "862ebde6-3448-46c2-bf23-0987ad2036d9", "value": 14315385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784436728, "uuid": "a551f47e-68e5-43d0-8e8c-3aa18897d0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784436728, "uuid": "e796f784-3dff-4bd3-9396-3a637c72dc37", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a894388e-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485717, "uuid": "548f3de2-0a7e-4f96-807d-e893ea537c4a", "comment": "Malware payload (Mirai)", "value": "3168dfc14eba56ee134f29d9027670b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485717, "uuid": "7eeedefa-7237-4e03-a56e-d5c8c81c9435", "comment": "Malware payload (Mirai)", "value": "ce23602650065b7bfce14bc67b210e6ea1fc8559ecc16b2104f83a74ef8ebe77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485717, "uuid": "5ee440f1-1de9-438d-aaac-619ce239b9f4", "comment": "Malware payload (Mirai)", "value": "63bc29e65124c654f37b58cd1b75db80ee59390a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485717, "uuid": "b48701e5-afc7-45c4-8a85-8225af25364d", "comment": "Malware payload (Mirai)", "value": "ccb4aea414e72d9d9ab579cecdb0bee80640b96bed1f6c8a93bc1db7e899c3ffd0cbf113de334d0287be09df68dcac56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485717, "uuid": "02649a77-017b-476c-904e-cb8f9db3f0d8", "value": "T1ADD3195AFC81AF11D5C626BAFE5E518933131BACE3EE7212DD244B2423CA91B0F7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485717, "uuid": "90cc2ee7-7999-4011-8baf-8b187514b992", "value": "3072:CloqRu9qX3G4JyqKELNynYzuHaMTxUUGWyfbgp6KVgW6D:ClZRuIX3G4JyQLN1aHaMTxUUGWobRKi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485717, "uuid": "9748d3f2-99e4-41f8-b1bd-61a1c69c58cc", "value": 136712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485717, "uuid": "a015e7ad-fb09-4c81-add7-b6ac859b892b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485717, "uuid": "fa14322c-ddc9-4d0e-97e6-d37353ad1f2f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1dd9fd-83cc-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784505128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505128, "uuid": "d0425e56-cf4e-4585-93e9-b78ed56d99f9", "comment": "Malware payload", "value": "0e99d191d1a82f4cbdd81859baf7405c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505128, "uuid": "44a79bcd-f798-43fa-8bb7-19f8b2d496a4", "comment": "Malware payload", "value": "cee1fd2f7f8b07acf1e012412219e2c1624b600a5716d885dba24c10453d26c7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505128, "uuid": "763a1687-ff59-4551-b40d-6cae214a095c", "comment": "Malware payload", "value": "4e49f3aee8a959a81511750151b82fb404869573", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505128, "uuid": "cf97b57b-9ec9-4303-b3d8-f620a5a88f27", "comment": "Malware payload", "value": "14af5baa59bccdf36b0d237b21755a84561dc0cd14d01ae478d04f4e4e4c9e2a4690c5622706db78834aa2bed6c421f5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505128, "uuid": "6112211d-1e32-4cf1-b4d2-ee12dc4f2aef", "value": "T1F3E63324B6E012FFF6B2413CE8D190DAE2E5F46607B1C4DF468493E22E5B2D0897D667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505128, "uuid": "a4102983-6056-4755-b357-f9508974291e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505128, "uuid": "a26366f3-4f60-4a91-8857-5e761462b453", "value": "393216:bUeMzL2Cz3cR6QnyrNXMCHWUjXzcuI3/PGTAI:bUeaqCg9kNXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505128, "uuid": "ebc9326f-217d-414b-b943-272e828a1964", "value": 14291123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505128, "uuid": "4598b17e-96f2-4f3a-b5cf-016f4e119a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505128, "uuid": "67638e9b-e6d1-4234-b963-28b95af84f4e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca88387-83b7-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784496032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496032, "uuid": "ebed2a66-dc04-4a18-8610-a5e4ad67cb36", "comment": "Malware payload", "value": "3cb5c3984af590d075b203fdd09896ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496032, "uuid": "42aee744-f68a-4296-a69d-152ce4cef097", "comment": "Malware payload", "value": "ceede5f1885ead41512a034bfb0a637814784b00c45a7e855aa8cc216b850658", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496032, "uuid": "cf4cca80-c64a-4bea-97e2-c706fc8fedb9", "comment": "Malware payload", "value": "6a2065b245144dc71bc2b061774e30ecd1b3ed53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784496032, "uuid": "4795572b-d0cb-47c4-a68f-273a9332163f", "comment": "Malware payload", "value": "02697f3a9bff482404b431baab07f6a08f10472483407c513c33fadb0e1c48e81e24a4e0c232690b6d0f2a3fcdce7a29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496032, "uuid": "abbedff9-ed6e-47b0-811e-8c9f3ae9e8d3", "value": "T11FE3085AEC819B11D5C526BAFE5E7289331337ACE3EE7212DD244F2523CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496032, "uuid": "de490a67-b197-4bdb-8a39-1102373059fc", "value": "3072:MgKzrBmnSnuI/Nd/ahYrCXVGZy1OPVbISOaJ7DfP6G5SlQgTRdXLuDV:9qrBmnSnX/Nd/ahYAViy12NOaJ7DfP6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784496032, "uuid": "548ddc13-6882-4569-95b1-5820f42f376c", "value": 153108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784496032, "uuid": "f818950c-332a-42ad-8a05-e36994637c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784496032, "uuid": "11910f5f-a080-43ef-94ca-1d9cdbd6af24", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0767094b-835b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784456241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456241, "uuid": "10b9d97e-1e8f-4dad-8119-c219aa431e55", "comment": "Malware payload (Mirai)", "value": "44042ff732909fb5203385528b3e1348", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456241, "uuid": "0f231da6-516e-4bf3-bebf-58dc4c8bc683", "comment": "Malware payload (Mirai)", "value": "cf5919a13185ac0bbf3c5890fad0ca5c0e79841bda8c5de99b867f749237ee13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456241, "uuid": "90c62fd4-f1f7-493d-a29f-2bfb7dbcdebf", "comment": "Malware payload (Mirai)", "value": "a7591138236ee82018b0eabde347b3a1375d0953", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456241, "uuid": "ed641b82-e79d-4af1-a20d-6b6950df270c", "comment": "Malware payload (Mirai)", "value": "fb55e6e679e66c9fd93b623f736c26a0c38cddbde8165b50e1f676f03cf9835e38569b1ab62b227bd01d405da8ae3aa6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456241, "uuid": "c242dae4-c2d7-4c40-82ba-576fe2a10d88", "value": "T1E351D6D610824B35AE5A9D72BBBB890E34C1C09A75DBEFD79BD8B8B4848CD147C60743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456241, "uuid": "4dab657f-bec6-4919-b151-73d0c714fdc2", "value": "48:isQbsFCEsGP3sRRsHVsPdscTTcTGFlsILsnxLsWZJsRJrs3ds+jTscpVsriF:ib6dKsop8az/OLnaOhhfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456241, "uuid": "62fc5aa3-d643-4c9c-8ca6-0c38162f6c54", "value": 2789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456241, "uuid": "738c8210-3acf-4f18-afd4-854a44fccad4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456241, "uuid": "d99bc763-5889-43ad-8c05-cd5c3bb8b39f", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f44d0fb-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784477863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477863, "uuid": "fe6aa506-c5d3-4de9-b5e2-66404019e26e", "comment": "Malware payload (Mirai)", "value": "c4c21f98d2d72e2aeca423e34338af84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477863, "uuid": "3c138d2d-7673-43bc-ba42-d5f929d29a8a", "comment": "Malware payload (Mirai)", "value": "d2d02d252960ead8b454689044bc83d592b181f294025e4601a5b8d754537d21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477863, "uuid": "f620730c-eedc-46c7-b23c-32caa94993ee", "comment": "Malware payload (Mirai)", "value": "58fc018d0fd569b0db642e7e44f800da2333b136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477863, "uuid": "20a62242-afc2-42f6-88ce-800a61f3fb0f", "comment": "Malware payload (Mirai)", "value": "24fc0f372e22649fa77bf01afe6b8c9416cc3c6853e2c2874a779f5b873f952ec662c3f1a1bba25f25d824dc519c0c4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477863, "uuid": "dfade3f0-d875-4856-9318-3914e5ef86e7", "value": "T12CB3D846FD018F13C5C721F7FBDE42987A166F6DD6FA3102A9257FA0374A4D60A3A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477863, "uuid": "ee62a8b4-11df-4b1f-b8f2-053c5ea9d3a3", "value": "1536:xp126gPU8315v4Vi6G7gxlc728Cy5RNormlqwMNwywbdCgU/tBrQOscUZgca:d23PU045GMxJqR6t7Wazca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477863, "uuid": "e83a9837-a40e-49af-80e5-214a694b8023", "value": 111676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477863, "uuid": "8d08d1ca-fdc1-4ce5-9598-94ec3d841361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477863, "uuid": "3f4c285e-8cf8-46bd-99a1-8b4f74d3e16b", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1720f8-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784485585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485585, "uuid": "d7217813-58de-42b1-a6b6-2c030b562055", "comment": "Malware payload", "value": "2f319b844b1e27e6e4a480c199d28c34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485585, "uuid": "afc7728f-c86e-41eb-809a-c30cf770a269", "comment": "Malware payload", "value": "d4b39abf3720cb99025812499c85e43a04eea8f8b82bfbbacba7ca3ed63e0831", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485585, "uuid": "db8b7ad4-c940-43bb-b72a-415242da3632", "comment": "Malware payload", "value": "7b677c3aa9a0f8b8d55a731b3084a76ac6128614", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485585, "uuid": "bbb48c3b-7749-480d-8825-2d505a79514f", "comment": "Malware payload", "value": "31cb989294ad30a97e2a5f595ffb77dc47245c1016adac1502b159d786a0ef4257c126aa3dcf2598cc7295e325e2a700", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485585, "uuid": "a7d3469a-8f08-4240-840e-9ba5e8cb5f22", "value": "T19E237D652A817C14AA98D4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485585, "uuid": "4c931939-7a5a-4572-8065-d691e9fd44cf", "value": "768:wXOGVvJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:WLacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485585, "uuid": "fb1ec018-7b0e-4a5d-9a72-9365fd5519e9", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485585, "uuid": "b031886d-05b4-4f5e-80b5-33227f1e2175", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485585, "uuid": "9ffede73-956f-475e-866d-0993a09e17ed", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28174bbd-835c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1784456725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456725, "uuid": "f331301f-efba-4552-acfc-f5dce7302ccd", "comment": "Malware payload (Vidar)", "value": "234bb25b1878650381668ca32a7254db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456725, "uuid": "c6daccb6-6d98-4892-ac20-e7feb0bdde5a", "comment": "Malware payload (Vidar)", "value": "d4e81a7304049c20e0b606220ff924dc48c70d46a8ab466c97d7c6a896e886f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456725, "uuid": "444b1bac-85fe-48c2-9cc2-6dcffb23d270", "comment": "Malware payload (Vidar)", "value": "5aa7cd09afef09c7b3b3bd7c401f776ecab0b18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456725, "uuid": "1a472423-3ffe-47e9-8df7-23fca82ccdd9", "comment": "Malware payload (Vidar)", "value": "07f26c3a73e00195b60fb8b04310ac997ed411c8e94ef048b98aaed66225c1758790c3844f057a5eaa3945f7e655bc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456725, "uuid": "4ffbe274-4778-48b4-bb20-191e504f437b", "value": "T1C5C633E116E94973E6793FB444F10561EF7B7C9016324ECF26B866881932BC1A63436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456725, "uuid": "18b0f1d5-3cd4-494f-a961-8075d6d24953", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456725, "uuid": "0bbbf0c2-6f43-40cf-bce4-f0703550d773", "value": "49152:KNT7agYvl+bxc+4X6N/wFKZgyRBwD2nIUTKsp:KNT71YMdc+4KFwYZ5IUeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456725, "uuid": "c4263c06-7c27-4d05-bf3c-6caa59ef5151", "value": 11534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456725, "uuid": "013c0f19-6408-4bb9-b0f4-ff0b05bc86e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456725, "uuid": "c1d4493d-7ee5-4d76-a69d-ab12562f5086", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6261995-8347-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784447944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447944, "uuid": "c1828067-babc-4585-9b96-fd05c7409568", "comment": "Malware payload", "value": "a52cc4e211449a81347b0674dec015ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447944, "uuid": "302d8be3-d5d2-41cd-a8cb-0d6df458c2f1", "comment": "Malware payload", "value": "d63904f1b2bca8c098ca57c34f060a860ad7a08352da3b93bd421c971a2c6ca9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447944, "uuid": "a9c50aeb-28d7-47be-b198-129fed83166a", "comment": "Malware payload", "value": "7d003c5cd061868bfaaa36d8b5397245cfd8753d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447944, "uuid": "395fa720-0d18-453f-95fe-0a2b180699d5", "comment": "Malware payload", "value": "761f5fa02936d348a238355dfcca13f8e92800306be84ccf04551021d410606242897c7c90eb738bd12c2680f6783158", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447944, "uuid": "0e76929b-4e8d-4b98-9b47-ff4b61e52599", "value": "T1BD236C6516857C24AE98C4361C7E2F0CB9AD83E6324452EE7FCF3CF68C4A6AD910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447944, "uuid": "1d35d431-143e-4385-9e72-439bba74aaed", "value": "768:p+e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:p+Lcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784447944, "uuid": "50d1936e-2e84-4da1-8df1-a5ac06b2d361", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784447944, "uuid": "efed478f-aad5-433a-b48b-5abd0292e0d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447944, "uuid": "a058e7a2-fb0f-487e-9f83-3955a74e98e4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605750b1-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477865, "uuid": "47e6ce1e-88dc-45ee-a2f7-12851b02d5c3", "comment": "Malware payload", "value": "2837c82b519222fb904d65ff3609907e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477865, "uuid": "3344d1d5-307c-42cb-94ee-cc66ae9abcbb", "comment": "Malware payload", "value": "d682bb46aa752710e3fff11f5f6cd1d14bda45f53ce5d4281e99f7614108aa95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477865, "uuid": "bced2d67-f903-4cde-9c83-d8c0eef5bc6f", "comment": "Malware payload", "value": "26390f072c356fa82d89803d940d7f424040d145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477865, "uuid": "d4fcca56-dc8e-40d0-92c3-ed6dc17f53ba", "comment": "Malware payload", "value": "3013bf3d79b2c280c3e45f0e3ac7adb3adcdd183bbee0cfd801d1d0d3cf98338db1ff1c95a40822ccd1094da8ccf0ca4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477865, "uuid": "46f2c140-e594-42ee-86db-914a2afb7c3b", "value": "T10DB3E5027B0D4F07E1432DF43B7B0BE0879BBD5628A9E580711AFEC993B19B19506E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477865, "uuid": "ae9e0736-9945-4051-bc16-74b9ab5502a2", "value": "1536:8AkE+KVOPRQvcxaSbAhvvV1yxB88w/rKjvABfm3depqRfeoqA6QrC9:QE+n6Ux2hfyxe/rrBdm5+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477865, "uuid": "bb449051-463d-407d-84ab-cbd44a0bfcda", "value": 117144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477865, "uuid": "880d3adb-c5d1-464d-8a21-9db7230de5ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477865, "uuid": "b8449e75-1f1f-44be-bb55-e7a09ce6fa95", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e8b026-839b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784483971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483971, "uuid": "4ccf4ead-9273-4687-8458-ed4fdf00070e", "comment": "Malware payload (Mirai)", "value": "5fd7fa69795676693aeb97b616aa62bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483971, "uuid": "0e44ed5c-47ca-4617-99c2-4857ec126500", "comment": "Malware payload (Mirai)", "value": "d6cdc63a2558d7548f2b5b433fefaf01c29fb29dcb1cd6e78fa217ea39ee4819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483971, "uuid": "1abc7018-045b-4a26-b3fa-a2326926c0c0", "comment": "Malware payload (Mirai)", "value": "db088f45b287de3a02533736b2984f3e0417c0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483971, "uuid": "0733d025-7bb4-4736-82c0-5ec31d6bf10a", "comment": "Malware payload (Mirai)", "value": "c11e88a16d558fcd993bd01f3815834afe0604e3b12afee218d41e7f823c606c53ae9c09109d37bb3983cdca72cc1201", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483971, "uuid": "b609efb7-2cf8-4cc8-a0e9-1c1ef26511ed", "value": "T107D32959BC829A12C6C2567BFF5F82CD372723A8E3EB3117DD145F25368B91A0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483971, "uuid": "7879940e-1a45-4675-8a34-4bec82edc11b", "value": "3072:J7mn9QNp7VZg/+OAeESr89tjDTKrERFG5nbK:J7mn9Op7VGWNCwfTKrEw9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483971, "uuid": "13ced033-e481-4d18-8d46-1bd6e1fa8ca1", "value": 136524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483971, "uuid": "1a52bd86-613b-41b5-b154-a9c2f50a8773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483971, "uuid": "46d10281-99d8-49ed-9472-49637eb98636", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94a3a98-836b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784463519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463519, "uuid": "89ba9933-f722-400c-8619-f13cc4cb536a", "comment": "Malware payload (Mirai)", "value": "b671511eed5c2b97e83b64e8ac1a7e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463519, "uuid": "b4ea1e05-fd36-4720-993a-63c678e1ddde", "comment": "Malware payload (Mirai)", "value": "d74eee5b755266dbf51bb2a63a8489a12e255b0c06c528be7defb71e61336abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463519, "uuid": "d68f3da4-e6e1-4700-8392-1d5f05b47d66", "comment": "Malware payload (Mirai)", "value": "68a1d3eb0e7fc0bddd9f0f354cf1bf351566a03d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463519, "uuid": "be9da768-86a4-4940-9370-8b15aac51c0c", "comment": "Malware payload (Mirai)", "value": "523c4268921b7cbd31003e8525747a67e726b2ccb7ed21a2fa9da3884713f4c118d3ad4103cfb9202c0df4384c9e1ab5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463519, "uuid": "1292a0fd-150d-498a-b38e-a4ecb9861d01", "value": "T1AAC329A9F890DE52C6D1267AF75E118C33231778C3DE7105CE249E3477EBA5A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463519, "uuid": "4f310dd5-501c-437b-bcfc-db6eb943cea3", "value": "3072:0E7vXJD0eFnpVrxa34oBYk35cYEEUa47psEx2bF+mFN07oU5p7+tf1Dl:0ErNHhC5cYEEUa47pD2RjFNo36t95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784463519, "uuid": "ec9c8812-8729-4e67-b40d-74e9712244ca", "value": 128456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784463519, "uuid": "93604180-3392-4af0-b2ad-85b73e680670", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463519, "uuid": "7592db8f-5641-4218-bc0f-3dcb8dc0d11b", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6f0d1e-8399-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784483039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483039, "uuid": "ddee8808-4836-4693-9527-aeb37dfe0497", "comment": "Malware payload (Mirai)", "value": "7fa870421b09306fa980351667e0b7c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483039, "uuid": "22dff5d4-2794-46c4-b2c1-79b0c50ea2b4", "comment": "Malware payload (Mirai)", "value": "d876fe5b950059f3dc4e8dca7e57017e0c29941235ed9fe3d848e425085fdab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483039, "uuid": "4c3b4a71-7622-479f-85dd-e84cd580ee10", "comment": "Malware payload (Mirai)", "value": "f4cfcbe9c7e8b40ff204cbb72e327f553f1f40da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784483039, "uuid": "8fe36aa0-43fb-4426-8207-e57c47a761d4", "comment": "Malware payload (Mirai)", "value": "0d4ec75ca0575fd0380a44a43f36299b2d06202fdf854062203ed1fdc1e54fdc5ed04287d47cf8aa752ebfc06da3ec31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483039, "uuid": "a4ae9124-b99a-4fef-9040-d33f5a7915f6", "value": "T141539E76C9297E94D15482B0F8718F751B63B48482871FFA5A9AC2BE9043DECF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483039, "uuid": "c2f377e2-8b26-4468-a8b5-d0ad37b96717", "value": "1536:qab1TwtqS8omFAF5KXaZs4fnc4YmYKOv3yNWzw3CUTldxB6s/K8:qCC8omFAzKXaZs4fc4YmfOWWzw3ff7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784483039, "uuid": "ab5de259-366a-4615-833b-7fce29c0e6a5", "value": 64616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784483039, "uuid": "7440f7f6-fc2f-4d3b-85cc-f2701ffba0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784483039, "uuid": "1b00c2fe-11b2-48d0-9481-bb15674f3e5f", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ead23f-8365-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1784460805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460805, "uuid": "30edb8c3-8a5b-44be-b225-b0d293571239", "comment": "Malware payload (SilentNet)", "value": "530f3de7880576ad89bb68ffc9b8bb82", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460805, "uuid": "1ad0ad40-4259-48e5-bbfc-39a05a2029fa", "comment": "Malware payload (SilentNet)", "value": "d8a6a1ea2da878d7b85b5fdcf501092ddccfecc90d8ef3a42d4392b621e791d7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460805, "uuid": "895072af-c644-4e91-96f1-49b906a09afc", "comment": "Malware payload (SilentNet)", "value": "c6b7f3ef3efe1ef90773b98d2a3f87747a058780", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784460805, "uuid": "466c2b6f-9f6d-460f-b289-0742b445e69a", "comment": "Malware payload (SilentNet)", "value": "7d48f76ed258b9aa11c87f8a079999c7c76729149c2d7d9fcaf78346cc436e9b61856218c857e73a173788042a35bb62", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460805, "uuid": "78e07aa8-eef8-4ae0-ae8e-6a18fce4b57e", "value": "T1645423273682CC1DFE05B1BE5104052BDB05AB74B8A6DBC030D36725E22EE494F796DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460805, "uuid": "a08cdcdc-84cb-4f4d-94e4-f54c7ac1b556", "value": "6144:Xd1lllByjwAA3TC6VgpX7N36a1FddFsQz2U15Zvek+4Y7nfgPcWK:Xlll3AqTC6V2X7oZQFYCYTfgkWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784460805, "uuid": "c81c4d78-2d2f-4848-993f-6f508c5d12cb", "value": 287358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784460805, "uuid": "0a11a2d1-4f7c-4d91-bcc0-d1b3517f81bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784460805, "uuid": "0f37a1d6-3a2a-493a-bec0-1fb7d0c071f5", "value": "cheatdevtest1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dab894-834f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784451135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451135, "uuid": "3ebe8d1d-9522-4eee-99b5-2b51b62f1cb1", "comment": "Malware payload (Efimer)", "value": "d23e775f78231758b89151fd316110e2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451135, "uuid": "ab3a074e-e521-4ae6-892d-b3368e8ffbfc", "comment": "Malware payload (Efimer)", "value": "dabcffbdbfc660d8aa018fe76f73f30e244b10b7043b84f80faf52871e65884e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451135, "uuid": "63926384-7d9e-483c-80df-442d9766e700", "comment": "Malware payload (Efimer)", "value": "632b9728aba68b5371830fd3e46b80f4ab5fa770", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784451135, "uuid": "dcf7412a-e4c3-42d9-a956-c55249852dab", "comment": "Malware payload (Efimer)", "value": "6aef9e0876fff8dfe038326a04096e97bad0e022837cc6830b00196ca26a0c5807d506a67df9e7936904fd5f879ff0bd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451135, "uuid": "140486c0-78c7-4043-be9f-8eb45a69580a", "value": "T1CDE6331866E441FFD2A3403DF9D28A99D969B4720372DADF137486B17D272E08D3CA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451135, "uuid": "94b57686-a661-4fe0-9ebd-c3f94920b332", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451135, "uuid": "44e70578-0878-4d33-8d57-a5dbf7981c5b", "value": "393216:K8qdlHDSnMlL1QdXLXMCHWUjX7BcuI3/PGTAI:K8e5DSS6bXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784451135, "uuid": "3f4e1bb9-6209-48a8-842d-705582ca6bf2", "value": 14289772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784451135, "uuid": "aa8449fb-4853-413a-8a43-ff7b3c8a719f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784451135, "uuid": "f16ebb7e-f34f-46b2-8d57-73e72ab67be0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b530508-8361-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784458825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458825, "uuid": "35985da5-021e-4679-a05b-ce7a224a7135", "comment": "Malware payload", "value": "dfece4a69d1986c9427b9b3dc8e62c38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458825, "uuid": "36bafc3f-4a91-468e-93da-fe25ba9ae3c8", "comment": "Malware payload", "value": "dae0dae07dfdb2e7158329ce69c9f3879d25756ee637294559fa7d2607bdd6b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458825, "uuid": "3ac8a056-9bbb-4bc9-8bbc-0c604ac72c38", "comment": "Malware payload", "value": "44f3090b50268f58561e12cfdbe8ae93f50c94f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784458825, "uuid": "2c50c64f-3c74-475e-8e4d-292c83cba0c6", "comment": "Malware payload", "value": "82ee654558af7df5623271a89c8073756df83c45b2a3ca74a51d4e18c72173dffe4ec80d5b82c0b387369d83cad4e792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458825, "uuid": "9ab744e3-70c7-42b5-baea-5c2443f2b895", "value": "T1A537CF77814338E9E5A98DB4D41025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458825, "uuid": "6d9f6f7d-619f-41da-b54e-1c0b508a8064", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784458825, "uuid": "51127be7-96dd-4b4c-be18-6075021135d4", "value": 22544384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784458825, "uuid": "37fb6970-5657-4a62-aa82-f937e8ea2e7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784458825, "uuid": "c5745c55-5200-4a68-9750-0ca7ae470236", "value": "dae0dae07dfdb2e7158329ce69c9f3879d25756ee637294559fa7d2607bdd6b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad9b07c-8367-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784461642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461642, "uuid": "c31eba5c-f7c4-425f-ba13-e7767660b0b0", "comment": "Malware payload", "value": "fce1b61c249b56a953c50a942eebfa91", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461642, "uuid": "8076dc35-09e0-4536-a5de-fbd9e2956895", "comment": "Malware payload", "value": "db8ce34cefcc83edd0e245844f35373828004706eb41f952ad0c2522e10e4b9c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461642, "uuid": "42142237-b0e8-477b-9f94-e28f52768428", "comment": "Malware payload", "value": "2c56e2233311618ba43bff656d306138cee6c09b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784461642, "uuid": "68bf75ee-8778-4039-8410-72190a5b9770", "comment": "Malware payload", "value": "d32edb1d67f997002c599607745efe05f4d82c4622a55ad9036af59741c9b648be392d91606af774a7c5c087614db557", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461642, "uuid": "239e7675-c502-4391-8f3c-abd4fc16e508", "value": "T1DE6523856BD000AAD87BA3B89AF322536775BCC517F5D3CF624082A92E339C4717B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461642, "uuid": "8ec7ad39-e95a-4201-9802-826922bf848e", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461642, "uuid": "98f9b2d7-ed45-4696-8313-ddf8705e6d7a", "value": "24576:lrsRcbYKNp03n4gZWmA7OABU5CpU8xPhuyHyCH+8xc9jeYu+gXTk0kye:lrsabNNp03FWmA7O95iUUPwULH+8Ff+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784461642, "uuid": "ac54ee29-0563-4b14-b134-b3a7d5b12433", "value": 1533008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784461642, "uuid": "cdd8d967-af88-468c-ad8b-8f846286ecfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784461642, "uuid": "d1dbec07-9515-4cc6-9526-a62090dcafe1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae94856-8389-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784476057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476057, "uuid": "778163bb-9170-40e3-b5cb-3fb8babf645b", "comment": "Malware payload (Mirai)", "value": "2dd62af99cf90a2d002fc669c1eee69c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476057, "uuid": "3dea496a-5fe2-4659-be5d-7a8d30791b02", "comment": "Malware payload (Mirai)", "value": "dbbb7a38dddc74ce056363fb500a65a3d9f0ed1b93b6344915c1698090f5304e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476057, "uuid": "a3ce43b6-75ca-4a66-ba6f-706d6b9e2e22", "comment": "Malware payload (Mirai)", "value": "bf69a6cd5c09d7644f6ea4eb07cc32a7559d9eec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476057, "uuid": "4166fce1-edfd-4fe5-a6fb-e2ae9933dfb7", "comment": "Malware payload (Mirai)", "value": "023104e15ddc59cf913c3cda7f0cc7f879a87f22a5130fd72f9e4687215562a1253908b42936e4630bd538b44bc55b49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476057, "uuid": "312ec751-3cf6-462b-bb78-303a92e9864f", "value": "T1D5D34B48FA57C0F0E6C341F5067BABA9963AD9113233F5E1FF5A3A62F8B1302588525C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476057, "uuid": "c0321e43-4f65-405e-b406-e88c16dda234", "value": "3072:Y+onMyVO3R69MfH7Lo/afaLUGMxWIXjdf9v:8ntVOc9qLnQUdxdhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784476057, "uuid": "73ba1467-e016-4da1-9c47-c1085d7f9ade", "value": 136572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784476057, "uuid": "e7d80b9e-791a-4817-85bb-076cb2fe4d0d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476057, "uuid": "109e9e36-005b-484b-8bde-134d782e397e", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f60be6-8372-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784466523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466523, "uuid": "9f478183-4d35-49dd-84fc-250f842f70eb", "comment": "Malware payload (Mirai)", "value": "c158dccabfd656b404043eca2b2f7e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466523, "uuid": "1badcd30-92a2-441d-9d1f-241861ba5673", "comment": "Malware payload (Mirai)", "value": "dc5bf086551430f2bf8a5742be05c0789c4f32f275a14ebb30caebfd25813c32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466523, "uuid": "194e4dbf-e941-4911-8136-628f1eecfef8", "comment": "Malware payload (Mirai)", "value": "b931e1ee8037637ad5116d58aeb63bf8319a22f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784466523, "uuid": "136316ac-9744-42b5-8ea0-b561580f998c", "comment": "Malware payload (Mirai)", "value": "f7284e3b143439e41f9646baa9a0412f62775083fc86683f89cd204e7b1d2d7b9a7e94d952b59a17b1536a27c9e64d13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466523, "uuid": "01ccdf28-efeb-42eb-95f0-385b1d9e457e", "value": "T15E8312D5CF6F97F9EB1359F118D72AE1042EC0062239DB7813B52B95AA3FC20E92191D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466523, "uuid": "2e69d12c-b751-44e8-9b4d-8a5d28b26021", "value": "1536:mpA0Sp0rauFzIEPn1DbvNJno+4+O8ZbebqUpjB9Pj/IR0f6xi0Z6:sO0225u+4+1lUtBhjgR0Ci0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784466523, "uuid": "8834c679-c871-4492-b8ba-6865b717f4a3", "value": 81728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784466523, "uuid": "c403553b-5378-40b2-8795-bbe91d80adba", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784466523, "uuid": "aa9f8f7a-5739-4272-b483-9a6fd42e799e", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670907a8-836b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784463273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463273, "uuid": "10adaa0b-3db8-4c0f-8538-9b46d010f5f9", "comment": "Malware payload", "value": "dbf8cdc115ba0664f307925397a679b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463273, "uuid": "8185d46a-274c-483a-a734-6c7e6f4874ee", "comment": "Malware payload", "value": "dd2fce7dad57958a7dec2c781a26c8fe8f7597696ba80dae921cd7744886972f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463273, "uuid": "ba567ed2-c9cc-48c8-a264-5dbeab8c11e8", "comment": "Malware payload", "value": "4d2bc599d9dafdba783cdb0abe5ae3a65efec04c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784463273, "uuid": "7d938c89-a9ae-473e-a3f9-ad729da8e9b6", "comment": "Malware payload", "value": "294649374fc355b549324a60d6c2a607c7f3131bb232b706d3ac8251f9c47622c5fbb4eb8c57dab5d225ab5e705c50bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463273, "uuid": "05f86b1f-db50-43d1-b52b-c2dc8eadced9", "value": "T18D01C2C993509910802A986D26D695E4F431C3C6064E0B7CBF9C843DBB8CE14F176F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463273, "uuid": "6595bb26-9083-46fb-aa7f-b83221e2a7b7", "value": "24:kXCKysE2hi0ziQvZohazf28qSXZTaenwEPu7:e9Qp+Mszu8qSk2Xm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784463273, "uuid": "7ed6b7bf-0f32-4407-87ed-47ae37ec2259", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784463273, "uuid": "c3fe778f-7ef2-4ca9-8f23-a88b9993e602", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784463273, "uuid": "75a53e9a-1e97-41ed-b1dc-996e110ada58", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382485db-83cd-11f1-be1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1784505285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505285, "uuid": "2ed566c3-5745-40f7-8fce-cbca7044582b", "comment": "Malware payload", "value": "e96d8fa5fdb08ecb52919d14a9a313fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505285, "uuid": "c8f272bf-b1fe-461c-a92a-63985f678659", "comment": "Malware payload", "value": "dd67a211107f82378b1a0fe465f66f06a5b3e035ae8ff64fd8d9607d343f3fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505285, "uuid": "b53fb4e1-a9dd-498f-b630-c61e180b6800", "comment": "Malware payload", "value": "2dc96bd9e8dde4b48dc6486ac420f590f5a33cb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784505285, "uuid": "bc0ee4bd-3a1d-45af-bf53-5428b7c4b1bf", "comment": "Malware payload", "value": "e38c381f8ef6666455492cc24f35ebce78f50e3a68f5de60df24303e083acd815bab6ff37fe111fbf334a09f216f0025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505285, "uuid": "e21795b6-53a1-4eea-9f8b-ee3556f0a5e0", "value": "T1F5C312DF11827143F9BE043FFEDC538A96F62A42FA39CCD77417940447DB0A1A8A6A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505285, "uuid": "8e7cbf71-7fc7-4067-9278-e7047dd077ed", "value": "3072:Xa1cuYnXFtdCO7Gzo7VYWG22AmMP3gBPoYRLVK:Xx/XFtdCO7GzCiWGRAlP3YrRZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784505285, "uuid": "116f9d4a-e82d-4ee1-80c8-e4ae61489def", "value": 127664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784505285, "uuid": "1082216c-94f3-44cd-8e34-107c1df2b4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784505285, "uuid": "d40f3beb-d3d2-4663-9ff4-59ff5041531e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be88ca3d-835b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784456548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456548, "uuid": "c6539d1b-6e94-4da0-86fd-0b0cbd49b199", "comment": "Malware payload", "value": "60ae60431418175412410d59dc8e88b6", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456548, "uuid": "0e478d78-0bbf-4c1b-8ddb-54c014eb52a0", "comment": "Malware payload", "value": "deb75847d9174df0c2c248dccedcd0a1238e2b06a2bdf2ffc898428a94932540", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456548, "uuid": "dbbf0ecb-2c8e-459a-a651-640a47f4f119", "comment": "Malware payload", "value": "1be3bd8d3770bcf23620839d14165c108d87eb0c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456548, "uuid": "e5a87a16-3646-4f6e-9cd1-d9a3362113a6", "comment": "Malware payload", "value": "0d122ca74db95daf79080d269abb5634007f0002345387d7e77a269793ffaa1317e90beb699e7cf6b3e317a2d2fc2a52", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456548, "uuid": "e34e7387-aa62-49c2-9024-03a6bedb272b", "value": "T1EF08332C8AF5A29FEA7F9CF81670D933F53910655E2434DB9BE834617233009067DA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456548, "uuid": "340698f1-52cc-40a5-8283-2d087e1488b7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456548, "uuid": "5f18e414-31b2-48ab-9d48-cf178457d1de", "value": "1572864:6t9IKPwDSY7yuCpY+eTqowzKYypCPRfYLgRLlPBnU6InslAFvAJ7:6UKIDSv5pYEoyKYyuB/5PU6Ins2vAJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456548, "uuid": "f41583f3-0b6e-410f-921f-ad340d59b0e4", "value": 77559535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456548, "uuid": "23004fb9-af11-4531-ab26-04c6c47c6375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456548, "uuid": "5c2af92f-6577-4ce4-bf55-b5924383501a", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992203a7-8363-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784459921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459921, "uuid": "85e219a5-bb54-42c8-93bd-a7d8d17bd92e", "comment": "Malware payload", "value": "ddd2dcd1bd337c0962ea19aa2505d579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459921, "uuid": "7b1f0e9e-3761-4257-b036-6d76a90f28a3", "comment": "Malware payload", "value": "df4e46d56a10bb6b4dfc686ee6d017143dfdc96ba2d509b1b610f5aceae16a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459921, "uuid": "11352676-c13f-43a5-8e3b-70d0b9339ffb", "comment": "Malware payload", "value": "1482f7fdca3c6e8c654aa4e76d9e67b9225425a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784459921, "uuid": "2bb6136b-5f2c-43ba-bb96-eb295c722f33", "comment": "Malware payload", "value": "82a0f872299f5d603f7b917e8f7fb04de1395f7f7de47697c75fa7f73e432169342e881610d0e3553a4b4e1206d7d038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459921, "uuid": "074e21a8-16a7-47f2-89b6-a03ad10d6222", "value": "T1BB66D63B766D66A8C29D937AC0B2AA30D8F371744FB3D2E311BD07AC5A415D44E3A1B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459921, "uuid": "98dfa8de-2f31-4d1c-af1f-be5333d8f529", "value": "84702c834326954655d1118866ba2cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459921, "uuid": "e5efe81d-539c-4f72-8456-5e575b86aa3f", "value": "49152:gHKQyy9sC131rhTEzs/0vMSkYxkLbXTIrdHyY:gHhjTIrdHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784459921, "uuid": "1917bde4-a38c-4875-ae37-8056719bcb2c", "value": 6958744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784459921, "uuid": "5465bb80-381b-44ef-9c18-ecc6541b6741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784459921, "uuid": "b21e927e-c508-45d1-b16e-458670610c59", "value": "Bonavol_f2q6s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa6ab2c-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490204, "uuid": "d3458682-d04b-4476-8d0f-a447cfa3b54a", "comment": "Malware payload (Mirai)", "value": "8f5809e0d8325df4e6fdb00af00b22c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490204, "uuid": "ce227f69-da78-436c-ba6b-679be1793d0b", "comment": "Malware payload (Mirai)", "value": "df99dc82a2f2d934b4b0fff91d202141787cf97c9e514f07fa671066c74c91fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490204, "uuid": "deab85de-6a7d-43b4-8746-e407090abf3b", "comment": "Malware payload (Mirai)", "value": "ca5391388cac5f08411457f507fc38077eeb046e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490204, "uuid": "9df8a28c-2144-4bd9-a6a0-d7843b9dc453", "comment": "Malware payload (Mirai)", "value": "7c6b5e2d319136e173b42caf4bc6afe3abb6a602a1196129721c0fd145aff03d0eae5133004d2c9116d64c2dcd28dc2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490204, "uuid": "0731126a-17df-442b-8fb2-411e5acd4c30", "value": "T143936DC6A587D8F1E82205712137BB374977F53E2139DB83CBA9A936AC116C0D22779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490204, "uuid": "b9f85777-ae1d-41ff-a470-435672dff52f", "value": "1536:wnPzshYAr2y8f+c8nQxInqy7cT8kgomBI+ArmTbqHd:uPzx1vgQxaqE+jnuIm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490204, "uuid": "776b5ab6-bdce-4f0b-b5dd-5b74d8340566", "value": 91828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490204, "uuid": "211703cd-e4bd-4488-83e6-ba62a234499b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490204, "uuid": "c280877b-ab29-4a68-b20b-f66c730539ea", "value": "ohshit.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ba3d57-83a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784487128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487128, "uuid": "3a6bb794-35ad-4d0c-89fa-2b91f9bf95b6", "comment": "Malware payload (Efimer)", "value": "da74a697e1cb99d47c33099d96820279", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487128, "uuid": "1d835fe1-726f-43f0-a1a7-645d84baa672", "comment": "Malware payload (Efimer)", "value": "dfc5d6c8933546d48bbc67df144418385e5eeda07db0fead7664c07c0b1474f7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487128, "uuid": "8279bbe0-e121-4c85-85d7-77d05e631258", "comment": "Malware payload (Efimer)", "value": "f56a0ae4d109c1344a488f6370413ed17c223dd2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487128, "uuid": "8d091bc6-5c76-4483-b8d2-3c1d7b6b7f6c", "comment": "Malware payload (Efimer)", "value": "b10f4ad37ae82653e16b2254801acc0495c293c386a58edddde3c76d232f6651cbcdcd4e23a47fb25b893875f7f9570e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487128, "uuid": "34120a25-e241-4ec5-b653-d2dd23d9eb6e", "value": "T186E633085DE00ADDE6B3423CAAE212F5F0A474A22771CDDF0B9886B16D571E18E7D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487128, "uuid": "215758be-012e-4b1b-ad04-208096470391", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487128, "uuid": "d87b5fae-0eea-43b9-b31d-d83843232ee4", "value": "393216:NoXXXPOAWzxPst5pwsFXMCHWUjXGcuI3/PGTAI:NKWzxP05CcXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487128, "uuid": "6467c8be-c027-496d-967a-71df7be9a1b7", "value": 14301311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487128, "uuid": "d74fa835-19f2-429b-bc63-131be32fbeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487128, "uuid": "18f9de68-3bae-4a7f-a230-7115d6e9cd33", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed18df2-8394-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784481111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481111, "uuid": "6f648eda-70fe-4470-8a37-896afcff1f44", "comment": "Malware payload", "value": "832f36ce0cd138548cdfc1c0151d6472", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481111, "uuid": "17a4c7e2-79de-4dd1-8b59-39070192f984", "comment": "Malware payload", "value": "e20a48b1fff9af6ad8464c5c6313fb6a6031b45c9dce872d090fdc45994bda17", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481111, "uuid": "c3500dff-b0e6-4c32-a1b2-330bb711d6ad", "comment": "Malware payload", "value": "deb4eea0b5f50d27588b4a037a4435991f0847a6", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784481111, "uuid": "064a017d-2c7b-44c3-938a-3dc76a9f3d43", "comment": "Malware payload", "value": "e710860a2aba84e5fa755f6e9e7bc350aed379f4e887eeb7f630d0f59fbfff69454d109c7e5e70e4b2b63abbe6df10f3", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481111, "uuid": "49abc18e-bde0-4329-ade4-cdaf98c98a36", "value": "T191F522702682C473F1725D70EB48ECB9BC86BED235F452C10ED56E6F34BAA67268D112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481111, "uuid": "7dfc4e0b-801d-48fe-9fac-05afabe0d0e8", "value": "2acc2804ddeca05350c784a2f5ce4f2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481111, "uuid": "c2032a8a-29e4-416e-bc09-b49ef177c754", "value": "98304:XA5WLD1dg04UHamWdEyvsRSkgXhk3Sn7TRPN6bY9alDdhSNBSE:QEHg0v/OEyURg23G5eou3+AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784481111, "uuid": "c662d856-8e4a-4685-add3-abc23cdd77ab", "value": 3564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784481111, "uuid": "829c699c-7f58-464b-8fb5-0658d344b36c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784481111, "uuid": "95eb441b-12b8-4416-aed7-54423e38c625", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a89944b-83ab-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1784490660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490660, "uuid": "c431bc1d-0af1-4cc2-a436-b1d048d527e5", "comment": "Malware payload (Gafgyt)", "value": "efe6fd9f002919ad1ed9259a34222690", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490660, "uuid": "2762c9ff-79f0-46d6-ac13-eebb18b8ec8a", "comment": "Malware payload (Gafgyt)", "value": "e25b101786e71d496cffa99044640095d1cddecb52f4475ddcaa8008f93de1d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490660, "uuid": "8846ca4c-595d-44e5-acc7-94f2b304424e", "comment": "Malware payload (Gafgyt)", "value": "90b35682a873bfcb04d9b214bd6b4345c5b418ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490660, "uuid": "84f31a23-db02-46c9-969c-a984dcb1b93b", "comment": "Malware payload (Gafgyt)", "value": "323f419a69d72b6aeb4a96b8bca0db6c3c74d464f9d71a902d214e1c5712641da4e731daa4381c8de53edaaefd6df25c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490660, "uuid": "9e33ed59-eb07-4ad3-8b45-10844a24db41", "value": "T187E3D50E6F628F6DF668873487F74E21E35823C727E1D645D1ACD5151E2038EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490660, "uuid": "68ce5aa5-b0d7-4a57-bfcb-8c0503cd1cd0", "value": "3072:NwuiSLauO41xkp72HR3D4Xs+Q3pGKPK1Qwrj:Nw8j3xkN2R4MZJiiyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490660, "uuid": "2667c539-c570-4596-97b8-ef7098207f0f", "value": 150844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490660, "uuid": "272bd6b5-d662-440f-9ce7-8ee77ee4353e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490660, "uuid": "3da41ff4-821d-4d54-a9db-12eecd28cd3e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90720981-836e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784464631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464631, "uuid": "d40284fd-bc9a-4de8-92eb-4e01c88ee15a", "comment": "Malware payload (Mirai)", "value": "e59c58d3ab7c10bcd94ce3129cd24c70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464631, "uuid": "6f2c3995-6e3a-41e2-8c35-16569b92002c", "comment": "Malware payload (Mirai)", "value": "e3c33d6864339ff83c9f52533174ff32efeccac7812146ddbbdf20dd04a95f89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464631, "uuid": "39f52479-898e-4c7b-a862-bba46e5a4227", "comment": "Malware payload (Mirai)", "value": "d0cca5378b192c7237b07d1adc30e23bf2c02b47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784464631, "uuid": "d41bee46-2c72-4824-8630-b68ddd94fa73", "comment": "Malware payload (Mirai)", "value": "c7e942a5dbf2ed9df057269ed938d6773c3a78b77adedd2a5045f32166cde4f98e385c26d035438eae5a10a60cffff97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464631, "uuid": "2870cafc-600e-46fb-a8cf-4c0871100daf", "value": "T153831AD7F400DDBDF80AD77B44634906B231A39205830F36A79BBA63ED361A45966FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464631, "uuid": "c8e17a78-3c7e-4cc6-8944-d57b97cb68e7", "value": "1536:RSpGnF9wfkA7ZDj4btHzi+8FjbQi3d/4/H6OXZJ7/aNLusy5OkpQXXn:EpGF9ohj4btH6TgHHXzQ/y5OOyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784464631, "uuid": "617744c7-103d-45f7-8dc1-2477770ce860", "value": 81812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784464631, "uuid": "a84e36ac-255a-4239-a6a1-bb06657aef7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784464631, "uuid": "6d0a8a52-e231-44b1-9dff-295256dd4c71", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85294a73-83a4-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784487805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487805, "uuid": "7e92590a-ce51-4e56-86bc-ea360b83c2ac", "comment": "Malware payload (Mirai)", "value": "937e2be96408211cd7398733750cc692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487805, "uuid": "3e0246a5-abba-42ae-8486-ac5e33c0ae31", "comment": "Malware payload (Mirai)", "value": "e425d063bef56c66f0bde899a4c51ffb4188377ff0bcbddaa22bf1026760b87d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487805, "uuid": "1f4229a1-cb8a-4c28-a592-ee373c08035e", "comment": "Malware payload (Mirai)", "value": "64f31f1aac3b7284402805d2e24b52634989e862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487805, "uuid": "1170710f-c5be-44c3-95f8-6dbba570956a", "comment": "Malware payload (Mirai)", "value": "10dc13dcb80c814400bc6044aae4e79d2437033650db4ba57a4a9ade63ea42778e09c6746981fdf9cdfa785189a14ea6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487805, "uuid": "53339ae9-3dc9-4a98-835a-149d0318363f", "value": "T1D1A33A47B9C0D8FDC499D03847BF7236C422F46E1235B29B23D4AE262D4DED02B59BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487805, "uuid": "9df6c2c9-66bc-496c-9ad9-f6656cfcf1bb", "value": "1536:qWfLJGGck5Cw5kOxABDHEddwMf6dUAM0X5xUTIqJddybLNPJbs5:9LJbck+cAREpf6bTX5WTIK/yfNPJbs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487805, "uuid": "87277589-c02d-40dd-bbe2-f88d1d28ee5e", "value": 100432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487805, "uuid": "04fab081-f018-4f4b-8198-3f207a2197c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487805, "uuid": "dd7ee666-820f-46a4-a703-d44b1233b441", "value": "ohshit.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560d1ecd-8398-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1784482572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482572, "uuid": "03b3e06c-3134-49e6-be80-50132d99fbfc", "comment": "Malware payload (Ladvix)", "value": "3ef10d1e7029ae4cd51cf9c9cee9ba6b", "object_relation": "md5", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482572, "uuid": "5c373693-8261-4806-9671-093a3a78d588", "comment": "Malware payload (Ladvix)", "value": "e55835a8e78ce22accbdd94626a854790459e3c728cecd7461d73c2271305807", "object_relation": "sha256", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482572, "uuid": "57795554-6f71-403e-9f9e-b5620ef46045", "comment": "Malware payload (Ladvix)", "value": "80f724b40f03a4f2471df1aed8c59626b0aa0994", "object_relation": "sha1", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482572, "uuid": "b5f2f2fa-383b-45fe-b975-50430cc05fbc", "comment": "Malware payload (Ladvix)", "value": "e604510e666cff6946fbd2d2d9b8479afc7382f1ca2e714fc4efc38924bc19ab63aa82267d4dcd6172d12ae4aec9ed71", "object_relation": "sha3-384", "Tag": [ { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482572, "uuid": "cd21176d-4ed0-4a10-99f4-d7f170c20e17", "value": "T1D003D90BA7E9EE3DC485C3708FCFD170627174756B32521F368132762592B986B29E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482572, "uuid": "be9aedc9-8ded-4d9d-a132-e0abfca3a3f1", "value": "768:AFTaLRRGJUvnfXPH/3vnfXPKC6yqiaSKafALw/+QVYpw6LgFKJm:GTqRR5fgw/N56Yam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482572, "uuid": "d4d5dc56-8df4-4395-a7f4-5265e9dc403e", "value": 38863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482572, "uuid": "db86c748-c760-468a-923f-0782f772b942", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482572, "uuid": "78eda558-3d73-4a79-b353-c1567e2ac8c4", "value": "clean", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61129cf-839e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485283, "uuid": "f2f61f55-bb01-479f-aa00-7ae23ce4ca25", "comment": "Malware payload (Mirai)", "value": "42a199d906f3ceea06db04b485735079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485283, "uuid": "69591c5b-35c7-4b09-8714-1c26add441fa", "comment": "Malware payload (Mirai)", "value": "e5d6e0d1ab8f556b6c69918b0c7023c60a51756b691250414349bf81ecf431d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485283, "uuid": "8493a2cf-19bc-4eb8-921c-72465b596d81", "comment": "Malware payload (Mirai)", "value": "efe5998c5257e7f7968473cdc8a35813ef05ecc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485283, "uuid": "07325f49-c4dd-42c0-98a4-c6b4aa466064", "comment": "Malware payload (Mirai)", "value": "60e189878bcca06784d03c8a99ccefe3e54ab0ce5350c75fac4de0aa9da5da4360b8a26e0389d22b172fc1716f66155c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485283, "uuid": "2874cec7-8ceb-482b-9e7d-96229f90533e", "value": "T152A3F686BB83DEB3E84324F112F75B314B32FD3E5C26DA81D3697DA489511D0A61A378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485283, "uuid": "da5f0ff7-38cf-488e-b46d-cc3636ac1a50", "value": "1536:9OYRo4Butyf8b4pfzI9VkxDh1t/w2Jf+C8nCiUJmGRH:9PetyEMpfc9Vyvxjr1RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485283, "uuid": "8da4bf73-de64-4b40-9674-e7ce42d3743e", "value": 99748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485283, "uuid": "36c91a82-7315-4467-8e73-652069e52cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485283, "uuid": "74ca57ba-288d-49ed-8c25-88ea73c9dd52", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072d3863-83c7-11f1-be1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1784502626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784502626, "uuid": "9a8a5dc0-91ed-4658-a869-3285aca1577f", "comment": "Malware payload (ValleyRAT)", "value": "0561a3921c93fe5913454241362e80e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784502626, "uuid": "2e87ff0b-8e10-4e33-b4b4-c4e1fed9b375", "comment": "Malware payload (ValleyRAT)", "value": "e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784502626, "uuid": "86c443e8-b895-4b2d-99f1-70013d9f4e12", "comment": "Malware payload (ValleyRAT)", "value": "602862693c2edba1df17afd61b4fcdc3a5ca139f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784502626, "uuid": "e284989d-b080-4865-8888-e340c6e8a7cb", "comment": "Malware payload (ValleyRAT)", "value": "c97ae0708c750760959eb23c491268b69f940b5e862189307c8157380962d52b853e9b34480bee535399a4327b8b46d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784502626, "uuid": "45a4cd16-82fb-4849-9f37-7e1a061bd6a6", "value": "T1F7A73323B3C7A13FF45E0B3B16B3A16094FB9A11B512BD678AC440ECDE264541E7E61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784502626, "uuid": "a43b1e98-f105-4566-919b-0da4deb77e21", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784502626, "uuid": "533075a2-9863-4045-a52a-e819d69b98db", "value": "786432:LhGfMHhij2MOLPstwdk0dyRFsNBvkOPFkFFQB7msB/PZkl4h2r6HWeyZpy0bfiGs:LhGfMBijDO0rs0OPBysNxklDrvpy0bf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784502626, "uuid": "abc1f683-b569-46b0-9550-c8628a97c83d", "value": 44304324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784502626, "uuid": "094ac3b3-7f62-4de7-bcc2-4495855ba783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784502626, "uuid": "f9ecbc9e-bd48-4118-956c-01969f591016", "value": "DingTalkD_Setup2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb415de0-8389-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784476326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476326, "uuid": "f05c6394-ddd7-4b2c-9586-1cd88c2d5668", "comment": "Malware payload (Efimer)", "value": "d9e6c031e7e21d7783ad504cb3fdd409", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476326, "uuid": "932be99e-d2a7-467f-a4bf-1ab95876b7ff", "comment": "Malware payload (Efimer)", "value": "e6fe49120349640169b007fe45a57d0d16cf4cd7dd109f950942e20e2b2a6e05", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476326, "uuid": "0c409ace-3c99-4cea-a1ab-f1ad8dba936a", "comment": "Malware payload (Efimer)", "value": "de74685ad7ca15b9d011f810a7c65b658df0e12e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784476326, "uuid": "e2c28ec2-16fe-4a62-ac16-c65f5deccd9f", "comment": "Malware payload (Efimer)", "value": "fdf9e0adde89e6f22f3c8d2b1651ef8b955c628ddc798d337b1092fcb1d0067b97333ef5be7c54999243d6f6d0e271d1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476326, "uuid": "b22c31b6-baf3-4cef-bd93-6bf5f727914e", "value": "T161E6334CA6C822FEF272503CFDE245C9E978782A6B72C8CB6B2446B16D535D05A3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476326, "uuid": "1e7e27f3-6037-4383-b305-268a6f30c1d0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476326, "uuid": "0bb97799-49c1-4cd1-8cf3-8ecabdc53c4d", "value": "393216:JcCB95liIOEEL2VOykXMCHWUjX8cuI3/PGTAI:JLT7VkykXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784476326, "uuid": "681c85fe-a3a4-4f1c-a65b-e8375e500296", "value": 14316918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784476326, "uuid": "9199bc2b-91b4-419e-b37a-cf193b9c47c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784476326, "uuid": "bd9d9015-ba0e-4942-8a96-034ef9919a37", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05bc80c-83cb-11f1-be1e-42010a9c0009", "comment": "Malware payload (Amadey)", "timestamp": 1784504709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784504709, "uuid": "29cec984-25f2-4543-a0bb-1ad4a40d6e9c", "comment": "Malware payload (Amadey)", "value": "f8e68cddf13a94d821a4b265172a0e32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784504709, "uuid": "b9bd63cb-c613-45e6-a3b8-f7dffeaec0a6", "comment": "Malware payload (Amadey)", "value": "e85149704da6ee8f9bc1c55304c560d1a792180489d4859a64cf0a4e056ccf52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784504709, "uuid": "45f95200-736c-4004-9cf7-294c1a8e8de4", "comment": "Malware payload (Amadey)", "value": "16646bfd7f6554cd170fb373ce813c24f37e829e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784504709, "uuid": "c61d4981-65dc-4ebf-835c-99a80bc84a10", "comment": "Malware payload (Amadey)", "value": "38bb14e6c381d318d9a55f39e7bc6158d33f033d79409177329d31836fcddf02c411dbcc289d018f400ba18fde761e79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784504709, "uuid": "66d19671-474c-4f39-82e7-a0c45907eaa9", "value": "T1A4D4C013B9A18476E1724635CD68EB54977DBC700F20ABCB67C005AA6EB06C0AF37767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784504709, "uuid": "62c1067d-3d4f-4497-9cda-3defdd6dfda0", "value": "cd702dbfbd74cf5a80f59195b2460134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784504709, "uuid": "f373db0b-5a02-43d4-aa1e-60a7cc54fd60", "value": "12288:L7bqVdZJ9HO5ov7zbrjr2RMh+luyxBlDetAqxSvwiA:L7evcojzbqRM+luyb4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784504709, "uuid": "bdb976a2-cca6-4029-bf59-c3c2c6805229", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784504709, "uuid": "1e8d6996-ce02-43bc-9837-137fe323d4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784504709, "uuid": "a4e82ff5-af1b-4e6d-85ab-c2c870e13565", "value": "F8E68CDDF13A94D821A4B265172A0E32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807f6512-83a0-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486079, "uuid": "4a71f6c9-1130-4db6-bf8d-69d085a81c2d", "comment": "Malware payload (Mirai)", "value": "7997f97fd05f7349a415d81552243ce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486079, "uuid": "a01d981c-5c9a-41a3-b99c-148a80261ea0", "comment": "Malware payload (Mirai)", "value": "e8ba80f829b67d3a0fcad9a7d554b6a686876dd09125c3b1a2e3230712490e89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486079, "uuid": "ce650d73-4277-47bb-abe2-19ebd7e48cfd", "comment": "Malware payload (Mirai)", "value": "2d01601e268c503b4d21b33c7c1d72c0c8a9ac2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486079, "uuid": "ecfe7238-81ea-4476-a20e-64fbf46bbb38", "comment": "Malware payload (Mirai)", "value": "7a88fe58868fd23e99c38d54fcba5ca24ecb96c94d24015ea24b672045ad94d96a4d9dd7e7a414c2d7bc0dc93576e57c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486079, "uuid": "440e5bae-4aca-4916-b3f1-57c3365775d9", "value": "T1C3C329A9F880DE52C6D4267AFB5E518C33231778D3DE7106CE109E3477EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486079, "uuid": "9bc5fe5a-31a0-49e7-9bea-96be066523ce", "value": "3072:ZLaTQnWpqwVpWcchkEi9cYEEUuh99nKOvNwhcHR3aPSU5VwuwU8TQf1D5s:ZCqqskP9cYEEUuh99nKOlw+daPTRKQ9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486079, "uuid": "e67cce18-7fbe-4a4f-aaca-fcaa0ac0149c", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486079, "uuid": "bfc173b9-6bc2-439a-8964-a3111bb1d242", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486079, "uuid": "013b2b60-8764-47f5-89a4-83d871bfd7b3", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4c6b08-8375-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467713, "uuid": "2f5bdc40-9fa7-4c42-9eac-27464eecbae5", "comment": "Malware payload (Mirai)", "value": "8a2bd23d317c1719217e5c2688e70cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467713, "uuid": "e776b468-ed6c-4188-92c0-652668f67025", "comment": "Malware payload (Mirai)", "value": "e96bf53db84fc07acaad3ec33280fa981ed4364c22ad91376f6cc9883b432e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467713, "uuid": "059fc497-6685-4e9f-a365-b82a01995880", "comment": "Malware payload (Mirai)", "value": "9e9d6f483cc9ee348cfdb6cdaec4c4a6a1028e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467713, "uuid": "fe019205-6408-4ce2-801c-5720cbd6ccbc", "comment": "Malware payload (Mirai)", "value": "131892147a3aebdb543a282adb3e45e7d0867274acf33f47bf0e47d1645124463dcc069105661f9b8c6fbd250ddfbf1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467713, "uuid": "d2ae664b-11b5-49af-af41-b77406136dda", "value": "T12D633B02B31C0E47D1635DB02A3F27E193AEA99121F4F689651EDB869276E331187FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467713, "uuid": "8bef2381-42c1-4bf7-8d39-4442e0c2b3e9", "value": "1536:F5h8/KL6zn7hncTx3Qu2ra4DUeINS5AV6Bo17os/KWJE6:FEaR8BUeIU5BMJE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467713, "uuid": "d47dea9a-2be7-448d-bc3e-6bc9683fcf0b", "value": 72860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467713, "uuid": "a699b413-1b04-4a2d-a822-016448d91f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467713, "uuid": "43c65228-cebf-46f1-85c0-49aa735ae5c2", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1893b2-8343-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784446342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446342, "uuid": "ee69a385-abee-4402-a1e2-ed3b9a964fb4", "comment": "Malware payload", "value": "32d3d9b7f60ef3afbd6ede6518dcff20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446342, "uuid": "ef5a6929-ac86-4c2d-b194-92be061d8c26", "comment": "Malware payload", "value": "e981d296a7034bc03a3a84185b5ac07d26afc01004f55cafadfaad1c42d70f40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446342, "uuid": "687d0f3c-2c00-4dea-a0c2-ddc2be6acd3d", "comment": "Malware payload", "value": "39cd9009a675547423db318af0713c9f4fc88da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446342, "uuid": "dc63a06e-d3a2-462a-9b8b-5bc31948daee", "comment": "Malware payload", "value": "ed66f28221689e975fb0adc88d3a83fdabecd2be3fd37e1697390a797fe53499ce00ef6002aaf0c2995116c78d370e3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446342, "uuid": "5854fac2-b06a-45d4-99bf-b8ba6bba4c88", "value": "T1898533E5309C1A14AE8E346AE1FBD273D6FF08E0590535CDD88746A2F859A5F08D272F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446342, "uuid": "c0820eef-387e-47d5-abd7-ee00d5630297", "value": "49152:uPvrVZ72ZhLqjP4zlSyLcGZa+tt9DzujxG1Xd02q:up9GLq74zwOT5zi1r2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784446342, "uuid": "1a34d52e-bd86-4359-bc98-34fc1affd7a7", "value": 1744164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784446342, "uuid": "d00f6de5-febf-471d-b1f2-332a004b49b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446342, "uuid": "dd01e7a1-98da-4568-9d6d-b1caa52f362b", "value": "riscv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063216e9-8348-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784448079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448079, "uuid": "57e96573-c0c6-4f62-9ea1-42ed1e3b956c", "comment": "Malware payload", "value": "d50718272c85fde6657829d529cd5b47", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448079, "uuid": "80de1d42-a05b-42a8-a039-24ef858fdccc", "comment": "Malware payload", "value": "eb4dda22e709b7da15aaebddec842067e97d85cdc99d753dc6335c0ae63d1e42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448079, "uuid": "3131ff94-f167-418a-ba63-1e0ad91a5a73", "comment": "Malware payload", "value": "9e84cfe52a57d4399b5d30f8c77896bcf44e280c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784448079, "uuid": "5be731f6-a8f0-4720-82d5-e9943b11fdb8", "comment": "Malware payload", "value": "2d6660162152b23752776240a46e8168432f5f383b339c7007bbbc839f8b9bbd485d3a21239bd0411fc5948311c66b4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448079, "uuid": "885e4337-3579-48a0-a13b-127a31834470", "value": "T1A6C28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448079, "uuid": "44348c0e-5371-4586-89bd-fe43d6a5e17c", "value": "768:A8vCB+25j6es8R89FYpMSUpi+20qUpi+20YQX:A8l25JKd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784448079, "uuid": "1dd5862c-b3f6-4904-a412-e70833456a01", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784448079, "uuid": "7deedcd5-9d77-42de-ab5b-8d6555841628", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784448079, "uuid": "0558dd52-fb30-4ecb-8478-9e1dba6d416c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c94d92-83a7-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784488934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488934, "uuid": "d082b84c-d5fa-443c-8d09-d6356c90334e", "comment": "Malware payload (Mirai)", "value": "771009e9be4655e10ac25240ea04b9ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488934, "uuid": "ea6d9144-0fe1-4a8b-82ad-15bdb3ec2c6b", "comment": "Malware payload (Mirai)", "value": "eb858a87854b713626531ded812d4da88557392736e878cceb124fabcf19cbf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488934, "uuid": "a2c5a3f7-f1a4-4523-a32f-708fcccc78f5", "comment": "Malware payload (Mirai)", "value": "f20896abef44afa193c4c71695c4182297e8d3b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784488934, "uuid": "f1700d8b-a472-4470-b32e-a2aaed626840", "comment": "Malware payload (Mirai)", "value": "d8e12c30d96ec606a42dc39378e12fb9620988b2e3995c1cb37c874088371b8e1cb64f1b348329e7c9c2340161094ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488934, "uuid": "db925c84-c388-4685-925c-16ad7151e8e3", "value": "T13C04F70AAF600EF7D86FCC3B42E94B0625DC655322A43B757534E928F64A54F4AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488934, "uuid": "30e20021-e979-4596-992f-3a0497c1a25c", "value": "3072:YZ2KiCbqtX5pYmRIuFPDzR+z8RFJHRIW38H0OX77nbC+:C2f0mHFPDzR+gzxIQ8H0AC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784488934, "uuid": "9c990ccc-076d-4cd0-b9dd-a0399bd58a0d", "value": 180320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784488934, "uuid": "b0bce8e9-2e66-4161-bbcb-797e09804705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784488934, "uuid": "adf4b4a7-6fe2-4397-acfa-6f27a4a9a620", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3111422f-837e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784471343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471343, "uuid": "64875080-1118-489b-a3fc-a81e741a16e7", "comment": "Malware payload (Mirai)", "value": "c9f70625bb69a0b5b1a127aa0dff410b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471343, "uuid": "6e6f8f1f-a06c-44d3-99cf-8a8ad9030045", "comment": "Malware payload (Mirai)", "value": "ebb529ad09a2a23b9327e0e2482f597ca94ea4867fe42a6e70a38184340bbc8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471343, "uuid": "42d4de59-06e5-4e0e-a010-ca12ec1ced6e", "comment": "Malware payload (Mirai)", "value": "857af681aa115feaf08c279238afd8e43117a122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471343, "uuid": "6899617a-e46b-41d8-a786-0df1207d3151", "comment": "Malware payload (Mirai)", "value": "c09877edf8473b27e68b3490aab9495bd9bc504409f68eed31f16835c294555ddd2e5ab702e74e55a1431323262e20c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471343, "uuid": "19178158-7f32-46cc-a6ed-08a8a8c2746c", "value": "T18203E1ADE6A07C83CE588CBE024E01652CE4E1F0F596AFCD3718995AE55A408FDCC47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471343, "uuid": "315d0ea6-32a0-47ce-b7d1-dbe29bba04e6", "value": "768:nABeP1CXfM69PwmmJPCLYph9z6dh9rHoZW/A7aHn//WT:ABeMdPwjJ59zgHoBWHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471343, "uuid": "3150726a-e893-425a-be49-51a44a24b616", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471343, "uuid": "5a4e13c0-fe32-4590-8a4a-f5797f2b6947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471343, "uuid": "50f7fb00-f17f-426c-beb9-3dd8bd562dd2", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e95cd93-8398-11f1-ac3b-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1784482533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482533, "uuid": "a42bf7bc-ba3b-4d66-90d7-02af4ad90759", "comment": "Malware payload (HijackLoader)", "value": "5a4ae18dd9b4e014f373e3496b4847b4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482533, "uuid": "23b266ce-b094-4005-a8c0-ba941a888086", "comment": "Malware payload (HijackLoader)", "value": "ebc088df0da93277c12a000aea0aff5aa184289fc7e72fee3c6fe181ec05c78e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482533, "uuid": "fd0810c3-bc18-44ad-b869-7547f2c6cc0c", "comment": "Malware payload (HijackLoader)", "value": "5e265395ad38c8cfd39a99ef878c7511e16d57f8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784482533, "uuid": "dee0fc9e-eef0-4c4c-a226-1ad81e8cb586", "comment": "Malware payload (HijackLoader)", "value": "04650deb79045dfcfff3208c65aa2e77fc5fd8f9fb710254bffcd9f2b1ce77840a17c7eb4dfe54f7c56f977d57b63b88", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482533, "uuid": "7f0120ec-f370-450d-90d8-66c622effac2", "value": "T11866331AF3CB0476E85099B4492680509D7A38FC4EF9E0066DB1CB5F993E9898F73B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482533, "uuid": "bbc8c5c3-2f0e-4687-9398-b4e08827139f", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482533, "uuid": "3f7233a7-cd39-4e5c-8965-2e8f9ba5538b", "value": "196608:UGgzrZjq9U6aEb2gjOBfwnmWPsCZSSzGT+9xd:cZq9b2gjOdEJvZSSvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784482533, "uuid": "747bb8f8-6e61-4af9-89fe-02c0de42ed88", "value": 7002440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784482533, "uuid": "b162d5f4-3d95-4d94-ac04-21278a75a521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784482533, "uuid": "2769c289-735b-45fc-8e01-9c3765ff95cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5635cf2b-8393-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CleanLog)", "timestamp": 1784480425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480425, "uuid": "f48b0de9-faa5-4c0c-836c-d289d125108a", "comment": "Malware payload (CleanLog)", "value": "fff0d8e3606f2ff2b5d87d520bbe4b68", "object_relation": "md5", "Tag": [ { "name": "Cleanlog", "colour": "#91D7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480425, "uuid": "44137127-b4b3-4036-911e-c325d27b7cf4", "comment": "Malware payload (CleanLog)", "value": "ebcb74a49add3f34c8c916839c0bc2c9f7646263ef91b4377156e078385a3f49", "object_relation": "sha256", "Tag": [ { "name": "Cleanlog", "colour": "#91D7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480425, "uuid": "3bb6b1ea-a28e-4d38-86b1-61ba6959c976", "comment": "Malware payload (CleanLog)", "value": "4819590c138e2e014d51a1b916a0844bc9374123", "object_relation": "sha1", "Tag": [ { "name": "Cleanlog", "colour": "#91D7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784480425, "uuid": "c2afffce-7499-4fc5-816c-fb6d6b1b6aea", "comment": "Malware payload (CleanLog)", "value": "974935985a0e85721c5af8ea20365758c5d4257fbe9728bb7ad7e285cd61adda97e38185b8de7322de688e338fba5d33", "object_relation": "sha3-384", "Tag": [ { "name": "Cleanlog", "colour": "#91D7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480425, "uuid": "e0f9fd2d-9996-482d-89ad-7ccc75d7fc77", "value": "T126A2C407BB61DD35D09552B42EDFA2A0723378B96732270B368AB3716684BC40F2D657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480425, "uuid": "6eccca8e-63c1-4d81-8051-11290dafcdcc", "value": "384:blaj0x6VJMgo6LjGTTo5hQOoMwNzF06CPWdjV/VH/g4A6ZD:by0XFvgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784480425, "uuid": "847788c4-5733-4150-b989-c40b027b0c3c", "value": 22368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784480425, "uuid": "37fefe61-c545-484c-83ea-ee1317d6404e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784480425, "uuid": "7814e613-df04-4d2f-83f4-93444e32c89f", "value": "mig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a873f4-8371-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784465692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465692, "uuid": "d472eb1b-5ff0-433b-ac69-70b978a89990", "comment": "Malware payload", "value": "5b0e070d241804f5a030fb7c8bf0a574", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465692, "uuid": "126320ea-de3a-49bb-a9d8-09ee901ca564", "comment": "Malware payload", "value": "ecbf82b0d81bf825416c378b5353b425df896fd887f618ce6dc19690d3398b82", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465692, "uuid": "93283b72-e765-4c04-82a5-56ae887b2068", "comment": "Malware payload", "value": "ee2f49561ade8ac071e30e934f41fe5d825f14f3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465692, "uuid": "9eca6862-1b96-47da-a355-e72247e1ad79", "comment": "Malware payload", "value": "84059f4c046d718ed8cdb57158f20ea4170c787105ed0b368576ba4a99dce32eb518b4b69c36659fefdad6687ed22eb2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465692, "uuid": "2fc766a8-c242-4a6e-83a9-71093a465913", "value": "T1B514190D933DDAA8F63A297D03D89F817DE0200F8BCD05C05D39A77369A59D93A9216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465692, "uuid": "be5a1b1e-0e58-447b-86c2-0b39886cd3bb", "value": "02937d5d6013d9de953275083b08bd0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465692, "uuid": "ed7ff5e1-57fe-4b59-94c9-8819badaa524", "value": "3072:qBaYu88CkYDR/rBLclyxnbZmAZkU1YLLzFlQTw8LQufsWakqqQ/j:qBaYu88+rekxnbLYoTw8LQufsWakqqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465692, "uuid": "e0ec7a8c-f20b-4751-bae7-e4bbc3bb52d7", "value": 195747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465692, "uuid": "be858dab-6378-4bef-8ac2-ad6696200030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465692, "uuid": "ab7a8d6c-0a26-4060-a451-8dfff9a6418a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ae023d-839c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784484456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484456, "uuid": "5f13291e-8909-4518-ab6d-1a0db0f45bab", "comment": "Malware payload (Mirai)", "value": "28da6f3c831721d7b2663e2a027b1edb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484456, "uuid": "627db9a6-cf9b-4699-b4e6-68a0f9d87892", "comment": "Malware payload (Mirai)", "value": "ee151571aa7e736f1adf36e997afae0590824707fa4c2fb3623c76c1241af135", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484456, "uuid": "86e294f1-617f-4206-8395-2d6a11fdd0b8", "comment": "Malware payload (Mirai)", "value": "91f8e448dfdccae1cf6f3fd17de6b0a9e6575b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784484456, "uuid": "c6f85732-69d5-412e-b20e-2e800ff65257", "comment": "Malware payload (Mirai)", "value": "392666be9700c4ee952a2a8c3d4b81c21175355d6d954f86868f9225ec4d46c80e550289efde0db633530f4813f3b086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484456, "uuid": "01059157-bf9d-494b-a603-aac38c2ccd54", "value": "T191D3B80E6E319F7CFBA8C23047B35B25A69923D636E1C585D1ACD6011E7038E645FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484456, "uuid": "dd7edd1a-beca-4031-96e3-c69591ddf193", "value": "1536:EoxSfXpsfExmrc58B4OwBAJNqbjUAH9Ns2TpAoOGOvw/qPe2NXdRvB0Re:LSfXEEQo58RaUA9Ns0pAoOGawSBRvig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784484456, "uuid": "1320a671-7067-4b43-a159-b79585a7f271", "value": 135572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784484456, "uuid": "03c481cd-e6c8-4e43-baed-fa505647d259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784484456, "uuid": "20dd7de1-aa4d-4bff-92f9-da6558e8cd16", "value": "ohshit.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3636ccba-83a2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784486814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486814, "uuid": "44963f15-8460-4e97-8aae-5e5194ca33ef", "comment": "Malware payload (Mirai)", "value": "3764b6a3a3da78ede56057be3dcc99e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486814, "uuid": "676d96dd-55e2-4a39-9298-510039557a56", "comment": "Malware payload (Mirai)", "value": "ee2ac2bdd780e82866f0135effc08c748895c42541d368e34b6214dbc9a6d190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486814, "uuid": "ece53d76-a5f7-4a1c-bc8c-6c0384385195", "comment": "Malware payload (Mirai)", "value": "9afaf6bfb8876f27c9bcf26c72ced67bb9ce0cb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784486814, "uuid": "c92b62d7-59b5-435c-b17d-40b6a1715bf2", "comment": "Malware payload (Mirai)", "value": "903a320287badc6e59166b8ea60104a7b6315703df937e3d7cbe287187790c0100f42f87d31082090143c0af210521db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486814, "uuid": "d0974bf7-3f2b-472c-a54d-5c52e4f08a59", "value": "T1ED53F1D5D2A79F88FC7DD57A8D6F34632405E72950220C77BCE8523BC601F222E29AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486814, "uuid": "8de9c5bc-4435-4c51-b80b-3fa57a17f614", "value": "1536:W7j2CD6NbFUiosJaGIwBpqdXfsVOeLYVZpnouy8DMe:8Dghhost2dXfmOeLYZoutDMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784486814, "uuid": "7f09fc26-b973-46d5-819c-95567f73b124", "value": 61012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784486814, "uuid": "9846694f-5b1e-42e3-ad30-f7e6aa5dc822", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784486814, "uuid": "89c68de2-dd72-40d0-a149-47245789b376", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cabe88-8322-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784431832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784431832, "uuid": "7c99e47d-3038-44ea-95ba-839a35267886", "comment": "Malware payload", "value": "0da34bd922eaac9f48c05fa9d31cc9d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784431832, "uuid": "ebf4e6f0-68b0-4a70-89cb-deb8d843926e", "comment": "Malware payload", "value": "ee5b4f0f96155f0e6d93d7816e26c54b64c230d8af0397eecb99039cff844b81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784431832, "uuid": "04d88f98-000c-4a6c-8a13-ef9b335d6131", "comment": "Malware payload", "value": "be7ff7c7e85a7b807a939f4404343ccaf624b63f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784431832, "uuid": "869a223a-a1f4-4573-9ff7-ef38e8f14276", "comment": "Malware payload", "value": "64785b1a28c5b3a9f15ae384658f167327b17f68024f036169438cf9deea4a8c020d3e833c7d801d21a276fa02c1cdbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784431832, "uuid": "c841d143-a98d-493d-ae15-d4961e654122", "value": "T128F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784431832, "uuid": "49f4932a-9dd3-4897-8b43-cec39151f002", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784431832, "uuid": "7430e61f-7933-4cf4-b095-c4205b84f064", "value": 15564800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784431832, "uuid": "618263f6-b396-4ab8-929c-692a052500d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784431832, "uuid": "7edd630c-15c6-4c9c-82eb-b0710e851397", "value": "ee5b4f0f96155f0e6d93d7816e26c54b64c230d8af0397eecb99039cff844b81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f91e03-8356-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784454254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454254, "uuid": "8113048e-4feb-42ac-9662-1c66d5805a13", "comment": "Malware payload", "value": "0b8790f44e38c2356bb116a8e0a32eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454254, "uuid": "2d5a3d5e-8fb9-4c0a-b5b1-bb78a535dac5", "comment": "Malware payload", "value": "ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454254, "uuid": "1ebd0822-e3fc-4208-9d78-48ce760f97a6", "comment": "Malware payload", "value": "d30139311511e5dac9057ccf9655176d7988b9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784454254, "uuid": "04717cd8-b187-4802-ae89-a281df4e3c76", "comment": "Malware payload", "value": "b6b81a58924a6ed4f419449d3d1b7bd29423ece8d4917ed4406f1d7b12249237cc1171ccb4938a1cb53e5cb10b553f0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454254, "uuid": "a0753dc2-9258-4cdf-bf50-edb586620db2", "value": "T1EE765A03FD6915E9C4ADD131CAB396627F617C894B2123C31B90B2287F73BD069B9768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454254, "uuid": "d878f5bf-eead-4552-8768-443bbea0d76b", "value": "49152:/hRopHv8LbNoATHvNOpCq0P4a+IrQcZbmTmJH6ynQp1nus3kZkbi6ZWL0CzSgKCd:/hyHEdB0mB61n13oei6ZWLrXEEgKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784454254, "uuid": "5ab6f946-5fe3-4066-be38-ff96fde4afaf", "value": 7823522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784454254, "uuid": "729bb967-84e9-4a88-9924-1500061ef92a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784454254, "uuid": "f9584e5a-8e3f-4913-9509-8e0e35e384cc", "value": "ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32195dd4-83b3-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784494108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494108, "uuid": "04bce5be-3303-4619-a20a-c9b17fa5000a", "comment": "Malware payload (Mirai)", "value": "dcee2c72f33eaa2b71702f2e77ea6ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494108, "uuid": "25f03eeb-2940-4e98-9bdc-0193fa343194", "comment": "Malware payload (Mirai)", "value": "ef1bd09696bce7aed7ba152f1d21060a56f23bf08051c6c04b9f2974d684d4e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494108, "uuid": "08ee0667-23fc-49ed-bd8d-c31478807a40", "comment": "Malware payload (Mirai)", "value": "9d583353935699b81ee727f1bc293468268cd0d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784494108, "uuid": "15ad3dcc-5638-494f-9178-eafbf94fe056", "comment": "Malware payload (Mirai)", "value": "7b5655777eb04963a348cd879a87729469e9fe6a0cb0bfac07075fdd7356713677c8db7af576101757e262d8498a8e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494108, "uuid": "9c66290a-f706-4b9b-9a30-01d8afa5253a", "value": "T12DB32A46F8818B21C5D712BEFA1D618E33131778D3DE32129E186F21778B5AB0E7B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494108, "uuid": "998397ae-3c1c-4dd5-bc2f-66d6dd7e7329", "value": "3072:nbSsT7Tmng0PjblEszGiNRa2snyGdne7E2rsjlX5n:nbFTeLXyszGinaICniE28lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784494108, "uuid": "a08e4e83-eacb-44ad-9e5d-9d2715e12e9e", "value": 116188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784494108, "uuid": "66f1492b-eb76-4f03-b278-5b251d5ed66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784494108, "uuid": "320be80c-2267-4893-8164-fc210b10bc4b", "value": "ohshit.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c72ea16-83a9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784489858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489858, "uuid": "3d76a4c7-31a3-4a7d-b08c-979193d645c7", "comment": "Malware payload (Mirai)", "value": "252751a7bf6fc187a4124b812d489e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489858, "uuid": "1781ed9c-e222-4b71-b206-b5575a24a05a", "comment": "Malware payload (Mirai)", "value": "ef25690d8594c1276d0b713d880700b869d72046dff01ff1a42294e539b84a68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489858, "uuid": "493f4a85-032f-4b25-8746-8e3827e0109d", "comment": "Malware payload (Mirai)", "value": "aaedc51061c704400c1ec52386788797cdd695ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784489858, "uuid": "a80a2046-60d2-4b9e-ae09-e7f95c2192b4", "comment": "Malware payload (Mirai)", "value": "fd4bd20c67da0602373192ca4bc9d9851424ce084b6ea8ec1ced9445d586c50660373ec025c148fb4ee1d11eaeaaa7a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489858, "uuid": "3eb970a4-171b-4e49-a2fe-e9b92752c6d7", "value": "T1B6E30A0EAF500EFBD82FCD3B06E9174635CC655722A53B753634D918BA1AA4B0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489858, "uuid": "62f78be1-623f-4693-b506-5e7f60921415", "value": "3072:UgFC6yQnXHFNNb4YOS9ENaicsXfMf6TwlDhZbtQdaYs:vFv5zOS9ENaiJia6DhZbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784489858, "uuid": "a8580649-0169-409c-9014-7ca3fb791905", "value": 154928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784489858, "uuid": "90fa3b8e-433e-4c2e-91f1-24e63dc2e002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784489858, "uuid": "08143436-31ec-44c6-a0d5-20b96028bfea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1c4ddd-837f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784471848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471848, "uuid": "788021f4-51dd-4478-a294-c85aaa4a7707", "comment": "Malware payload", "value": "80b54fbeaccf1f1aeb131c56bf3b42c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471848, "uuid": "31bbb9b9-1804-4352-a4e1-8f6a1627e360", "comment": "Malware payload", "value": "efab45e445f7f3895ae26f54819eb30e7fdbe0b289e12d8f7c077f895efbe2d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471848, "uuid": "f7629191-8a61-4246-80f4-4157328e8e70", "comment": "Malware payload", "value": "ea158854465633fe3594f0fb786fd6f8313ad55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784471848, "uuid": "cd3e708c-297d-439e-8abb-7db0d5953ad6", "comment": "Malware payload", "value": "3dae9800800978fd58c5789c46dbcd5a3393a8626498c9b8b05a484aba74f508f8b416553e385496ff72b471b9ce4e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471848, "uuid": "6e4ea5bf-e86b-4daf-b99d-89524a181dac", "value": "T19A6512C9761072EFC52BD47089A66CA9F7057C7A872B4947C0173DAD9A7C88BDF180B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471848, "uuid": "f0d54ae3-94ba-490b-b77e-a13b5fa26824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471848, "uuid": "d6fc775a-2ee3-4a30-b245-b1569806c1ae", "value": "24576:iyN2MetPvstcZQ0ZJn9zt8Wkm+b1DPNmbWtVYhekYiJirT1dbSpX96r70Gee7Tt:Fotht9z2Wkmm1obuV3IJirT1INZyTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784471848, "uuid": "5f0b953b-37c9-4fce-91e8-9dafaa2177a9", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784471848, "uuid": "9452ef5f-8e96-4a4b-a36e-4b688735a29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784471848, "uuid": "51b63b32-d603-4e7d-9417-fa3b4513e365", "value": "Protection.Agent.v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf91ecfa-8346-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784447531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447531, "uuid": "f035ac91-b59d-4127-a5ee-783ef3289c5f", "comment": "Malware payload (Efimer)", "value": "5ce6ee0bcdf96d64dd701d72237552d8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447531, "uuid": "ee24ec0b-e90d-4151-80b4-6f4f30ead6c8", "comment": "Malware payload (Efimer)", "value": "f033922762915c3cc901a8c00fe8760079f9e178bf0bd275fddd81a3a0b01d47", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447531, "uuid": "1de694f6-0efa-47a9-a3fb-51548425e8c8", "comment": "Malware payload (Efimer)", "value": "547a0dd6d746a4ccc5190d278fd78148e0ab031e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784447531, "uuid": "08367cb7-cb6c-40c5-96ab-fc62b938ff03", "comment": "Malware payload (Efimer)", "value": "e0222cf28f05fe2dcffc34dae0a07e69b529c9c6738e2543653c4d1af8a34734cf2b3033fdf46e1fe1425b030a38f36a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447531, "uuid": "028b0765-2cfb-4e00-819a-fb67ea70bb4c", "value": "T1F2E63358E5E012FEE9B3427DEDE20592D8B4B4620772CFAB0B90A755AF672E04C3D543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447531, "uuid": "23ee3af0-ede8-4c43-9678-701341aedafa", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447531, "uuid": "d79419a8-12a5-4c04-97c2-ef83bace9316", "value": "393216:GjeQS/Nn/DMmxhazkevEk4XMCHWUjXIcuI3/PGTAI:GOFQmxhYveXMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784447531, "uuid": "a56a9a15-a1f8-421b-bd79-e1b1d042cad4", "value": 14298873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784447531, "uuid": "207433ed-3b99-4a2f-802c-a17a71046a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784447531, "uuid": "d7806111-4aeb-4011-9c7b-b98e03ac1b70", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea6da96-83c2-11f1-be1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784500840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500840, "uuid": "bccfe0eb-b50c-47c6-b8f1-91343fe0d1ba", "comment": "Malware payload (Mirai)", "value": "e6e9faf0f85c8f030cd7b8373a409769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500840, "uuid": "3d5e0c7b-ff9c-4713-a8a7-0f918a329089", "comment": "Malware payload (Mirai)", "value": "f0ea2d0017a88323d730042c2b571a4d06cd8dbe169c3cef2e457bd0c5d676ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500840, "uuid": "4f996681-e6df-4842-8ff8-649956d4e17c", "comment": "Malware payload (Mirai)", "value": "3e8c93ca78831ebf02f99a402766b3fcd6e71fd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784500840, "uuid": "0990733f-91c1-4b69-9681-fd343f9d57dd", "comment": "Malware payload (Mirai)", "value": "d894f709e50fc8c8c0af3ba2ec5a3f120a2da3bb877d3ae502f27b307d470ba440e86aa82b725b4b7a0655f63e18e487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500840, "uuid": "f905b91a-febe-4238-a1d8-497981e5e4c9", "value": "T11B43F182CE61FE4AFB742233C91E8A41680999FCDD6579B291B215146AF32DC3FF0583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500840, "uuid": "c5ca2ca4-7127-4109-9ae6-aae5e232eb53", "value": "768:fySvUwRefU1hhRRjTj15WXdQv8qzYrHQKKPvyMuAnFy09p3U4RufefPh5BnuppR9:DvUwV15WGkqzewK6avAnFyOUquUP1fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784500840, "uuid": "818ec619-3776-42f5-84aa-709eebde7ac7", "value": 55656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784500840, "uuid": "208bcc8a-9b33-4ec8-86de-52687571ada8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784500840, "uuid": "58697cee-6dca-4dcb-93fa-1a439c5950ec", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffe1220-8380-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784472174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472174, "uuid": "9974096d-e5e5-4dc0-ab70-983615da03d1", "comment": "Malware payload", "value": "f4766afdd0f7627a7f1fd6ebee5c9c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472174, "uuid": "50c9f997-5089-40cb-b7b6-321b86d3f39e", "comment": "Malware payload", "value": "f1a5a73fc8dc8876da560a5d8ad966eff34fbc630a649dc3b7ac6da9f9690f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472174, "uuid": "8e7ca95f-75e1-4c39-9740-be328c903db1", "comment": "Malware payload", "value": "8ebcedb5fceee6a1d539fb8bd6902d9f4a335742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784472174, "uuid": "7ff70c25-0561-4f66-8992-80d4a5f0c34b", "comment": "Malware payload", "value": "8b5780f0d896c03161cb372cf15169b96998f1f421a75a27084f089670c59c6a004bee80e4183bcceecab606d5c7bf96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472174, "uuid": "505daed5-1b9c-4f76-8cbe-e0d4fe0b7099", "value": "T1DC463911FECB50F5E903193205ABB27F23346D054B28CBDBDB547E6AF9BB6914832246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472174, "uuid": "1760e81d-34ac-4e96-b0b6-225f09f311e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472174, "uuid": "ccec1c3a-61f9-4866-9c38-772f1e27cf3d", "value": "49152:hZ7sH2YpEDS+f++smhHKK+RGdcyKgN7yobV9/FnvEwj698fhfX7ZQDN5E:AtpEDh6UdcyDN7xbV9lf17ZQnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784472174, "uuid": "b1f598cf-35b1-4868-895e-b2ea2fba802a", "value": 5629440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784472174, "uuid": "2605573d-3bad-4253-8bea-0f7df9464331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784472174, "uuid": "148011bc-5554-476d-b7bf-d0be0184eb4b", "value": "operatundef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5d9d2f-8344-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784446779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446779, "uuid": "4b88db50-edf1-4ef1-92c1-4375c391735a", "comment": "Malware payload (CoinMiner)", "value": "f9374562d78ad41f64da5e83b2be7fc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446779, "uuid": "81555661-28dd-4f69-9647-173416271e9c", "comment": "Malware payload (CoinMiner)", "value": "f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446779, "uuid": "ca7af872-4fbe-4296-bc80-c174601e83e1", "comment": "Malware payload (CoinMiner)", "value": "67e687c086739b6c4ef1ba393503071fbcf1f09a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784446779, "uuid": "8dfcc663-d987-4b7a-994f-03af6c629ce4", "comment": "Malware payload (CoinMiner)", "value": "3a799e65260602c0306bb47b3b1dc2ec56c3e885c44d4b9c3bb738e05634874fdb320527e871df22c5a9fe4993223e8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446779, "uuid": "37cc78c8-f424-4324-a987-070fc5ac3c8a", "value": "T1536533CC5BCE91DC4229E4F6797DAC1A943970E3C4CE402DF6AA2AF4464F6C305668B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446779, "uuid": "0148de84-19ab-47cb-abe9-37514f954bb2", "value": "24576:jgApxJC8uCiRgAkviGM5r1fnGTWQYxsAP1+CZVXVwCGB50IpwKS668DA:pFLiRgAX5n9QYaAN+4XVwCGBbwhqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784446779, "uuid": "a1a35e00-82a3-4942-974d-32117ec8f224", "value": 1437880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784446779, "uuid": "ab7f0e0e-c98f-4815-80ad-4c1ef4043536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784446779, "uuid": "d770cf2f-0b97-4396-b493-968643ddb114", "value": "f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f4755a-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445278, "uuid": "43106ef4-b923-418a-a189-21ad7d80b6bd", "comment": "Malware payload", "value": "d8b8bd3049f2d28898d2e917cfd5ac8e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445278, "uuid": "45addf5b-86a2-4c28-973e-94136a1fc4d8", "comment": "Malware payload", "value": "f3fc5b4616bae1839e5239c9ec494dfdefa366c49b8ec5a7bc166821c174fa6a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445278, "uuid": "4f679400-9303-4a10-b25d-8f16f9c60b0a", "comment": "Malware payload", "value": "3e074e30b55306324b5ad49089ee2e2c20a0a911", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445278, "uuid": "24d43d27-c079-4b44-88f3-5ece1ebe483f", "comment": "Malware payload", "value": "d2a4442e14813575d05f097812fe8ffa5da5f4f8fa4d06bfbba93249ec28a89038f4912ac28b71229f743e32c940a0df", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "deyetechnical-com", "colour": "#FBEF80", "exportable": true, "hide_tag": false }, { "name": "hongyang2015-com", "colour": "#2B0D83", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445278, "uuid": "b55a6296-86a1-42ac-890d-119762c44823", "value": "T13885331C352BE982FA6D1E3C2707A85CCE4D46A8DB5714E58CA6C2126E5F1770F80FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445278, "uuid": "15598375-9e0c-4c40-b1e9-4e20541283f3", "value": "24576:UZLNWzdCD3/nsltjTMpD+6Vac1oGXgI97VzfkZJiyYUQ3iD/IbwzcrkMrZEb2Ejd:wLoJm2sRjxVzMniyYb32/Ib2EebKMN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445278, "uuid": "a159458a-057a-47c8-8bd8-4bfe262bf30f", "value": 1853972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445278, "uuid": "e5c872f3-e243-42b9-9aa1-f1c5633683af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445278, "uuid": "e8f7db7c-d500-4aaf-855b-6ccb81633435", "value": "winsconsx86.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93adaa8b-83a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784487400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487400, "uuid": "d8953b38-bf91-4c16-a21a-59617bd5d51a", "comment": "Malware payload (Mirai)", "value": "c01e349c77726b0a6c83801600f0794f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487400, "uuid": "59917a9d-798e-48b7-ba94-d9019a8c8ace", "comment": "Malware payload (Mirai)", "value": "f3fdbd51a85f2b42162c28a0840193da355dc0d67eccc3ae3badefce851d9744", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487400, "uuid": "474edb29-642a-4f01-97ff-e83c00e26310", "comment": "Malware payload (Mirai)", "value": "d73b8d6d9bf77ffe7ade5ce4fed35106395aae66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487400, "uuid": "edd97634-8bbd-442b-8acb-da0bb29842ee", "comment": "Malware payload (Mirai)", "value": "20c332ec16c1d25e2a26991c293ff0aab0810e304f96cc21f465181898cb919a25fea0e661e97ac1b959adcc4ae606a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487400, "uuid": "ef5fd355-dd17-44f8-b2ec-d5ebd64a0fb7", "value": "T1D6B3D746FD018F13C5C721F7FBDE42987A166F6DD6EA3202D925BFA037464D60A3A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487400, "uuid": "e7ee52f8-2091-4c07-8a55-38acad662b71", "value": "1536:7FQSfWynV8bPrS4VKGi74mtp7HEtACS0loklBHwywsWmb++W/gMCOxcO5tvchIH:7FQKhnV941icm8uBEf+YAchIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487400, "uuid": "c980a361-735f-4750-a7f0-99ece7474233", "value": 115340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487400, "uuid": "64d18359-99a4-4a48-a3af-b4b0eb4659d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487400, "uuid": "1318aa0d-ee7e-49bf-9e71-48b0272ae954", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa17d1b0-83a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784487572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487572, "uuid": "f678d9ac-7e0c-4646-9954-f7664d6164be", "comment": "Malware payload (Mirai)", "value": "ad1515a1c537a885853c7bc54b933cfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487572, "uuid": "8fe6853c-8fb1-4233-8e4b-e3e3e7097276", "comment": "Malware payload (Mirai)", "value": "f42c8f49b6056f9190da668b8fb649d0ad66377dcfa5cd2bd38353964eef6e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487572, "uuid": "fb64f7c7-d192-43f9-ae67-62c11b0f8696", "comment": "Malware payload (Mirai)", "value": "29e374e73b0cecda79c8d9a36a4b66b35b12163d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487572, "uuid": "d0c2a49b-c199-4712-92af-cb8d0f6a9c7f", "comment": "Malware payload (Mirai)", "value": "0d7e872feb0b3fd680bf49027a530c43c2d3c16f083445a23ed141916e63c2fca9b43a46f5048030fcf4c52e8200ee84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487572, "uuid": "61063975-f910-41bc-9809-80ebe582bdd9", "value": "T118B3E649F9429F01D4D731FAFB8F415532536FA8E3F97101EA206F6123CAADB0B66612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487572, "uuid": "ee1d2d80-6b9e-43f7-a3c0-89204177c940", "value": "3072:nmqyy2a9l8nVzg9hvaA5fpurIfvFUbX2xO:mqyy9+Vs9hvaA5ccFUbX2xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487572, "uuid": "072944ea-afa5-4bfe-a9d3-c684f1a30a75", "value": 108280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487572, "uuid": "ee139171-9b21-40fe-b54e-2458f3e22421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487572, "uuid": "e3043471-011d-4b35-b24d-bf27134f2c8d", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9f13f3-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784490529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490529, "uuid": "b23fe70e-e326-4e10-9e5b-6e426813e505", "comment": "Malware payload", "value": "82a6af75d84291499af897cb85b703f1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490529, "uuid": "2d30c166-4dec-4df7-b331-563dd839d155", "comment": "Malware payload", "value": "f483db0480f32cab641f20501d26b5d68c46092b558a11704a97192a83c166f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490529, "uuid": "ca6f8a55-f2c2-4ce5-8573-fa9db39ea58b", "comment": "Malware payload", "value": "d7e86b56f42e9252c31aaea64d4bb73d83520f58", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490529, "uuid": "08d8269f-8a84-4d7e-973f-2c9e95769e55", "comment": "Malware payload", "value": "3e7af174881e2cd6ac54eea05341ecf30c3e44432d4ecdb7f92366b0d0485e7dd6443987926d5cf8129503f3b26814b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490529, "uuid": "ce606cc1-66bf-4d3c-841d-7de83d5bc9fa", "value": "T130236C6516857C14AE99C4365C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490529, "uuid": "2e087c7b-c7ba-4df7-9499-bcffce6fff2b", "value": "768:nr9NyXsZztCI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rHusZYcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490529, "uuid": "657839e1-cb7a-4024-8cd5-1e9f0027f21a", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490529, "uuid": "2ae14bf9-9bce-41b0-b355-1095aa8d0f0f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490529, "uuid": "915d5995-99c7-4f94-ac17-f08c78777a09", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860fa1c5-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485659, "uuid": "4ea70d61-05f5-4c47-bb26-eb5444847893", "comment": "Malware payload (Mirai)", "value": "59a1630343059f66087eca84add68da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485659, "uuid": "a1613790-c2d2-446e-8988-5adb0d6a77a7", "comment": "Malware payload (Mirai)", "value": "f67e7c0cd158eba6bf1c0c37dc32c357e1645cd8420221992050f92ab8cd3028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485659, "uuid": "118e9d61-9d81-4618-9608-96a9a0146f5c", "comment": "Malware payload (Mirai)", "value": "a794bb39ae8fb03f919c7557dfdf4a2176a557ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485659, "uuid": "6cae295f-092a-4463-a45a-f9280dad09b4", "comment": "Malware payload (Mirai)", "value": "7d8db6c0a415c978f34b26e7f502117881c0afe1cb1fc71218214b13f016470a9794c1a4135fc9275a68c72b8b4641ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485659, "uuid": "0b28f7a9-a816-436f-a967-ef95c680dce6", "value": "T185C3F906B5519F02D1C221B9FF5E425A37136F78D2EE72029D24BFB0374A8FB0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485659, "uuid": "93568b4b-0d7f-4b7e-9b77-5487da9e82ab", "value": "1536:zcnEhYpP50YxWIYSocqXyBtJI/asAIA2BTi1mOWjYqIXpN+e56W4jE0m0SFFHXjn:XhYpmYtYPpX6QaHmOWjYqIXPsW4lhyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485659, "uuid": "9974b27e-6bf6-4739-b6cf-f451e7175c11", "value": 129036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485659, "uuid": "29af0337-ff0e-4e71-9e98-fc9d68a678ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485659, "uuid": "be218924-9265-4fec-9088-0655a668590d", "value": "SecuriteInfo.com.Linux.Bot.4042.9064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3d405b-8374-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784467359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467359, "uuid": "ba507124-bec6-4fd1-b1d2-c52848fbb000", "comment": "Malware payload (Mirai)", "value": "de1631cec6e9599738bfc47966115f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467359, "uuid": "b32506af-9773-43de-975c-e7877bcb2f83", "comment": "Malware payload (Mirai)", "value": "f6e6cac8ae44a874bd374c3cb4e064a4dc7d03aa0635b1abf24e10655f8dfdf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467359, "uuid": "80a5b8df-d6ee-41e2-a625-41ea95075abb", "comment": "Malware payload (Mirai)", "value": "110eaafe8b451f1f4c4a5d2648465307be3881c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784467359, "uuid": "f9624916-d784-4d9b-82ec-4623b7da3ca9", "comment": "Malware payload (Mirai)", "value": "c7138f448e3dd6c7b7d9dfae904e111d3988017b1a92f8ae9c68dddd1ad44da65f0f70fccac521d7ecd415f677e2150f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467359, "uuid": "46d1be35-3eaa-4901-b1e0-b81e943a8aa4", "value": "T1C6930899F8819B11D5D522BEFA1E018D33531B6CE3EE72129D205F2467CA96F0F77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467359, "uuid": "6f0d2422-a39b-4847-98af-87e706ad0e3e", "value": "1536:oHn3u+PYis4HDsoFFy4gJU1aq88YJqQT3YANlZMi0975vRbJZuYHSZs/AP:7MY+9jy4gJU1aq88YJqNMy975vRbJgBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784467359, "uuid": "43a61f9a-4892-403d-800e-4e30b6a3bddb", "value": 94824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784467359, "uuid": "9c70ad14-3aca-4135-bf41-1ec872a0e788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784467359, "uuid": "71d5e94d-f27d-4911-ba27-359800522696", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f87022-8336-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1784440664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440664, "uuid": "5a12fb74-0d9a-47e9-95b5-19950b34845d", "comment": "Malware payload (CoinMiner)", "value": "83a66686b40e1110de5065a45e273f80", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440664, "uuid": "9635aefa-f801-4e11-b442-5f584f7a6ecf", "comment": "Malware payload (CoinMiner)", "value": "f7fe0d0be53dc875f6101bce77f3314b3ee40319106fc87da06bf93e6c51ac8c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440664, "uuid": "88f993b4-5319-407d-bc13-a4869dafd30f", "comment": "Malware payload (CoinMiner)", "value": "b423d542b208e6df941ff5649179c17b686dce6c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784440664, "uuid": "a806b823-b9c3-42d9-b0dc-7c1feb749cde", "comment": "Malware payload (CoinMiner)", "value": "d5ca39da2b72d348708adaa08b6a6d2386243f4d3864163932f984ba4bd54f9ff11920f2cde2264a30fe8f644f2f4c55", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440664, "uuid": "0a176753-cd0c-4e7e-97fa-5d4efba6368f", "value": "T11D365C4BF1A360FCC1ABC434875B9963B931786901247DBB66D4DA302B33F605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440664, "uuid": "44f190a1-964c-4759-8ca5-a4897660b15d", "value": "98304:PRYwncOls75pK32jYOqBnziAGwaJh1wuKnT0uBNd6+eLSxkTCKRKSGpPTPS3f+SK:jeYow+uBT6BJKPmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784440664, "uuid": "c2d1f137-f87e-47fb-807b-f34c6d6fa3cc", "value": 5064720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784440664, "uuid": "bb3ecc3f-a56d-45e6-906c-dec516a79b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784440664, "uuid": "72386e0a-eb99-4ba6-8c52-e29a98850ee9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e344a5-8370-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784465474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465474, "uuid": "ab0a6d1f-730c-4021-a2d6-7a0a53b345ae", "comment": "Malware payload (Mirai)", "value": "0ebbbfa0b2f413a72be7582898a371b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465474, "uuid": "5d0ad648-1bb8-47b6-8af3-4d80938b0927", "comment": "Malware payload (Mirai)", "value": "f858f6eb62fdbf1c8bd7367799c5c519db9a5113afd2efdd3f18a30e36870816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465474, "uuid": "a8e73c3f-333a-4352-8dbc-222008e57b5b", "comment": "Malware payload (Mirai)", "value": "9a5b6ba02387dcb60df55496bfe753f64fcb9c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465474, "uuid": "7641ed1c-bd6a-446b-b2ec-030c7eda2164", "comment": "Malware payload (Mirai)", "value": "37e2f8ee3d93ce8ac6908a0f912d378689fa7113543773cac98f3ac4b97f061c5fc7382dc1152b2ec34e096071079fb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465474, "uuid": "6f64e3d3-eae9-41f4-96cd-dbfbe370c74e", "value": "T101734C32BA751D2BC4D4A8BA61F30325F2F2478A25ACCA1A7D710D4EBF2564032577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465474, "uuid": "136b2e81-6b02-4f8e-be32-716ef0dc32b5", "value": "1536:x1pS6eEvcW0L3FlT6QkKQ9dthXXN95YSgAWwth8/0p:DQmEBm/nNPHrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465474, "uuid": "8bd83e35-0e53-4951-a8e5-bd50f83d62b2", "value": 78688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465474, "uuid": "d70bee9c-ac82-4450-89ce-ff89592cc547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465474, "uuid": "059839de-1766-42f1-b057-6d5cbb7dd3ce", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af33204-83ac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784491063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491063, "uuid": "decc933a-74df-458a-b119-8a4afd71a0bc", "comment": "Malware payload (Mirai)", "value": "296cb1faf0f1a493787ec22f0689d293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491063, "uuid": "2fc9d7c3-51c1-4f8a-b65e-584ece0ff885", "comment": "Malware payload (Mirai)", "value": "f965b3068fd7d248114d9dab5a3e1f5d3d578560e4bd46a1b1c9b2724ac33ecb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491063, "uuid": "b11a6aeb-4ca2-4c4c-a1ca-b1d76deb306e", "comment": "Malware payload (Mirai)", "value": "60a9292adbb61ab7ea0c3474bb26f14ffaafcc09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784491063, "uuid": "4360d026-c867-4f65-a50e-d65b71abcea7", "comment": "Malware payload (Mirai)", "value": "c4f425d85a82646a4414daefe9b5e610d35c2da9663f3855b34b2af0582a6070b1110e35527f09b482dfaa84bdc62f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491063, "uuid": "3a87f422-ce8d-4a90-9bcc-04dfd5cfd323", "value": "T10C831995B8814B12D5D512BAFE1E118E3323177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491063, "uuid": "de751baa-34c6-477e-b584-1f40fc06d483", "value": "1536:yjn63Wezi8kIQ14B/kkMlrGaOlFdQaM6ifu7G3SfPw7m+Y5mY0s/At:DFzyakZlrGaOGu7G3SfPwi+Yg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784491063, "uuid": "abfb60c8-f212-4526-9cf1-85f9722a810b", "value": 83660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784491063, "uuid": "4940732b-0257-4202-b094-7a87a977d77c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784491063, "uuid": "7ecfc7de-0b62-4824-b643-7dc25056e4a2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7aa988-83aa-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784490400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490400, "uuid": "c0d27531-d652-4f7b-b97b-7b70f97cadce", "comment": "Malware payload (Mirai)", "value": "2c9e58d2dfd5150184d466ec4af02a7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490400, "uuid": "9ef3b9b6-808e-465e-af36-f90279d22ee3", "comment": "Malware payload (Mirai)", "value": "fa0aa2833f8e946ebbba25bbead2f6bc26ca4968d289489b7953abc8065c339e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490400, "uuid": "da3373d5-0c8a-4109-a38c-dc5a49b902a8", "comment": "Malware payload (Mirai)", "value": "c84de2f727c80c2f35c5faf9a16ae3278cca180b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784490400, "uuid": "5a7843fd-c623-42ea-9fcf-bce09ed4a5a8", "comment": "Malware payload (Mirai)", "value": "502bb9c4e974a810925f6e43b0d1da92ef4fd1831ac084142d8b698296afd6d33271e303ddfd4a48831583b8be6eedde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490400, "uuid": "ea61b388-2ca3-42df-9bed-b3013dfe83cc", "value": "T167E34A49FA57C0F0D2D344F1063BEB9A963A9D116173F5E5FF663A62F8B1301288626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490400, "uuid": "279f51bb-8435-4b67-87a6-2e97f0219df1", "value": "3072:LpLQ+QXw85mqmP/ePDqI3aNuFfWIIFKplE:tQ1XuKD/sMfSop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784490400, "uuid": "3ef97eab-d50c-4f22-a4c4-a97dca3ff8bf", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784490400, "uuid": "acdc08a0-8c2c-4554-948d-515b0619f60a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784490400, "uuid": "7d1abd4a-f13d-42c8-941f-434d13bbf409", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb08c1e1-83a3-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784487573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487573, "uuid": "5109d9f0-2430-4775-b226-b2a5eae9c04e", "comment": "Malware payload", "value": "ccb4aeba7c6afbc3c2611d0c440a9993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487573, "uuid": "bda9a829-dd49-4670-8359-9453670dc942", "comment": "Malware payload", "value": "fa53ca26be6f566f25087663526d8fbb5d081f04ebb4ea8c2e4bcdc7d0811d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487573, "uuid": "5416fb79-7a44-4f70-8800-085d7a80a953", "comment": "Malware payload", "value": "bec3a6b687df25ff3cfc8bceaec51bef301f6f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784487573, "uuid": "706218ce-c109-41f1-aa60-c62145c43c91", "comment": "Malware payload", "value": "bd2882822ef4899fe3ce0ff4261de88d4c79bb47ce345e26b6ea34236b088d792afaeac47695a7e54ca60c5f9a58ddaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487573, "uuid": "f6fc394d-87bc-41d5-a1b8-79133ebe7a6e", "value": "T147B3E6026B0D4F03E1432DF4377B0BE0879BBD5628A9E680751AFEC993719F1A506E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487573, "uuid": "0b995eda-e102-4c90-a71f-a3651e269aec", "value": "1536:aLy0A4HjDfYgxSiqQlRiaFkxeFq3rzUvAkWCWv61KDDlgdNOqPKZLf9:G3j3xnlZkx93r1kFX4D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784487573, "uuid": "7ccd1aff-ec92-48e2-92e5-9b8004668a47", "value": 117384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784487573, "uuid": "1bfa3b50-88fe-408e-8154-c0a3df184b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784487573, "uuid": "58ba8b3c-22d5-41a2-91d5-2dbececbe73b", "value": "eclipse.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d99a92b-833f-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784444252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444252, "uuid": "258b4300-4868-41f3-ab84-819acfc4c9f2", "comment": "Malware payload", "value": "57c102ed0adf792402c7e7e071435ed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444252, "uuid": "e6c9755c-c7b1-4318-9e2c-f7e6ec18653e", "comment": "Malware payload", "value": "fa5ca514a361c589e5879dc42c3b0d2b86d14cdf39ac3e0ecc6d8605771976e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444252, "uuid": "98d94560-ab29-48d2-8392-b536e8b2b9c5", "comment": "Malware payload", "value": "30b05cb4df09750f8b4c8126a6b87a7b016d22ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784444252, "uuid": "54f76a54-f9e8-408d-832b-6d540c39f642", "comment": "Malware payload", "value": "b025720c9135350ed6ee105dff7f67600673dd9c2ef9acf031aca595a0f0ac2578d8079c0c2c0b729961a08d51158fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444252, "uuid": "7e52fc68-103f-42ce-8493-d644be40e8aa", "value": "T12683182AB9419F05D4D526BAFF1E934933536BBCE3EE7102EE141F25278A91B0F2A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444252, "uuid": "1f7ca6a6-8b93-4065-a593-a4c2f2a6ad19", "value": "1536:D2nLoSyHqYu1kE5PynmIXeUhDIzLmP7fNzVo/lUu+hllZ1iD9p/vOAY:4oSOakac/dwmP7fNzVo/lYzY9puR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784444252, "uuid": "d1ad51af-d4f6-4eae-9a4b-af098363f149", "value": 82364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784444252, "uuid": "3bd51331-98a9-48fd-8f5a-279f6a270b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784444252, "uuid": "f654c5af-9130-4986-bd4a-f55d1c0689ca", "value": "c3cS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019e2805-8341-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784445064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445064, "uuid": "5900eb15-2c82-49e7-a454-255cbd4ab1a7", "comment": "Malware payload", "value": "5cac832ff423f8eb20e26cf02dca41c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445064, "uuid": "d2163b16-f06d-40d3-8c72-e4ee9324dac0", "comment": "Malware payload", "value": "fb8c3315722d0d2d78d08278774e0b03d334b35cfd59fa2d2a6dd21fbf99b347", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445064, "uuid": "838a5741-511b-4ea1-abd4-b8d95a11c974", "comment": "Malware payload", "value": "ddf2ef2c550e35d764caa99fb8247a78cd26e56b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784445064, "uuid": "658deefd-d81e-461f-bacd-46047333aad2", "comment": "Malware payload", "value": "c685e96ff9c75b7b17260bf84e7e998d137e56cd7788dc6915cec4e18a96166619f28eaf1f3dd772035ad3912e481425", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445064, "uuid": "2341495a-db66-4ae6-a1fa-3e967e5e6853", "value": "T1BB235C651A857C14AA98C4361D7F2F0CB9AD43E6320452EE7FCF3CF28C9A6AD910572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445064, "uuid": "3173cff0-1f60-4898-b4d8-ee9bf2ebabd3", "value": "768:B6Utd8/i9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Wcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784445064, "uuid": "92316deb-5e6d-4688-803f-f0fc6076e60b", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784445064, "uuid": "699fe3f1-76f9-4a0a-903d-72087f3981e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784445064, "uuid": "bad1e858-8858-422b-9207-2e41288ea07a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124f8d4e-830c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1784422329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784422329, "uuid": "f9dbd6ac-7dd5-4405-a2a1-429b01d01522", "comment": "Malware payload (Efimer)", "value": "a77aa4a0070fad1d7448c6f5f100c592", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784422329, "uuid": "56518327-4b73-4cb8-b881-51b73a0478ec", "comment": "Malware payload (Efimer)", "value": "fbfa869a9d6e624a4134e6c44baef0987d0c09f4b9be3ec95295f77599e4f566", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784422329, "uuid": "bb00a783-09c4-4676-a3d9-53e05df6e0d1", "comment": "Malware payload (Efimer)", "value": "53074580821f3ee3226bbd4dafb837657b40306e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784422329, "uuid": "4c6c0b2b-7fe8-4fe0-b59a-9731ba3f10ff", "comment": "Malware payload (Efimer)", "value": "578524952de9d727840d8930979cb3a37e27f52cf212c5b1a0585e1e7634bee84cd1ed54fa7a03a5e1c01ffa3a784b2f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784422329, "uuid": "fbccbe10-9dfc-4066-a7ba-5562f9e62d24", "value": "T184E63348BAD402FEF5B2403DBAF0A6A5D876B4660375C59B0BA057B5BC072E04E3D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1784422329, "uuid": "967a7606-b893-446b-8746-b1a8a29cb0d1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784422329, "uuid": "a151bc24-d97f-4af7-b3a8-2dd943f0da1b", "value": "393216:96pKTPfb4NIwxA7CRDaXIXMCHWUjXNcuI3/PGTAI:96nIwxWCRDaXIXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784422329, "uuid": "904acd6c-767c-4628-86b6-205bbca6cf61", "value": 14319913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784422329, "uuid": "df969b6a-39fa-4f16-9b8e-0d12ebcfdd68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784422329, "uuid": "b09328c9-ec18-483b-b908-6c3dee1c0abe", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73d9ceb-8371-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784465985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465985, "uuid": "bdf81817-b1a8-4f69-a8f9-678b5b4fad55", "comment": "Malware payload (Mirai)", "value": "82d793fd4a60afeba89b57a774650b93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465985, "uuid": "7801d8bf-2f59-4f85-b377-732bf19ce983", "comment": "Malware payload (Mirai)", "value": "fc29d400dc813809a579fb218e278eb27f0e56a949b26af1d88c0c3ff069ec4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465985, "uuid": "5342b189-c28b-4615-aea1-6637fa0168b5", "comment": "Malware payload (Mirai)", "value": "3d440f01abcabb2c5907b2cf09b6b89d3b0ce312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784465985, "uuid": "455dde0e-9f4c-46c7-9699-683b3e21b9ff", "comment": "Malware payload (Mirai)", "value": "78766b66183d4fb775a55c3dcb7bd5ae46a73b36d6da654a6d0e00505bb5b50059cf87b59e72464b6489d8bcdfc247c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465985, "uuid": "a6bf00b7-57d1-45e1-9d01-445422513856", "value": "T198C37CC2B20D7EADE5933E7CC10A17176E1C9A519C83450250B5FE072AB76E71E36ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465985, "uuid": "abbe5ca6-fa49-4c04-aaac-fc36fdbb58b2", "value": "3072:nTykX+7ydkBqit9PaKcTKk3gGrEzslUv1giMJCQLLjyotO:2I+WSaBfQGrqnv1gRCQXv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784465985, "uuid": "db403cb9-13b4-4c40-9df8-0c5a9f766c82", "value": 125268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784465985, "uuid": "6f6756ef-b365-4f64-ae67-e8c636e6a878", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784465985, "uuid": "0df4e5f9-0a84-4797-b9db-88aff6f92076", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7aade24-839f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1784485716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485716, "uuid": "385a6d32-a9f2-4028-85ea-9b9d93d59ff5", "comment": "Malware payload (Mirai)", "value": "91055ebbd9177b234fbcbd09820ac030", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485716, "uuid": "fac35daf-bf13-447f-b403-a04412ab9d68", "comment": "Malware payload (Mirai)", "value": "fc387fa281c0c50428ffde7c5fc517d3855b8bf21583efb20188484f297d3848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485716, "uuid": "04e22359-dd4e-4bd5-8824-747f865f7005", "comment": "Malware payload (Mirai)", "value": "622674996122bd9fba96a938724fd43317574176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784485716, "uuid": "95c8f008-7efb-4184-9fd6-09c77c816372", "comment": "Malware payload (Mirai)", "value": "6b37b3e654cc2fa47635fe313a6413399e2dc8c291207cccffc18661db202c823e2165eb42649ec7713e1d7a5a533379", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485716, "uuid": "23c76fe1-e02e-425b-8d8b-1a4181d4d94c", "value": "T1914301758F21AC70C450C8B2AA2B1311E5CC3FF5E3F637B2BA7482DA66C8416742C64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485716, "uuid": "e4515fba-ea6e-4f7b-8012-42f396d6cbd8", "value": "1536:GNv7pF/TAeipa+WKIEDyDD4uvacrIXrlBYc/SfW:0v7jse6a+W9GrRqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784485716, "uuid": "f3b5a9f3-fdbe-468d-8539-3894cb12f46b", "value": 56492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784485716, "uuid": "cb6824f7-e159-4a95-a74a-5c2975bf8009", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784485716, "uuid": "b5f45c8c-157e-4f7b-b5f5-d3cca7b40b70", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1c4b3c-838d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784477858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477858, "uuid": "94629c0f-5e1c-44fc-b6ac-6730c6b2edbf", "comment": "Malware payload", "value": "1da19651edf19ba96e321e209487b6a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477858, "uuid": "6152eb90-1860-44fe-a011-18db5d536b83", "comment": "Malware payload", "value": "fd94807d4eab8e8c05abff10610a8c2718ddc3a86723417c1f50ba4fcc95da8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477858, "uuid": "80dbc14e-1676-485f-8494-c11a0885f037", "comment": "Malware payload", "value": "e8dafcac553aeb7693038e950ad0c17bfeced4ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784477858, "uuid": "3e224397-af30-4f6e-9957-e8ddc3151eb7", "comment": "Malware payload", "value": "2eb121b870b6a64480329c1672fa64af5c2545586f7bc3f180b2dc5252e790526ebd3ceb88372182ea0707f4afbe114a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477858, "uuid": "5d24a8b6-0f27-47d0-8099-42e93a5078ca", "value": "T15DA30782BB43DFB3D84314F112B74B358B32FC3A8826DA95E3797DA589161D0A61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477858, "uuid": "620c28b6-d9b5-4e76-92d0-666e27ffc1ab", "value": "1536:7/QFRTg+b/IzD2uWM887ZOqn9QliRaX5sKO6I3l:rUgg/IHiX8lOqWX5Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784477858, "uuid": "38a4d8d2-59d1-4130-826d-d300ffeafef8", "value": 99704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784477858, "uuid": "6789b3bb-6fc0-47af-8be4-3d823ee080b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784477858, "uuid": "fa872005-123b-4a88-ad8e-6e5f8c968671", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb9bfe7-8338-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784441249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441249, "uuid": "92049843-be02-4687-8dcb-689eed0bc0b2", "comment": "Malware payload", "value": "fbc5a4dec8c14f3cc4bfec935926bc9b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441249, "uuid": "0fac8d54-e9c7-474f-b1af-898abde69cc7", "comment": "Malware payload", "value": "fe3b7afe2287109d62bc1c8901d311579e07fb63966eb86e2534338fb3dd17b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441249, "uuid": "a1bb7783-4209-4746-8380-9766b7b400ed", "comment": "Malware payload", "value": "7e9558262c39db26b4273409ec15d3922fb5f836", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784441249, "uuid": "7bf590a5-23a0-4d03-87f2-a0d6b73c1b95", "comment": "Malware payload", "value": "38e10bb3f2449685ddd007538b5cbd0d3f9e554a40d6aef738b21c642a681c65f91b4c1db952188c515dfd34af3f90f9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441249, "uuid": "3e6caabd-6a79-4187-badc-8be8e62a1f6d", "value": "T13541C6CA20A10D76EC63D8D3325D8C1735DEEEDB94CABF2998ED36E6408EE0474116C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441249, "uuid": "911c8dc1-91c6-4091-ab52-381b1c745ba5", "value": "48:SyR1yZRyLfyF1yzXy3y7yPy7yfyK9WbybyA:SyR1yZRyLfyF1yzXy3y7yPy7yfyfybyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784441249, "uuid": "721c3596-aeea-45cd-8bbe-2210e7062c6d", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784441249, "uuid": "c2d92940-cc5c-4abf-8eb5-e68e4e97c201", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784441249, "uuid": "35154e3a-ca00-4a9d-b596-1059b3c85fe6", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083a9e48-835b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1784456242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456242, "uuid": "21991732-cea2-46e8-aad4-ba9edb3f3c03", "comment": "Malware payload", "value": "a897df00206b8674331346a50b03be36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456242, "uuid": "000d731a-0b36-4e9b-89e7-174e12de4873", "comment": "Malware payload", "value": "ff55377fb0950b4cf0bcadd773d97f9620e0b70dc9c98dede82e48fbf98d6f31", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456242, "uuid": "ac973bce-1329-485f-98cb-a4b7df5036f3", "comment": "Malware payload", "value": "ee3049182a00405a141397aa9e53be1cfc8abe4b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1784456242, "uuid": "ba4ef1fe-2537-409d-bb04-a482ca1c21ca", "comment": "Malware payload", "value": "2d2ab2c25473bdcff4886fb1af539b7fd9a727ce10b38d74b5e9c2767195241d093f8500b428914d3cdd017deb389d61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456242, "uuid": "5bcd2edc-758f-479e-b798-dcd357145db8", "value": "T1D4C27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456242, "uuid": "494f02ab-ec8e-4764-a9a1-eecefcfbe006", "value": "768:E8vCB+25j6es8RVn9FYpMSUpi+20qUpi+20YQX:E8l25JVBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1784456242, "uuid": "ea5ed072-b5bb-493f-820d-9f7ff386d7da", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1784456242, "uuid": "35f1ee70-7db3-4f97-be20-5e414e528170", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1784456242, "uuid": "808eed1f-8caf-40c6-bcac-8b3ad3bde88c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }