{ "Event": { "published": true, "date": "2025-11-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-27", "timestamp": 1764288181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0abec2b5-2aef-44dd-866e-ed5e5ece9040", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292556c6-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241605, "uuid": "90b0df3a-1057-4d6a-ac29-2c8673a1dc2f", "comment": "Malware payload (Mirai)", "value": "d1cd98f810b4bdd65c4712f00e55b9bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241605, "uuid": "f65ab223-192c-4e83-902a-023775f11a85", "comment": "Malware payload (Mirai)", "value": "001a48b245f236fae410254d66aa0d36593571aab7110abfb325f2a60a65ecd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241605, "uuid": "98d8631a-b50b-4df5-aecc-32a52814c276", "comment": "Malware payload (Mirai)", "value": "bb8adee655905fc3b17f94534ae7f8d1199e591a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241605, "uuid": "cbeb883b-f027-46b1-a125-e910526c84fb", "comment": "Malware payload (Mirai)", "value": "0eb13c6260ac451e27eac26722717ef5c0abf986cffc24efa0ba59c85643ca30758b7a9a038a850b58392d4f918154d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241605, "uuid": "90296484-570e-4eec-959d-ae91e1e0fa3a", "value": "T1996302BB870146B5C8AE9931664C0B821D7E1E7130E2E455349CEB3B0D5FDA4FDE3A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241605, "uuid": "001bf841-1590-4501-bad3-3b1338e1818f", "value": "1536:YoFQZb7PdiRIXIfSPxyI5QBkoeqG8XmolABpIPS1LMNVJuQ:YGob7M2ag/5QKohG8XjABpIPKLuVQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241605, "uuid": "605984a6-6748-4dba-9c72-aedebc1962ad", "value": 68712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241605, "uuid": "100a3929-ad71-4b2b-b467-8eec047e3526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241605, "uuid": "27e0f964-b156-4ec7-9f02-f13a4195783d", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fcce0f-cb84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764242827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242827, "uuid": "7eb0a437-5bc8-45c7-b84e-c39ea5188e0c", "comment": "Malware payload (Mirai)", "value": "df48c8e5e1a94e6e2fab83de0cf60528", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242827, "uuid": "327f5e65-74fc-4e41-b235-3868f5026bc9", "comment": "Malware payload (Mirai)", "value": "0062e163eb52df01884e167525853ba2863f5e97cd4760ddf4e4d3b1c92bf0dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242827, "uuid": "9c0ad6f9-fc7d-4a1f-83eb-a795a2919f1d", "comment": "Malware payload (Mirai)", "value": "436b868b1448a498791c4a72be82f2a1829b67b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242827, "uuid": "6cf5da40-fdd9-443c-9f66-6ed86959f097", "comment": "Malware payload (Mirai)", "value": "77f38e956b76b85a993dd5a22c0671b50ef922c74ea71d17c22bb7abcc42795adb3ff4083661865515ff828d0892c195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242827, "uuid": "f6276200-5bd6-4665-9071-e6e0e8e05b7c", "value": "T17D33020E93AC56C0E67C2271F0E77DD2EDD6853876AD416928DC1363BAA85F1DB1430E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242827, "uuid": "8b4c244d-24b9-4a59-a3a0-694f4314d48a", "value": "1536:URjBZmTSVaVbsTrxTBplwZE1f8BKCLnouy8Hy1:UBv4SVaVbsJTpgoutu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764242827, "uuid": "66ec2dbc-b8b8-406f-b7d9-43a0e32aad89", "value": 52372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764242827, "uuid": "81125088-665f-4219-b562-4b4535f0a66a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242827, "uuid": "1d5c37a4-c6ff-4b91-a108-256595e6e5ab", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5abcb76-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228526, "uuid": "086bc72b-14bb-4c7f-bf24-ae8f1e9829f3", "comment": "Malware payload (Mirai)", "value": "e3be5926703936bccbeeb753b8ca3693", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228526, "uuid": "4eba5d99-5bb1-47b7-a152-679c4da4ed48", "comment": "Malware payload (Mirai)", "value": "020b3c9a83e311f217adeab616042f0cd5a9b391ed9a48d8099ef7504885ddd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228526, "uuid": "5eacd56e-7d86-4827-883e-2562196fd6a4", "comment": "Malware payload (Mirai)", "value": "d702896fbf181af5630d95c6bdbd44e075e8e5d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228526, "uuid": "70689300-bda8-462f-9ee9-8ac01493f50c", "comment": "Malware payload (Mirai)", "value": "fa6190ace34446ce84040ba68962abb11ca54dab6ae8c376b43430eb7eb759eb6fcba045a41b61bf2298b37d863b25e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228526, "uuid": "09bedc5c-4c9e-4d29-aba0-511a79b0cfd8", "value": "T17C73852BBB72DF77CC4ECD7306AA4502108DA54A12D92B6FB6A4D52CE34BD4E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228526, "uuid": "70078258-071e-4fa4-98eb-9551cc8ae9f4", "value": "1536:WeTi0+xZfXeIhfMP9lhRUrJgZeRrQN0blNRnB:KxZfXeIOPolgx0bl7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228526, "uuid": "42fa2f7d-2809-4fd8-bd72-fa1e69821e7a", "value": 79636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228526, "uuid": "9528ae43-55ee-4354-a889-f5df5a6d30bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228526, "uuid": "14f544f1-1a9c-424b-b60a-4368ae3716d3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1a222a-cba3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764256212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256212, "uuid": "27b6ccd8-a126-49d5-8cc4-2fdf913fb25b", "comment": "Malware payload (Formbook)", "value": "8db0c1ecfe2a304e6386b3cacb341c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256212, "uuid": "289736b2-bda2-4478-867a-d4de9c119a76", "comment": "Malware payload (Formbook)", "value": "04a594d99ff1450bb488f2a3c47a49c9ea59e16fac5a23cc3e4b44d7bddb53c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256212, "uuid": "a0ccc840-1180-4f8e-acb3-3fc016c5899e", "comment": "Malware payload (Formbook)", "value": "c5c4ffa985bce0a46211d129cd7d382354c3bef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256212, "uuid": "84ce4326-12bf-465d-9322-b628b3d8fcbb", "comment": "Malware payload (Formbook)", "value": "b8c59c8b48acdd289b99dbbb226a4d9e36b2130d8720479ffee1e5e98f27d70d74877410bf01892eb1f91a3a255041da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256212, "uuid": "88715f11-b14a-418c-9ab6-66621cbdc939", "value": "T158F401182219D803D5A66FB41D71F3F42B785E9AE805C203CFE97EDFBC7A6566805382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256212, "uuid": "c5c80ef6-a48e-4a25-af2d-2da457f74939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256212, "uuid": "c3ae478a-e51e-433d-8102-96d7c343b5fa", "value": "12288:NOPad9pTcszvDIR3+5OX05ED3Eq6vy8UYYGhW5rTtM+JRj2rpOe5MMJbOPa:gPcTcszIqw2Y0q6vtUY3+PScArpOe5MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764256212, "uuid": "937075cb-9cd4-4539-bf66-c153335d565d", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764256212, "uuid": "5b1188bf-347f-4279-8411-2d079f9d3eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256212, "uuid": "041571b1-083d-4e11-b0c4-b321ac1ed7ac", "value": "Quatation Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c137e2f5-cb88-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764244866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244866, "uuid": "62bf51d1-9847-4e83-9cef-7a29a45ac50f", "comment": "Malware payload (Mirai)", "value": "bd9c2c84dffe42ec019461621334ab00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244866, "uuid": "143ccaff-e142-4011-a977-ad11994eaaa8", "comment": "Malware payload (Mirai)", "value": "08de72197ab706663a4c5f08fd17d44318af88e7617e999994bbcb6c09c91038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244866, "uuid": "480d803b-3db0-4acb-a763-83dc40ad16c8", "comment": "Malware payload (Mirai)", "value": "ed0b1b0e6cd1a01b97ba2c410b167ad1c4f19819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244866, "uuid": "254a9c34-dccc-467d-b5ee-a994932af7d4", "comment": "Malware payload (Mirai)", "value": "bf7395d157eef8d35c84f2967ddc48e653ed55da01264fd7df50486df2ab5fea4ccdef09d5747c9ba4826d5f8297b698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244866, "uuid": "787a6c55-6fc4-4c5d-b86e-7545f0301052", "value": "T1A224738AAFA03FFFD85ECC374295CB09159C490A1298BF766A74D418B68B10E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244866, "uuid": "5f4fb917-53c7-45df-a8a9-e79ee26a9113", "value": "1536:DxJA8HUE20IYGaOrVNN8no3Ekw4V9dsqt8fi07bDrbcewKH2twh0qSTmsElSdn5S:DkCxqTa6/lt8fi7efVh0qSZn5yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764244866, "uuid": "b738491d-871d-4afb-8a7f-adfac68be72d", "value": 223492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764244866, "uuid": "50735796-f5ff-44ab-9578-74bd3f6ea547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244866, "uuid": "b372affb-9ce5-4112-beaa-201754d7bd6c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4552cc6d-cb66-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764230055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764230055, "uuid": "c5603593-b198-49a5-9920-419519767c39", "comment": "Malware payload", "value": "c1c3fa2eef6b33afd0af5ff4e31695db", "object_relation": "md5", "Tag": [ { "name": "172-67-168-243", "colour": "#BAFD5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764230055, "uuid": "986f5c9d-cb97-4380-bc97-d6b85c30b2dd", "comment": "Malware payload", "value": "08f3d4ac28ea1b1534af30e27f996ece8f22c31776bad2ed5e23bc4a220c0dd2", "object_relation": "sha256", "Tag": [ { "name": "172-67-168-243", "colour": "#BAFD5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764230055, "uuid": "21ebd7b8-0edb-4e2f-80ba-6f87fb89e0cb", "comment": "Malware payload", "value": "fd076ac2862fed669fea6ba8a29f70049af9daf8", "object_relation": "sha1", "Tag": [ { "name": "172-67-168-243", "colour": "#BAFD5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764230055, "uuid": "75dd1570-75be-4c57-80f6-625f8470cd31", "comment": "Malware payload", "value": "739f97f065b8b1bf4756b4a6a6cf79c0a709c7a50a29b05a029e1452479c6340cee982550b1c4481caff498f39ee7a2a", "object_relation": "sha3-384", "Tag": [ { "name": "172-67-168-243", "colour": "#BAFD5E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764230055, "uuid": "5e48db84-dd13-4929-b3d4-f08f022fa503", "value": "T175564C43F85190A9C0ADC230C66A9352BB3278A5473073D36B55BEB52B72BC47E793B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764230055, "uuid": "8225de78-8fce-4771-9430-3b12b7cdc748", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764230055, "uuid": "d17f7ad8-649d-4a3d-8049-eb7b2e0b188a", "value": "49152:XDBU6OBVrb/TXvO90dL3BmAFd4A64nsfJQ53/mkMjhOCOS/p+2wsB/rD89Zja46s:XDgz5PUFZ+Kk2465ZHHh2cnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764230055, "uuid": "56b58143-7aad-48fb-a65e-8bf1a98b4487", "value": 6202368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764230055, "uuid": "d0f8f2e3-0776-4037-bef8-4c82e9ddc45a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764230055, "uuid": "3f90606d-8a37-4823-8e4e-8452bf7978b4", "value": "08f3d4ac28ea1b1534af30e27f996ece8f22c31776bad2ed5e23bc4a220c0dd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e21663-cb91-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764248718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248718, "uuid": "7ce55e31-4931-4a95-80d5-9893971b1105", "comment": "Malware payload", "value": "7202248fcf1d5793983cfaf80edfbcee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248718, "uuid": "703c0c47-0960-49dd-81a2-2d36c4bae179", "comment": "Malware payload", "value": "09647fabb086acf09fdc72f3e8703c77c65e27fa52de14c9976389ef1bf4a843", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248718, "uuid": "822dc228-3b03-450b-9352-838c7bac7d8f", "comment": "Malware payload", "value": "c11324a7bcdd5daebb3d7eae4fffe56afb4ed414", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248718, "uuid": "312fe9dc-588c-4fcd-bda2-1c28f4cc2bc0", "comment": "Malware payload", "value": "646a5b38fb81b24ac6fe82329ba2d5ce6451551ca641896eb3eb082a4c27e8c4dbdece9f46e46fcb68297887eeb9b875", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248718, "uuid": "cb308681-8cd8-4b9f-85f1-4505aee36979", "value": "T1FDB5986D1281B22EFD4EA71FF8A15D58960937AC756B2D8DF00C328C631EF4491A4DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248718, "uuid": "1e456495-62c2-44de-870c-c0de13929f74", "value": "3072:fJN4n76N4n76N4n76N4n76N4n76N4n76N4n76N4n76N4n76N4n76N4n76N4n76Ns:STKV1awY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764248718, "uuid": "b0863996-ef1a-4c23-a022-67a30f38324a", "value": 2421023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764248718, "uuid": "1a0249e9-c79f-4449-9df3-a8b30577bcc8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248718, "uuid": "c15927be-ab70-4706-b2e4-5050c14834a2", "value": "CamScanner-Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e5009f-cbe5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764284554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284554, "uuid": "4da30d16-21a4-4000-943b-d8f81debea10", "comment": "Malware payload", "value": "2b8d9d0cffbe3740b52a348eeb1e7d56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284554, "uuid": "9ec4182f-55bb-41a5-95dd-08f7361a3536", "comment": "Malware payload", "value": "0a3f011df49b29a40af51a682ea1e3c10a0629ea4d9174fc7c9455eaf2ab440d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284554, "uuid": "35587f27-3d97-447c-b357-1caa956ed0e3", "comment": "Malware payload", "value": "21e02ebfeb66873b1fc11808c3082bbbe4629ed1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284554, "uuid": "6fe39483-8638-4a8a-b165-be17e48e2ff6", "comment": "Malware payload", "value": "bf72da763d84899db150e9fe7258416fb541fde6a7bcfa798be30fa32813be7a2cf4b89721c72946e013cd9472426f7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284554, "uuid": "9c04a951-5f58-4402-ac6e-59e1a92dd033", "value": "T1FD73B70A6E769FADFB6CC33587778A259748739227E0C641D16CE9005E6034EA41FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284554, "uuid": "e7fdb58f-08ba-4b21-a236-e6adf5fc198c", "value": "1536:f1j3kxYORkAuxYqpoDoCPC7o/zKA6qSyvUPvlZPvvwralbtmuggug7RFX:hUxlR+EPJKA6qbGmNgugXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764284554, "uuid": "b3f2d788-f1ea-4805-810b-f52a6712ca70", "value": 80076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764284554, "uuid": "177fc8d4-f20c-4f3a-83b0-d302b5976783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284554, "uuid": "494ccccc-96a0-4d8f-8a1d-562fc932cd00", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5572e0-cbb3-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1764263299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263299, "uuid": "5857f275-4598-4e39-89c6-2881ae86598a", "comment": "Malware payload (ACRStealer)", "value": "a0ca49e5687a97c450f315b6fa1b6161", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263299, "uuid": "babc9bcd-4671-4020-a8f3-ca5f738c5fec", "comment": "Malware payload (ACRStealer)", "value": "0a5f07bba72afe6d78126f87467ad8c1b6cf086dee17e64bd7734ca60922af2c", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263299, "uuid": "6f2928aa-8c2c-48b9-9851-81731ba3e4be", "comment": "Malware payload (ACRStealer)", "value": "d25d15381d94eb4281c66b8923d132ef2fd243d0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263299, "uuid": "b4d3b809-08d0-4256-9e5d-23fc9600decb", "comment": "Malware payload (ACRStealer)", "value": "b23f3a59ee58887c0b4d7170bed40b4aa0c587d055a4609d086e8c2b906382b98e626e4a8b9087d14107ba4a9e25486a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263299, "uuid": "cb5456b8-ecb7-44e4-ac20-d7d98d7ca4f5", "value": "T1D4163381FA86E2E2D843A5BA3C0ECD8128A17C3FDF9199E1857C7E340D32D275D65DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263299, "uuid": "cd12bd9c-9d1e-4ba8-afc4-ac8cf3930e30", "value": "98304:w1rTSOQJjSi/8cGsiTnTCnjdvA4IjXh1fALlQEArJQ+tC:whxMjETKjPQXHbNrJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764263299, "uuid": "c16dd297-660e-46bc-8eab-6a0067f876fd", "value": 4190208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764263299, "uuid": "49ac2b71-98e9-487a-a1a2-904a45609829", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263299, "uuid": "ed6f739a-500f-4add-a16f-c598f03d31c9", "value": "TUFPCCFS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a32df-cbbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764267923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267923, "uuid": "2d41c428-fcd6-4b02-a0b7-2e0fb5ca6b65", "comment": "Malware payload (Mirai)", "value": "0b2b0c16ef121ab81569d6016a25626d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267923, "uuid": "98d1d1cf-8609-4310-937e-ceb699fb04df", "comment": "Malware payload (Mirai)", "value": "0b09202817c1f89d42a2d88ede4a2ebc402b64c32ed50bd763bb9cdd1a95de48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267923, "uuid": "50d45774-7089-4c4f-8c2f-d0e38e6fc3d3", "comment": "Malware payload (Mirai)", "value": "bdb810824489e28ffe0a91849fff0b7f8aa781e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267923, "uuid": "59079078-bb77-419f-b5d4-9a8c5fe8868b", "comment": "Malware payload (Mirai)", "value": "9f1661a80146667f93282f94d4c2f896a75f2cc2b4e60373071cbc0704a90a258d36310ac807d7ab15216a598e29f0fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267923, "uuid": "fd5a0479-ffb7-4796-80a2-386c3411259e", "value": "T15AA67C4BF5A358ECC09AC430475FD663A931B89542317E7B3694AA342E77E305B2EF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267923, "uuid": "8d9b8076-2e7f-4f47-b75a-e4e621c13be0", "value": "98304:0xo9rBIe6uK1JcVb28DTYtxeOmJosFNQ98s9PEqlWmEfpIawQW0OZkG4ckRUa3op:0PuKpE0SUa3Gn8gMB+5qNnIFzAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267923, "uuid": "49fb6ab6-b27a-491b-b3ad-3af797b6d2a6", "value": 10171080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267923, "uuid": "d63cb26c-6653-46ad-bd9c-8c658b63fca6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267923, "uuid": "8dad5885-6a19-4b44-8727-6df34bc658d5", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aed718-cb5b-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764225226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764225226, "uuid": "ac6560f4-b250-482c-bd27-8c61d593c7d7", "comment": "Malware payload (njrat)", "value": "3b206ef37a980e40addcb184288f6421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764225226, "uuid": "21022e7e-9316-4a37-bd3f-08271297949a", "comment": "Malware payload (njrat)", "value": "0be718f7b7a74c02cb6e13cf89c32e36e3385d3c8d6bf11459e8a43afafe4ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764225226, "uuid": "f8c9f880-2a6f-401d-a746-c32f78c7adf7", "comment": "Malware payload (njrat)", "value": "e27c54ebe66568f6f438080db7b1a9b4ff23c598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764225226, "uuid": "94d1532b-6319-458c-8439-bb494305ca41", "comment": "Malware payload (njrat)", "value": "a4082605710e56e362942dabff8e9005984ab296b4232d76a1ea6703f219377186d5e1c1bc1d8a4bc496a076f9e2d4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764225226, "uuid": "7b33e63c-5c34-4ffa-9a7c-b10399d6ad38", "value": "T145A401A827998F37E4B957F22431F33153B96E4EB552CB568FDAACDB7012B011A40B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764225226, "uuid": "c018cf60-736c-4e81-9e0d-fdc2d8966057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764225226, "uuid": "3d629b4f-f32a-4578-9089-267a1037be5f", "value": "12288:/LURSkTqNc4YlYfBo1zKOxRGZTjSYL4X:QckTqXYUwKfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764225226, "uuid": "394d96d9-c0ea-494d-a81d-b8c0bed64a78", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764225226, "uuid": "ac219239-8e29-4854-99b4-49a4c3e019ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764225226, "uuid": "4b034671-f558-4db1-84eb-0c613f749c8e", "value": "SKM_C364e25062711130651646556565655656565652626565626556566565.PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c33e93-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272840, "uuid": "a7f63293-2e75-4d2b-8e57-94357c987cc6", "comment": "Malware payload", "value": "f8ea271552118b139871acf7ced18a6b", "object_relation": "md5", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272840, "uuid": "d8f93718-d07c-4c25-b781-cddc48c963d2", "comment": "Malware payload", "value": "0c2ea5394269f3d0c95c799e4b8741c3b392c09d330ad4d375994a16cd1ffc8a", "object_relation": "sha256", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272840, "uuid": "7d6855b4-0913-4f19-b55b-21a7b170e560", "comment": "Malware payload", "value": "8070a88826912844a652fda6afeecc45340496ae", "object_relation": "sha1", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272840, "uuid": "a54d2e5b-de37-43f5-9c96-d1259371545c", "comment": "Malware payload", "value": "3c01091d549d41ed29b305a2f23d1d0868f38abcffd1ab738cb5cbe8acb9c012016a8f05a641f5a8303305c90cb9326e", "object_relation": "sha3-384", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272840, "uuid": "ecd5da71-0c55-425a-acd0-d874b18b64ae", "value": "T1801619136953CEA6C89A9235F89261D5BEA4BC0C0B7436E31A507F22DE7A3C80D7771D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272840, "uuid": "408efd65-2b98-4efd-a0d1-a31058fa8832", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272840, "uuid": "f404203b-d2a0-4f2d-9b63-9a36dce71744", "value": "49152:cbiKyeydeW9qlxT0M3QeESF47A7PW/Xa2pa6sF:cOXl9GIAb32pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272840, "uuid": "b6784169-f46a-4ea0-bbfa-166bb56c1eb3", "value": 4368384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272840, "uuid": "7484b53f-d551-4113-9968-17c833d7f08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272840, "uuid": "8afe26d0-70e9-4e0d-b780-3b1c979294a2", "value": "download autodesk fusion 360 full crack_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606b2629-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223658, "uuid": "3e6d517f-ad8c-4282-86c2-0632676c6184", "comment": "Malware payload (Mirai)", "value": "e03ed48bf3a9a7af9d7555eb16d2bed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223658, "uuid": "a82b8550-6b2c-44e2-8e3b-ffa53a13056f", "comment": "Malware payload (Mirai)", "value": "0e863586c6e109b114296ac0fe683f11150aa2d1e37c968ea4cd9e002f385876", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223658, "uuid": "f3718a22-2cd3-4fd5-92e5-66f83c5c89d4", "comment": "Malware payload (Mirai)", "value": "10abfcddd47a2dfe4f14997517ae91a96ca32cec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223658, "uuid": "9c4e19a3-4e34-4629-8ff3-fb9582a37604", "comment": "Malware payload (Mirai)", "value": "0bb1c2a90ca70911e62876e26d3713a0105084ea47c228adacedc36da666448c3fe4956a457a4e17ada6fef9c44eb305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223658, "uuid": "0cd1e676-1dcc-439e-91a7-012eeaa6c4e8", "value": "T16EC2E1644228D472B4B45436FEAF0503A736CFF8D6EF362611244734E097D26A6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223658, "uuid": "6b4a2450-e061-4a9d-bf4e-720611924455", "value": "384:VH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNwWCHhymdGO:QyNUQUfhQllxlaH0MFjlOnGsJSs3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223658, "uuid": "69606efb-7b11-4660-806d-c0cdee422696", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223658, "uuid": "c82c5ca7-dda9-4366-995d-3e6a61eebcb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223658, "uuid": "74344256-68c0-48b0-be29-1330d01d4ec4", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ced23f-cbec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764287907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287907, "uuid": "988e3787-3e11-4031-a945-46fd9d631041", "comment": "Malware payload", "value": "d2af91d7cf1c4ca462a1401fe3251a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287907, "uuid": "2a3abee8-1f1a-4e34-af13-2801d9639158", "comment": "Malware payload", "value": "10368a193e39747dcfb153f22855b40f0a8ce4ed4319e2892d2dc860cab73e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287907, "uuid": "e163fec4-f765-4ab3-b275-48a1e3561465", "comment": "Malware payload", "value": "47e55ef071df39c800c1fc78dad8cf698d20b78d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287907, "uuid": "9a1dbdb9-a200-44a7-8cfd-d08bf4099d74", "comment": "Malware payload", "value": "2519718cee070bb132843549e79feb8f94039363ed14101a17da8ac2039276944cc3eb1c1bcb17975ab2053485bc2240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287907, "uuid": "2718652b-cada-4b46-a4df-11c81e8de491", "value": "T1C373A449BB654FF7DC5BCD3B09BA5B0428DC950A21A83B367934E818F64B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287907, "uuid": "66b2b653-5821-469a-b063-dcc7182d9327", "value": "1536:pX84CmLuocMfsSQhy25XGsxL/aCiJdMCfp2svug7R:pXh/uo7fYhLpxaVvug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764287907, "uuid": "3e2df43c-719d-48dc-96b6-1ce4bb2ce4a2", "value": 80444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764287907, "uuid": "d482a9ba-bd77-49d1-9cbf-cfd53bef81f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287907, "uuid": "d9dbea07-dbc6-4ff5-b326-f0662d6ce8da", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f9ad7c-cbbb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764266852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266852, "uuid": "61e53024-754a-4c01-a98c-eeeecd7a8fd9", "comment": "Malware payload", "value": "69f566a1dca842fcc3ed2b060c4fa42f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266852, "uuid": "d2b525d8-4c95-4a03-8607-475e6c6299ec", "comment": "Malware payload", "value": "112744f8530952b42f35cf2bae011044c0ff36666e1ea00cf26f68982ce651dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266852, "uuid": "865ef8e2-94bf-4bd7-9ee0-eb70ded7c7f3", "comment": "Malware payload", "value": "89453502df91bd71869a121cbe6208fc3ef06266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266852, "uuid": "c7b329df-8595-425c-9107-ed3ae858c18e", "comment": "Malware payload", "value": "b514b1b1e2ff35004f0dd422ef38cb8d4e456c0002da84feb474fa468b71eef53e8844ea8fd058a65c17a406b7f8fbe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266852, "uuid": "18ea7efe-0f89-4183-85c5-63b0aabf82da", "value": "T10753029C6DB2E47ADDF0C23EE138A605D07A84BACD809A6376B6F3401D29D0EF571803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266852, "uuid": "a6a30e5f-e6fb-4795-a8e5-ed3ae6d7e57a", "value": "1536:pdtsVUMJtEyZ+NJmllXU0U4+8UxQh+zwO5iFdubfs+wx:oUANZVltU0U4g0pO5iCbfs+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266852, "uuid": "a54a6ce3-3f0e-4394-b9e9-00df1fdb0ac8", "value": 66676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266852, "uuid": "b2a59c74-9301-47dd-98a8-3f1e69058746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266852, "uuid": "74985d50-9634-4c5f-a9d1-a650aeb18f44", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2210d9-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236992, "uuid": "0c32fada-fa49-4422-9658-05258f274065", "comment": "Malware payload (Mirai)", "value": "ad09f882803550a51abf4244464eb235", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236992, "uuid": "976c0b3f-c86f-4a3e-9cae-720d2010d9ce", "comment": "Malware payload (Mirai)", "value": "115b01daefac4160916c22fad9593a1b1e07628c13cc7e44c308f6b15a9a0fa2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236992, "uuid": "0728aa87-dacd-4920-8b38-d72ac4fbdf45", "comment": "Malware payload (Mirai)", "value": "f5a8118485536c95c37ba686fcea423cbab584c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236992, "uuid": "9d1ecb17-2d72-4b6f-944d-e6d23781e8ac", "comment": "Malware payload (Mirai)", "value": "e7ad2d6dc013244ca57eaf917fe77270fb74aa6bd4c5149c7aea59c398411962ba9a895259948e1ac30aa395baeae1f3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236992, "uuid": "01828930-5b8c-437a-b254-0ece3115a682", "value": "T1A36173F6014807356CE26B97627D404D7296969740FE7F22A7DC2CA44D8EFDCBC41663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236992, "uuid": "5ffcdbad-e3db-4fed-b891-cd1106d6fd44", "value": "48:/w9/P9/dGVVw9u9mw9V9gw9G9mw9o9Sw9/89/UPFy+w9rV9rJh+Jw9b9cw9E96wV:/ypdGVVe7Cgy+UPFy+fJp0bukT1JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236992, "uuid": "f39564af-48c9-4819-9e68-975925bdcbb7", "value": 3210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236992, "uuid": "0e614e44-f632-4f0f-ab82-c6d54593d5cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236992, "uuid": "e01fccb3-e545-47ab-bde2-d407eb837e4e", "value": "2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb2580f-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764251246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251246, "uuid": "d304795c-d6d0-40e1-b57a-97408a8f29fe", "comment": "Malware payload (DarkTortilla)", "value": "04af1c4aec86d87069eacf8038586afc", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251246, "uuid": "108f6cce-2be9-4438-b31c-8ce1472b99ae", "comment": "Malware payload (DarkTortilla)", "value": "1196557e1f036847cb8f0f941fb49d6e9b3daeebc9a1bece45e12a737ea52c94", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251246, "uuid": "e3050f8f-a5df-4000-be1d-c85d639fa1b4", "comment": "Malware payload (DarkTortilla)", "value": "6a494f14284772b6b352aad4d907d8da5ba242ec", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251246, "uuid": "3e65f49e-dd2b-4646-a12c-23dd35326a9e", "comment": "Malware payload (DarkTortilla)", "value": "416ce2d06e5e31b7840d5727af38d7e8d35022188fdc2a4b21ab90c7600bfb3087aef054546bf33ed7f02399798e6d4c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251246, "uuid": "644cdef0-4c13-4727-8909-0f03af90c348", "value": "T16525339CAFA6D9042B1FFB56B7AB331A3431833B6715C402DF0F4A83269467277B4685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251246, "uuid": "05dc60ce-1153-4b4f-b477-9a38da9a0def", "value": "24576:/cKzZZ9dCJvCY1ltNSPLZb94R9GHvnK/jAJLGqk/82:EKdZ9dil1LQ9b946Hf+jUD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764251246, "uuid": "1762e101-bc99-4ece-93cd-d4145283361e", "value": 978739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764251246, "uuid": "449b9b4b-d7a0-4d0a-b426-55418bfa99ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251246, "uuid": "1f0b4201-6eef-4cf0-a2a1-af112757e3ec", "value": "Orden de compra n.\u00b0 2025-835436899DWSA[65kg].com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa752be3-cbeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764287482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287482, "uuid": "e8aed8af-9a53-4e4f-a638-ae3a6cac9145", "comment": "Malware payload (Mirai)", "value": "05881177359317ca1228f760cb7583c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287482, "uuid": "a2cd04bb-5d1c-45ca-a140-1f76c62f2751", "comment": "Malware payload (Mirai)", "value": "13406e67427da3d37792ea50d4360812d682a79974eb6d4b4718f2cb94390488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287482, "uuid": "6c36d10b-af66-48f8-ac61-7b1aa44541ee", "comment": "Malware payload (Mirai)", "value": "1948013ad45ae450981a6974db28cd24c6aefb9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287482, "uuid": "cd693c53-949a-4286-98c5-e052fbee41da", "comment": "Malware payload (Mirai)", "value": "57ef013119b4fa95860702dce397253d15fef6091d75e8f7e240b4f98679f185487f9d9445faf95e556d081fc1a53b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287482, "uuid": "26a8edcc-04d9-45a9-a192-1727f70ed4f2", "value": "T1E983F74ABD819B15C5D922BEFA1E018D335317A8E3EF7212DD115F15378A92F0E7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287482, "uuid": "e18cfa09-850e-4283-8c14-b2f8883cb67e", "value": "1536:Gxn/7GVmHsD+2ShkseqiyTmcKLS2n4HW5p3YA/QodlwbikaCws7ltug7R/:fEHNhksziOmcKLS24HW5p3YA+mCwKlt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764287482, "uuid": "e264d5ca-4f2a-443a-8b9a-95bd407e328c", "value": 84460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764287482, "uuid": "6c4a45a6-c872-4bc1-91ba-4b33f301d3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287482, "uuid": "161971eb-d809-4f47-aa4f-1640aac320c1", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03823e50-cbdd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764281055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281055, "uuid": "00c38141-f78f-4768-b550-1266b2d863f3", "comment": "Malware payload", "value": "2660593ed035e771265562a437611887", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281055, "uuid": "e9271928-85c0-4ad0-9c47-62c07b13d914", "comment": "Malware payload", "value": "146f0175c40cf2e538c25733962a76aa422e66b7d5a7c732cca56c709eaeccd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281055, "uuid": "f9a6ca4f-a340-490d-b098-d948e59eaed4", "comment": "Malware payload", "value": "f0aa00d496dcff1d6b7a02355ee445f91c41dbb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281055, "uuid": "1109503a-dcbc-4a6b-8afe-ed184f955d6e", "comment": "Malware payload", "value": "851adace0f747093dc26dd80354db9d1da61e0d60ebde9a8ed584e2b1d481d8baf448afb3d14f7c085cf4a0a47d6bb38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281055, "uuid": "acf1eb24-aeab-4f4b-b964-89422f284159", "value": "T13B936BC2FA83D0F6F85304B24037E3374732E439502AEE56D7699D36EC629419A2B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281055, "uuid": "b163571f-b446-4375-8a63-1b102da8436c", "value": "1536:MWgsqhLUT1+X+IHVKjeXnXzGAV3d3eczA2W2O4EES7S9ahS:Mxsq5UTkX+PjeXD13d37z6r/WohS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764281055, "uuid": "70f547ad-8f11-4804-b886-f656446eda9f", "value": 96488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764281055, "uuid": "71e39004-086c-405d-925d-abefbbc570ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281055, "uuid": "1eb24569-6ac0-495f-8b44-b3821c74f26d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95289f1b-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764234484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234484, "uuid": "117e8685-9450-4532-8102-2938fff20d96", "comment": "Malware payload (N-able)", "value": "ebd8a2b0a92d65932ab67f84a50cdb60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234484, "uuid": "4f4f27c2-3edc-474c-ac0c-18e340313bba", "comment": "Malware payload (N-able)", "value": "14e81837a8343a96a70c2ec52539a78b13f083eba9ceb91f2f0c029a7ea833b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234484, "uuid": "bc769d6d-9f68-44cb-b1c3-4fa233df37a5", "comment": "Malware payload (N-able)", "value": "f3ce3aebab2c7a8620fffa8f5952124cfa69d241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234484, "uuid": "5db5651b-40a1-4bd7-820e-23f4f24c0603", "comment": "Malware payload (N-able)", "value": "1171b3d7dfdfa97b76e8b9d5171f4487a28a147d1d3a4c5c7fbe34208cacf10e1e0da4aaa55b8180172d0114b472ce11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234484, "uuid": "28e1f2b7-c594-473e-8f82-2d6d7015ed74", "value": "T113E633527C88DBBFD4212770C6419BB7529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234484, "uuid": "18b54c17-2320-459e-8ec0-7ab0611ef1ca", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234484, "uuid": "83c55587-73f9-4186-96a6-247a329e8b04", "value": "393216:E8F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1G:frRxvoC/7a0jUxX7h1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234484, "uuid": "142405d5-6148-4b56-a19a-ff2876780761", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234484, "uuid": "5bbc7e1a-337c-4916-a623-4de56194a5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234484, "uuid": "0b70b5c3-5c88-4d46-aa0b-4d8e202801a5", "value": "voicem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c64e34-cbc6-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764271533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271533, "uuid": "247ef9c9-362e-4f63-b2d0-d4d4defd2bca", "comment": "Malware payload (njrat)", "value": "e88d98ce073f13e144ae9714c459521d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271533, "uuid": "f3d0369c-395e-4890-88ce-3cd950d4697f", "comment": "Malware payload (njrat)", "value": "16c85ccbc4bd049f6d77c4be926f9b29da03bdbf8da753336242cf802110161e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271533, "uuid": "27a05949-bfd4-4af0-90bd-c81c37c1480c", "comment": "Malware payload (njrat)", "value": "27ec52b66ae49b0ee45b3f2bd76cf307e3b34f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271533, "uuid": "8b872cc1-2ffa-4527-ad3c-3fdfa362b116", "comment": "Malware payload (njrat)", "value": "43cb5370a44ea664bbe0dd2b6319b3e4e29a62a3bc2eddecbf35afca2243fbc42a4179d9aca9fd7c0be1b9bda2b2dc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271533, "uuid": "b7f0c478-dbb8-40c9-b382-c718fcf0ae70", "value": "T172A423652372C18BD9A52FB118F25E4DF6E9DA1904A0B38F3FD05745F8A22C3121EE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271533, "uuid": "4e81ca94-7b13-4b03-9912-4e8fd7b21b1f", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271533, "uuid": "fce0b9a0-c05d-4183-88e4-3c2423513b33", "value": "12288:PVbWcMuaGO8QHPG2xt2H3fNvSmll8kI2ImVzOHIgx1c:P0gpAfotSmlKkXzOoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764271533, "uuid": "6737136f-a049-47cd-b118-7ddd08b3187d", "value": 491056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764271533, "uuid": "9cc01c26-f0a0-4be0-a7ab-041c7aeb51b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271533, "uuid": "979c5d5b-2378-4ddd-9511-899e2162c81c", "value": "DRAFT DOCS RSHA1568060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff818ac-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236865, "uuid": "b37bcf05-83ea-44a5-8325-3eeddab552df", "comment": "Malware payload (Mirai)", "value": "135bbb0caf9cec503be8868dbc8b676f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236865, "uuid": "b75fdfbc-3f2a-45e5-88d8-a9d807e13858", "comment": "Malware payload (Mirai)", "value": "177855572b18035ea4e6b5670b352028be6b382c1ecb67fbfff8d6c9a60230c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236865, "uuid": "08e894fa-cfec-4110-b69e-d91de149f2ca", "comment": "Malware payload (Mirai)", "value": "fa868e73579e930a7aab401fd79e9b71c73c6833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236865, "uuid": "70e16d64-8aa9-4b7c-b002-6891398554f9", "comment": "Malware payload (Mirai)", "value": "ab3e3888460426df1663a945098b9e302d001cafe3b129a0b0dbd5f917cb3e40c3d34fe3ce50252cae6620b300079e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236865, "uuid": "63a48854-eef3-4833-98a4-9fac0849ae0d", "value": "T1C823F1789D3E8467C80259F54F3203111A9C0BA706C7CD91B288A5EFEA8349D7A87ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236865, "uuid": "14a960cd-d9df-4d96-9f7b-78b3b5fd1e26", "value": "768:O+jm/igUe0HCLCO63QTxr4p8c5zQbP/sdY7vZciCjnn1hVT4jKxeHSxhHAc+j0lg:OFigU7M6q4mc50b867miynvVTaweHSNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236865, "uuid": "4a1ae34c-fe8f-4afb-bf42-8571f8854cc8", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236865, "uuid": "01fb8091-fba0-435c-8de5-f9e3cf5a8a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236865, "uuid": "4363c39a-ec42-4dd3-be3b-7433dca5d950", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed02f41-cba6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764257479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257479, "uuid": "21bb5486-cd80-48db-a875-f2b47d4068a4", "comment": "Malware payload (AgentTesla)", "value": "b10584eb0bd88e76ad1c507f75fe5419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257479, "uuid": "d64de0ef-0ab2-429f-86fd-49e2ae57eec4", "comment": "Malware payload (AgentTesla)", "value": "188ee25aa973a2fb98b0206036db3830297c8f3533fd2bff75d9a669628d1dcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257479, "uuid": "42d2a8d3-7128-4b9c-8adb-33aa7c80fe58", "comment": "Malware payload (AgentTesla)", "value": "b815afe745cf50c0d680f8b03c138108489786ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257479, "uuid": "3ecc3388-b3ac-432a-ba87-6110c17eaf75", "comment": "Malware payload (AgentTesla)", "value": "6632395de517826bc3615c451c738667366f7b7b87387c2f2382ba674d849b6fae7d141c0343618c449fd99b48282805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257479, "uuid": "66052e45-c33e-4780-874d-02a7964e9b71", "value": "T151E423EDB0CC408388E86E315C5A1A6C31DF4E68DB7F6174E9DD4A09DE970AB811D4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257479, "uuid": "0c04822e-e0e4-4980-baea-9cae6fa966a3", "value": "12288:QwASnZGONjOBXTQHEUxXWZga/DBgMo596k8bc9SZJcFQhLA/OE0hWOdyquuidcez:QRoZVjcVNZTdgg7PkyEKhWOsRuJeOpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257479, "uuid": "098632a9-0f2e-48b8-b2f5-65da4dc3e51b", "value": 699176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257479, "uuid": "9052597d-3070-44f5-9d3a-25458d4083d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257479, "uuid": "abbf75d7-19d6-44b4-9db9-88b24a64745b", "value": "nNoviembre_2025.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38d93a1-cb85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764243555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243555, "uuid": "1216a7b0-63d0-49c5-89ae-567946ecc546", "comment": "Malware payload (Mirai)", "value": "ae80a979d05742bfec9cea6bfa12698d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243555, "uuid": "9b6279a6-9934-427d-8986-d41d7d2c4d7e", "comment": "Malware payload (Mirai)", "value": "18bf3f07b630adddb6af8893a7ac59fd6e091749b37b1e95d4aa7bb2ecd35fe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243555, "uuid": "65bd04e8-6472-4b6a-906b-9409e27b4858", "comment": "Malware payload (Mirai)", "value": "1aa33d3cc8bdf86a0c391bbf12d08da126cf7341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243555, "uuid": "2573355f-c469-401c-968c-f2041b8fdc60", "comment": "Malware payload (Mirai)", "value": "be9df1071319bae4ead3249fe88f7ac56d9d2209784c168dbebdde9d828ccbb734b6244ca8621716f52340f2a3ba823c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243555, "uuid": "426fcfb9-a87f-4d1f-9f31-f256f7d42a36", "value": "T1E2E49E98FD4E3D42D2C7E37DDF4587A1212BB5E4E32382B27981025DE4DAEEDCAA1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243555, "uuid": "dccb275c-5cfc-468a-8303-5a504657d6f0", "value": "12288:tpkU6o+uMt6EpssOh2kj7bAx5U4n0HmIIs591LFG:tpkUJ/EKhXj70nUZ5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764243555, "uuid": "6b4e0feb-b422-4381-9f2f-b504b82c75a2", "value": 706976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764243555, "uuid": "6bba11e0-c578-475b-bdf4-2dc40964de74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243555, "uuid": "7f4b8dd4-9429-4e91-b1a8-c4ba214e8b81", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4875d-cb7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764240515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240515, "uuid": "0a11c2b1-f064-462c-a880-3fb5826688fa", "comment": "Malware payload (Stealc)", "value": "31b858a23beccb6ac6ef087fe752953e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240515, "uuid": "afdfc331-a2a0-4e1d-98d5-39b65d5983f8", "comment": "Malware payload (Stealc)", "value": "1a6905fc790998c7bbea610ee70cff1cca93840ae4b33f6a1967a070f56ad2c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240515, "uuid": "e6de32ed-94ae-4a83-b307-d68b67fe0eb9", "comment": "Malware payload (Stealc)", "value": "17de58dc59ac6af90b68b2caa0c59eaf6d0752df", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240515, "uuid": "a2e6ffe0-ae22-4422-9a2d-8dd59b140fac", "comment": "Malware payload (Stealc)", "value": "19655400959718bbeadb9b4875e835b707a134cdb324c6b7a98c58a8319c7438f2194b35973f44be5122e9767320405e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240515, "uuid": "574219f5-729c-41bb-9da6-27f2c9c185ef", "value": "T1A7251237FB03B1E5D5E845B29CA946B32612AC1707400F77A2B4B6252CE532B7B37936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240515, "uuid": "b40311f1-12e4-4eff-9d64-7af200309d09", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240515, "uuid": "5df12461-ffa7-4deb-a6f3-9a2debd39ac2", "value": "24576:fd4jSQex+gLYcahpTUoEqd9bU8nbwutrEXNYo8xw:F4ZgiNEcbZMutrEdYo8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764240515, "uuid": "8bd1b6a9-f814-4e05-85e4-e66053fcb0c7", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764240515, "uuid": "be675e05-f101-40b3-8595-fdbec7449c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240515, "uuid": "77b5a3c2-4b03-4766-b2ec-51bc709b30b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6949262a-cb77-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1764237417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237417, "uuid": "c162d5d9-51a7-4169-bf93-1416834fe8e4", "comment": "Malware payload (LummaStealer)", "value": "0969fea706d082a95ba4fbbe5b61b236", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237417, "uuid": "8f9511e9-3c8a-41aa-8069-e55f6944797d", "comment": "Malware payload (LummaStealer)", "value": "1ab81856c74c631b8953ccaecc74b2b87bc2805b5bf228710c078bf86cae2d13", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237417, "uuid": "e6460bc8-7dcc-424b-bba7-50bd74b7e6d7", "comment": "Malware payload (LummaStealer)", "value": "8f4ccfc6c38c532cb9e87138902b1a473c797fb1", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237417, "uuid": "18aa15c4-ad63-4509-93fe-8206bb0bcb42", "comment": "Malware payload (LummaStealer)", "value": "62c9fb00e5acb334e88796a24922953891f0722fc189c79885b2e04b884d489bd605c8282461a4c6e9e12f68ba96a9b1", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237417, "uuid": "7211620a-c202-4a92-8abd-55f6e1b8c883", "value": "T193E54C436C95CBA6D09A9739BCA351D2AA707C084F3423F31E61AA761D3A3CC593772D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237417, "uuid": "0fa0ef3c-21f6-4543-8a89-a5ff17867eb3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237417, "uuid": "f7a5570d-8516-45f3-8cca-5748df7f67b7", "value": "24576:SEWw8yQLbMbi4Qb92vGIXCV5ERpu8iLAE45Yhhelet29mFalbua5bqsx1jd:SEZxQMbi4QEvGIXCV5ERpu8VRQBM5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237417, "uuid": "2cd193c3-622a-4f33-8c8c-603bec0cf2d8", "value": 3316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237417, "uuid": "8f865d28-542b-4141-9087-2c4bfed805de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237417, "uuid": "9225efcb-e09a-43eb-9e28-6399a70ea011", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347d56da-cbbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764266534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266534, "uuid": "bc062c3d-a7db-4f14-9f35-d3431f0a103a", "comment": "Malware payload (Mirai)", "value": "ca30bd327b5c5949b2f9b26093f12251", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266534, "uuid": "d75d07c0-54c1-4b79-8457-d0976de0859d", "comment": "Malware payload (Mirai)", "value": "1c25ee26d0cae6b747760da303079ba55b646360b5ff70c792a2387af731b444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266534, "uuid": "c23d2039-7fa6-41d6-aa11-747ba6286f6c", "comment": "Malware payload (Mirai)", "value": "5270eaa6bdd849ec791fb246b9b95a380e97b7b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266534, "uuid": "b5ed51d2-b419-401b-821a-64829aa865ba", "comment": "Malware payload (Mirai)", "value": "1226e3cb777438104440b5a30f2f21e9f458acfcba29ee0b213ce12ed4e1dabe139eaf79ad74be91840a4acbee3f560e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266534, "uuid": "70092e99-8cd3-4dfc-8780-5db8c6f0d841", "value": "T1EFD36CC5E68FD0F5E85215713136F7365A72ED3A023EDA83D3A89A319CE3981D61A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266534, "uuid": "5fab5b9d-aaca-4c12-9d88-753a8677e090", "value": "3072:yPQLV7AWrEFFrpX0KjV87L56vnEo3sGeTJ+D:0QLV7fEFTrjVZs9F+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266534, "uuid": "33c2cabd-f2eb-4202-b9e9-474f3f692e3e", "value": 141676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266534, "uuid": "ad5ba63e-1044-4d6b-881b-5d37c385d5e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266534, "uuid": "89bab88d-10c6-4ab4-80ca-d240c0590470", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8ecf28-cbe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764286335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286335, "uuid": "dfeb5c7c-9d28-4d86-abba-47c0fbef6260", "comment": "Malware payload", "value": "d287532464aab94b3cf444f83d7d6939", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286335, "uuid": "95d7e51d-d9b7-42ab-82e7-cee8840575ea", "comment": "Malware payload", "value": "1d508ca205cf76817d9ac6e61fabe3f581b024caa99878dc9790dbc6216bfdcb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286335, "uuid": "52d2c9fe-3de1-400b-b19f-9fcd45bd4556", "comment": "Malware payload", "value": "877704447b9ba95c04498f1c62d8b5daea8c329e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286335, "uuid": "095cb7b4-7a52-419a-80e6-6a519f2c5fdc", "comment": "Malware payload", "value": "6274b94c811213dd80eca08dc84559e3b1b7ca4f3ed1493fc0813afc61ce3e8252f8222536de19305c95e89696708616", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286335, "uuid": "523d9012-a0c6-4b25-a49a-1a7b9771c107", "value": "T1BE63D104A2C15FB5FFB52D19E07FA18E13FE09C286206DCDE53A7A1D2BDB2C8525E254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286335, "uuid": "1ddfc232-850b-4a08-a6f9-2371ed6a63fa", "value": "1536:vYyRPOPdacLgK42kKPbk9/XSbjDrJf0EleAmPgUU0NCZiyp:vRRoYcMl2JPby2XOcexPgUUMCIyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764286335, "uuid": "c89d6cbc-037c-4aca-a387-e09e8f4f0185", "value": 72824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764286335, "uuid": "9483b24c-73e4-4582-bc8a-919811ec63f1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286335, "uuid": "524aac55-9b01-41e2-8a2b-3c0d34ddc063", "value": "kryo_crypted_fgow4o24.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f5f479-cb4c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764218910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218910, "uuid": "43aac4f7-0fe4-4a03-a2c0-1b6f09a4a145", "comment": "Malware payload (Mirai)", "value": "df4d79e6089fd8b5169fdbd902066650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218910, "uuid": "2371a40b-3971-4d87-ac2b-0ceac1989669", "comment": "Malware payload (Mirai)", "value": "1d8cf78db810074e5aaa9c9257547ad3e22b1d473fcba704016847dd42616ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218910, "uuid": "9256d4fc-133a-4b72-b177-23905b2362e0", "comment": "Malware payload (Mirai)", "value": "8ea156c343bb0c49aad8ca0f2ca3d19c3fbbafdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218910, "uuid": "181129d2-4d0b-473c-8f58-83c0a2695bcc", "comment": "Malware payload (Mirai)", "value": "4bd5756f83293b76f33825cbc3fa9f6173d8fe35de0024163bb5d841e57b340bf3096d80d4955860b0900d9176d58ce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218910, "uuid": "6f717120-7fdd-4e69-bab7-6910d4c9dca9", "value": "T1AD83F78AFD819B15C5D922BEFE1E018D335317A8E3EF7212DD115B14678A92B0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218910, "uuid": "b9ba82c2-b5a0-4517-9905-95e0575a3128", "value": "1536:ONnhbAiT0s0pKV8uZqEZQZ9Aixc1Nf4oXQOdlMDiHGW2jhtug7R:7E02V8u4EZQZ9Xxc1Nf4oceGW4htug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764218910, "uuid": "97669ea1-f28a-4201-a1df-7e63d986e636", "value": 84720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764218910, "uuid": "ce3a271b-c2ee-4a5b-b76f-c949a9dea04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218910, "uuid": "4b37aa47-6fd3-4e85-a1f1-76cc69d78738", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72990e7e-cb30-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764206938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764206938, "uuid": "90d3b0a4-aae4-42b7-8a17-ccf3e7c2cb4c", "comment": "Malware payload (RustyStealer)", "value": "ec94090082acb2dab2bc11ec4427ea45", "object_relation": "md5", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764206938, "uuid": "22838c64-dd8e-4a93-85ee-ab62c218aa69", "comment": "Malware payload (RustyStealer)", "value": "1e5d38b9abc8b13463e988fc005b83b34f7f52c5f0923c79561f61a57e4fcfb0", "object_relation": "sha256", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764206938, "uuid": "9fb90d8b-970f-41b8-bf04-eaa6e04af1da", "comment": "Malware payload (RustyStealer)", "value": "07a280123c3dd05a546898c60866a74e5ccee61b", "object_relation": "sha1", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764206938, "uuid": "fa262cec-48cf-48e4-9dc6-2f804d08da0d", "comment": "Malware payload (RustyStealer)", "value": "db922d95288c7a64a891492a748200b6e1320c7eb4999a1ec6262cbe53b5dfbe30e4dd67ffd99cbff0631f218f9684f7", "object_relation": "sha3-384", "Tag": [ { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764206938, "uuid": "06c999d2-8253-49e3-bd3b-73e179ddf753", "value": "T13E76BE79E47CC62DCDFEAA78D54FE03D36F67BD4B3399A1A0085E830E992591150A20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764206938, "uuid": "057074d2-eae9-432f-a604-3e8bd9894631", "value": "c396ab4704055b33617f1d0f14aa4491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764206938, "uuid": "7885b121-2cc7-4c3c-9c5a-7656cfa8a3c9", "value": "98304:nLG+QYDMdFDtNDD6Wdx3lRkYBmiTTqPUdaBYsp8Do8+T9gjfmIL9N6U9DYjU6:yFNxVRkYBTEW+RgjfmImgYjU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764206938, "uuid": "ea19526a-bf80-4ad9-a5c1-ebfc36455bd5", "value": 7680281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764206938, "uuid": "a55e690c-89bf-463a-b0d9-1757c879b203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764206938, "uuid": "cc43bdd3-9bac-46b6-8c86-f520e23c4601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bc8ce4-cb89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764245355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245355, "uuid": "b5912f66-1b05-4cdb-9fcf-b35764acfd54", "comment": "Malware payload (Mirai)", "value": "d1acf58b9f5a2e7d316102242c1a8781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245355, "uuid": "1fdf0f34-92ac-4e70-8196-357d1a15282d", "comment": "Malware payload (Mirai)", "value": "1e7972ba7de42b3f6da6ff91586c878ff9af2649d9a321463ab426ab89ecc612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245355, "uuid": "f75a238c-14de-4c36-ae29-b0c7d8e42456", "comment": "Malware payload (Mirai)", "value": "59fe597174732094ede3b0705692c8603940ea5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245355, "uuid": "0856f9a8-83a5-420b-97fc-e87acb4c6dd3", "comment": "Malware payload (Mirai)", "value": "bcec78f4016300719b99b97b8414603db85a16ebbbee4c1af5318309adffade32f820fbb47a476311cc336708230db5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245355, "uuid": "6e72338d-be71-494b-b6aa-33bd5e77b1c8", "value": "T153241946EA814E13C0D627BEF69F524533339754D3EB73069929AFB03B8779A0F22605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245355, "uuid": "5935cca0-4753-4ae4-85f8-1bc86b4d036d", "value": "6144:nFDuZwxyP/mk9Gauchy8oWYfhGL+NW3xyM/RVbpT:FDu+xHk9Gauchy8opJ/Sxb/bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764245355, "uuid": "336f197b-6baf-40e5-b17b-8edfadc48e56", "value": 228424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764245355, "uuid": "d65893c8-7fd5-427c-bd86-91541e3c7e0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245355, "uuid": "4dca3cf9-133d-45b2-b0ae-046c00f7b166", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1469e58d-cba1-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1764255314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255314, "uuid": "e789f973-1dbb-458d-96a0-9a864df8366e", "comment": "Malware payload (Meterpreter)", "value": "e0f6f0710fb8b1d1f1859bc114f82a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255314, "uuid": "f444e0f9-71e9-480c-9771-3cccb61762f5", "comment": "Malware payload (Meterpreter)", "value": "1edd32c344cb42fdd75ef91bee11bd8dbc418d87a7ca2b4a0207d69ba9d77bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255314, "uuid": "71fb14f5-febe-4b2b-87fa-23576dfa828f", "comment": "Malware payload (Meterpreter)", "value": "167a293d6d1082524b0092cd2a715100d7b1daa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255314, "uuid": "69da875c-8b2f-46d4-bf42-79b3ca803ad8", "comment": "Malware payload (Meterpreter)", "value": "bcf483994985d144016bc7d6a6f52d34513135395290abcedd71457e53e26d9393fe000b2cc8fe838b1ef9f7d295d594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255314, "uuid": "973b4e0e-8ddd-440f-bd01-1ade9f76877f", "value": "T17BA256C3B66518A6F9790B7F8507E7CD64BCE73073521B494671054E78A2866B821F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255314, "uuid": "4737318b-143e-4d8e-ba1c-d14c4da2b6d3", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255314, "uuid": "987b21f9-01aa-4869-b8aa-5404d436c110", "value": "24:eFGSG184bknehtht6dp54aY+mq9KMn2DOIRwSclFcabPDbuqiksvcLFpk:iGS3nehthEdgt+B9TCO1SUuanqqilkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764255314, "uuid": "23110542-839a-471f-94be-a1a3fca7c2f3", "value": 21472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764255314, "uuid": "3282dee5-2d1a-4cc5-a53c-08c0aed53fe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255314, "uuid": "2020151e-8f8b-45b6-84f6-b89a145485cd", "value": "1t34a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c29413-cb9b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764252771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252771, "uuid": "e8aa1fc4-655e-44ad-bad7-b599360cb05a", "comment": "Malware payload", "value": "dbd9f0a3cf9efde485556135866d0994", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252771, "uuid": "76191dbb-fab9-495a-8b2a-fef5e98506ce", "comment": "Malware payload", "value": "2005930349994dd3f359d3c1cb9f333587d00dbb0419637a4d6337e976587778", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252771, "uuid": "c7de9156-6e68-413a-becb-e9dece45d6fc", "comment": "Malware payload", "value": "ba0bc9de01b10d3b2be4232aa497c8dcbdd4b0c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252771, "uuid": "5d88d183-9c3f-4876-a88b-0e5bfa4c598d", "comment": "Malware payload", "value": "2bf7597c76628b279aafb3c6668adc0fa4562875b2a00e71264f11f981fa12db921cd0a1e485111455b8c5f9e92365b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252771, "uuid": "02e5a3a6-24bc-4d14-ad20-d405dc210cae", "value": "T13801CC9852905757D388CE2FB793607E1721A6CD941E1BC0F2DA967847847C5B028967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252771, "uuid": "be6e5407-7040-4f27-a527-67d93682949a", "value": "24:KOQyS1bbemwBTm91npLO9m9waliAjLqlVmKoJFUbOIVcr:K82q9TY9p6bciAjgqFBI2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764252771, "uuid": "1262a03b-925b-4747-ad23-38545b2ecc99", "value": 790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764252771, "uuid": "5bae02a9-f46f-4ede-8af9-659356a85b56", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252771, "uuid": "1b26955a-57e6-4e35-8c79-84b6d8615bd3", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca53a192-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764237150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237150, "uuid": "b7ffcd23-6788-4da9-8544-4af19bd8bc62", "comment": "Malware payload (Mirai)", "value": "c777d3373f487edb2ae3edba55f9da72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237150, "uuid": "235e015f-43b3-4800-80cd-f5c24b9eaa27", "comment": "Malware payload (Mirai)", "value": "202d8e7841a018cc057e86809d358b12467ffdcaf6033370660c0f05292d4479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237150, "uuid": "d0212467-7b8e-4096-a6ab-c8e6a5e83e4f", "comment": "Malware payload (Mirai)", "value": "d9b0a0d15db2acfbf65768601b9893fe8f62c379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237150, "uuid": "3da01c6d-1a07-46d5-a1a4-ad7d1c9f7cfa", "comment": "Malware payload (Mirai)", "value": "2a892b4eae63042e6096bf457f1938a632ce8ad3c92aa02886d90a33ca5a68ac99c7bd0f59760f1b03ed18425af0675d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237150, "uuid": "d2ebff1e-337d-477b-9fe3-504d4d2dd811", "value": "T1EE041946F8C19B11D5C111BEFA1E628E33231B78E2DE7212AD255B20778B9BB0F7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237150, "uuid": "f866319a-074e-4738-82d0-3b00335fca84", "value": "3072:alpu+OfY9bXY0WHU+DbjuXYN0io9aHJZAd+Av4eoDC2z7f:EpumtWHljuXU0icaL7Av2DC2z7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237150, "uuid": "6a568b98-c67b-4d40-a240-293c32e4acba", "value": 183100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237150, "uuid": "4e0dd187-5843-4bfd-9c48-043d661ba64e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237150, "uuid": "1c132c2e-e114-433c-8a86-985035ebdea4", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3080ebf-cb8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764246184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246184, "uuid": "c504b782-c98c-46ef-95d4-e03360769aa4", "comment": "Malware payload (Mirai)", "value": "ad1602507f0de122c7d17c6b1ed29c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246184, "uuid": "63e3a0a0-ef3d-4500-ac13-32105fc60cc6", "comment": "Malware payload (Mirai)", "value": "20fac5d2b6e17eaa834f11711cd3737dfdc3c93545be93acd0775c839b918acf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246184, "uuid": "e608fc2c-8d14-4cef-bf2d-8635416e41d9", "comment": "Malware payload (Mirai)", "value": "6074a7c3ac1f4ee1fc62e9a98d39b80264f5e83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246184, "uuid": "c7098851-9d6c-4379-8e2f-3d114beba017", "comment": "Malware payload (Mirai)", "value": "c1124b2734c6687fbcef9b2fc408360d3d242f1a3412007ce1f769827413053f9fa91dc2078a0b0b9c0905bbf9f43ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246184, "uuid": "8041c9e0-a3c4-46f5-ac79-40a4d993d02d", "value": "T1133301438D259704F8557379376B4D094422F92FA891A07A5ADCF430B470BD3EDB8A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246184, "uuid": "27f02603-a780-4890-b419-4e20db3acd82", "value": "768:IHjPGIJutDoMnLH/2+2RsaYoZ0udW76amtlz3ZFOX/m8wjxOlHROVNpb5GNPnddU:ID+BbH/6WeTtdk6+YLpinFnouy8GyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764246184, "uuid": "d9f141df-5b4e-43d1-a3c5-391b064fc41f", "value": 54416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764246184, "uuid": "782f3210-6eb3-4e15-96d3-75e1c550cb54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246184, "uuid": "a2e965c8-20b4-47a3-9800-65041b20f8e4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bb6a6f-cbea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764286938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286938, "uuid": "4635e4ca-de45-43d2-a825-817a04dfa3d9", "comment": "Malware payload", "value": "d0d8c9cc3483cdf3d7791eac842ad1c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286938, "uuid": "e75ed8bd-1012-4843-b0b7-a476b57ee6e7", "comment": "Malware payload", "value": "22cad686f39b008f7fa996e096590cc244055116f1d466600bd2374f49a82906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286938, "uuid": "3cfbe10c-fb8b-4a45-b744-3cdd91a07db8", "comment": "Malware payload", "value": "65623adaa42cc19352e9593993401949e7246dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286938, "uuid": "c0872bb5-a1ae-4c5f-b536-cc8158211fee", "comment": "Malware payload", "value": "277f3fc26a33fde48795d1ddb21e77fdfdb19b38c3b324ffbd1f6fc8237b103837d37864463b29572ba4b7f80ade41c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286938, "uuid": "f75eb06a-4595-4804-b82f-0f1866dcf1a4", "value": "T1D7936BC2FA83D0F6F85304B24037E3374732E439502AEE56D7699D36EC629419A2B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286938, "uuid": "6c2796d6-c743-44ce-9f67-0476230dce1c", "value": "1536:MWguqhLUm1+X+IHVKjeXnXzGAV3d3eczA2W2O4EES7S9aRS:Mxuq5UmkX+PjeXD13d37z6r/WoRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764286938, "uuid": "32d29170-c901-45ec-bfe8-37a952dff489", "value": 96488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764286938, "uuid": "ca561b5f-bcc4-4e6b-a2d3-44e06cda17de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286938, "uuid": "4b5288c4-715f-4efe-bb12-70d905f483d0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f68244-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272583, "uuid": "c39a5834-1f17-4c0a-b993-a698a41823c3", "comment": "Malware payload", "value": "6e006b9729c1c46c39b78227110ab3f1", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272583, "uuid": "20ab5fe7-2c4a-4223-8865-5db165b1f06a", "comment": "Malware payload", "value": "22d7d66ca0b12ab43524fcdb5cd7a7dc2babffccca8a7f5244046d64dc3be74d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272583, "uuid": "f3e68f22-1972-48ad-89b1-a6565a93466f", "comment": "Malware payload", "value": "90e5accb03fec38561cec4c146cd9d56efe37f0c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272583, "uuid": "c4829e1a-1db2-4e0e-bca9-0b19aadcf8d3", "comment": "Malware payload", "value": "5fcb4930d194cf1af863fa8037a317f0573e275131d0924d111670532e5200d08c22a7e24e31f48b88438b5f8f1e1a0c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272583, "uuid": "dbc847f4-d7ac-42cb-92a5-2c67a28d3307", "value": "T1240733F0B3942AC0EA3B7DF9930154C59700F5DB7E3461397A2EF48D7B2A265183678A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272583, "uuid": "cb751ce4-6eb3-4c82-9ec8-5458a79dd0ac", "value": "393216:YoefxQm6gfqvU63VpE7Bj4Q8QGpBZ2ENlDtJtj7ElpaNjpRGTK1Ydm:YTq4fqvT7YQB0sDtQlpatpRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272583, "uuid": "6c2938aa-5703-483b-9036-19393f0ac63f", "value": 17917952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272583, "uuid": "f7d374be-a494-4c46-8790-ee2c79aa514b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272583, "uuid": "9d3e468e-55dd-4bd4-834d-772362cfdc14", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264bc118-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236875, "uuid": "a90ba6eb-22ba-46a7-9b1a-44257a30e089", "comment": "Malware payload (Mirai)", "value": "6254526aec54a34201f98eaf8bcb88ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236875, "uuid": "9462507d-1ea8-4f45-a9e2-865c5701d4f6", "comment": "Malware payload (Mirai)", "value": "23a8fef9e04345bcbfe4ceb393db7540418a589147c94a4436b18f033c2281dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236875, "uuid": "da82c4c5-ece4-4b23-ac7b-8eab565cb5d5", "comment": "Malware payload (Mirai)", "value": "403ef4f17e28716b864f04a0697fbe4cf579f848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236875, "uuid": "81586daa-5070-4f1a-bca2-593715cb8a7c", "comment": "Malware payload (Mirai)", "value": "c2ed45b865c3ffda37e28411ab51a3b846f60563c5cdc3d429844912b50f72a932f0a397b66a83b64a1ad4913c0c075c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236875, "uuid": "5117f024-f39f-4c8a-9ea6-495a0a4a51bf", "value": "T15EA3BF32C82A5D98C18505B8B4E6DE365B23E5C417932EF71AE6C7A65047EA4F40AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236875, "uuid": "c44df3b7-acc1-4a65-aac5-bb78233e413b", "value": "1536:H/I9A0n3bQK05LKGVwS0TYqcKDFVut7DAQmHICwE6SPXc/:Hw9AkrqLK/TfDDwAQmHIEvvc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236875, "uuid": "5c3a0672-cd0e-478a-bd31-5653a6f6f530", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236875, "uuid": "56b0af0d-539f-424b-b791-ab46b95d89fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236875, "uuid": "bce2ace5-0e40-4d6c-9fd8-a9a06947e58c", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da523f6e-cb8b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764246197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246197, "uuid": "f2c294dc-5108-4610-9d87-19b7eb031f3b", "comment": "Malware payload (Mirai)", "value": "071e1dce580d5021d0d4722572d83d3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246197, "uuid": "0f512903-93ee-498c-ab56-3378924662ca", "comment": "Malware payload (Mirai)", "value": "23e86fa82e4ad95cc11892562c339eb0fc99f48f92572e24515878c2633cb081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246197, "uuid": "f558f06b-a9ca-41e9-82d6-150bd4cb3ccb", "comment": "Malware payload (Mirai)", "value": "f247abf7f368552714c0a6a43bb5474558a37894", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246197, "uuid": "ee92fea7-d57a-47a3-82ce-5f17ed5cedbf", "comment": "Malware payload (Mirai)", "value": "16823a1a09277e6499a7f28953bddcb5ceed647df582756a0bdaae3be09d169a78735ab50a6e54af0085ed7809265714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246197, "uuid": "d78e15e3-3070-4e2a-90bd-eabcdef14233", "value": "T154D35AC4E68FD0F6E85215312072BB264A76FC3A623DEA83C3B89B3598935C1D91771C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246197, "uuid": "1712585a-54cc-4b21-a963-ca57eca8de90", "value": "3072:+Hs73Frp3jre6lnUcAnhZPPsApHD407BT:+Hs73jIFNtD407BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764246197, "uuid": "72d9b3e6-f07e-4067-a42c-4a953b426e10", "value": 133484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764246197, "uuid": "9de6aa9f-901c-4235-8c3b-082974eef152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246197, "uuid": "edaa1fd5-825f-4bba-94be-64ac7294f5be", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43424ac2-cb4b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764218455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218455, "uuid": "d353e569-febb-4d5d-ab3a-153a1516f70f", "comment": "Malware payload (Mirai)", "value": "1c000eaa37276d9f69c0223c554b5d53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218455, "uuid": "e6901684-4dae-4ca8-a374-ac8b921fe8b7", "comment": "Malware payload (Mirai)", "value": "24e2114a216ad71c08227628c41849c8a1c3dca88ec7be5398fd4c9770d83264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218455, "uuid": "d02f12de-5cd3-482d-9d6b-8c9979e46b90", "comment": "Malware payload (Mirai)", "value": "26091e6afdc672b156859f8ab4ddbb5183f33ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218455, "uuid": "a27b95e6-2c88-4a04-b21b-6996aac390a1", "comment": "Malware payload (Mirai)", "value": "d5f5ede5792a82ac754cabce985a3e68c69bbaf191275954e9b9b0354bea2e782ebde44dc21486f92d9288ce361facb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218455, "uuid": "e88b55ce-efc1-4b3c-b1e1-0471cf2896a9", "value": "T18F533A2179396E17C4C5B87F22F74725B1F2270A36A8CA2E7E721E4EFF1065025076B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218455, "uuid": "e5de2051-8aae-446b-86f2-7387dc2f2b82", "value": "1536:REPPSaobolJ5TmCpxM0vZeGT4qjWrP3ul9H/zpeQchO:RKK0BmgLT4tviZzpeQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764218455, "uuid": "bcfa5399-e101-4d52-b7a2-9e8ed58d3821", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764218455, "uuid": "99f32e82-7680-424a-ba84-0a04b5a1cf0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218455, "uuid": "371b5bd1-de27-4f09-8e85-f3424a7385df", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d39f22-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234507, "uuid": "40f8e81f-bdff-40da-be40-0fff6b32a077", "comment": "Malware payload", "value": "9eca222305e08bb4999b73dd6e4f5eea", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234507, "uuid": "e291061f-abde-4110-8a64-9f97e895ee3b", "comment": "Malware payload", "value": "251f8813768fc5d3e8db5992b58ea274cfeec1a372559fbc7f9bd3125732d2e0", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234507, "uuid": "8ad70fa9-234b-4489-9e27-73a5fdfb56cb", "comment": "Malware payload", "value": "018da3824a99e345d1838a5ec1f9552955cd9393", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234507, "uuid": "11237967-6473-4b2a-b516-b6fe66877cae", "comment": "Malware payload", "value": "4bfc08d7414072511316a06b93316dbb1c903d34263f01d6f012f45cdf0c30911659d9c036e72f5207d2818fbbb2be6e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234507, "uuid": "0295159e-e118-461c-b92a-1e7803c41d0a", "value": "T16B55BF51F683C072E59102B16476DBBE4A7C6C340762D8D7E3C43EB7D9202D1AF39A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234507, "uuid": "38e4de3c-9815-498f-bcf0-9372c11e7998", "value": "23f20f26a15d3def163ec2913c659767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234507, "uuid": "b36fae72-0ba6-47b4-bb95-0ee28420985c", "value": "24576:+M4jLq2TFiq9QH6LIV62vaSX6wdwBSwufUWbrviDQXFi:+pXTFi0QdvJX6B7u/viyFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234507, "uuid": "bef65341-81d4-4eee-807f-397e5c9bb613", "value": 1303552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234507, "uuid": "96c596ea-36a3-4639-b016-c9fbd1216742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234507, "uuid": "89288ee0-e448-4697-bc02-3042a20e930b", "value": "VERIFIED 3.11.2025. II.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6548f605-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223667, "uuid": "35ea0ac3-aa51-470c-9379-c63249351b57", "comment": "Malware payload (Mirai)", "value": "48fc16f6d8fce94324aa15ae891de373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223667, "uuid": "2ac6835e-a264-4709-96e0-f737efce5040", "comment": "Malware payload (Mirai)", "value": "260652b694557293fcc0f8b41c6b5d157a7988ce39c237a1c9bf4d1560f008b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223667, "uuid": "b16bfb0b-cbb4-42a0-86f7-e669ea710abb", "comment": "Malware payload (Mirai)", "value": "f7b24eb752b3c47607d3b906d22ad3db93bdb086", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223667, "uuid": "fd6f00e9-c4d4-4a15-8065-da8b9724a4f6", "comment": "Malware payload (Mirai)", "value": "ab294248ab068e324edea8325619333ca89d1e1460ea635b6bb7cbc5d40345e186763e9cb0de0837573c56d15b1080f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223667, "uuid": "43c126c5-ccbe-41a3-a1a5-00b1f7220b23", "value": "T12C538D75D11DEEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223667, "uuid": "023fb321-037c-4c51-a0dd-57cf08187d6d", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223667, "uuid": "7e75212d-8ca3-4a48-b40d-0569f3f1a33c", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223667, "uuid": "efe9b566-cbc4-41cd-9c49-eff59d07edfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223667, "uuid": "82ae42f4-6328-47e5-a4d8-0d0de214f911", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee66110-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272780, "uuid": "b7d1190b-bc4f-4219-996b-877410229e65", "comment": "Malware payload", "value": "925cae9382bcc6834ac1cc5074c25c31", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272780, "uuid": "6b9f9384-6bda-4997-a3c4-72ae22c1d749", "comment": "Malware payload", "value": "27be57df99e7bafab9fff48f086bfb16d754adc27baadb4826b170783a7a2c80", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272780, "uuid": "f161f792-bb5a-4e43-9b36-9cee38741341", "comment": "Malware payload", "value": "740f20ea2599daae81f7c1e004e3a304b80e0ce8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272780, "uuid": "c7b126fa-1a80-4ab2-b800-46287b460a48", "comment": "Malware payload", "value": "086d5452e6a2fd455f61ec690fe71a65819c8c6e2273ca242e01abec17c460596db64782db020c88cd9eaf2f5972892a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272780, "uuid": "efa9699d-0ad6-4942-8adb-6dc0bf4f203e", "value": "T1A7B423CEEDA18F538F3BECA90AC65E7ADA15415E601BDBDB7008900754073D3E27875A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272780, "uuid": "01b53160-ad87-4d84-940f-e935f0852885", "value": "12288:f9sye7CO/SZYnP+82OidzA11FQ+a620Lc:1svKZYnP+u64Eg2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272780, "uuid": "4a3163b8-2a09-4498-9e6b-8d7c054fcd6b", "value": 511758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272780, "uuid": "8b2c1e2e-3e4e-4ccc-88b1-07f25e64be56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272780, "uuid": "44e07cc2-90b4-418e-83f5-e13684a19341", "value": "INVOICE-No92744.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cf348b-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223914, "uuid": "b9813b7c-0da9-49bc-a7ba-5d474138e03a", "comment": "Malware payload (Mirai)", "value": "e3ba9ea2b75231a111b28db6a680c753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223914, "uuid": "74c200e2-428b-4c53-946f-28c3bc4186b4", "comment": "Malware payload (Mirai)", "value": "27f2c5afd05637f1819cfde76e9fbdef3f33c0b29be969ebc1f2aa9f75e77d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223914, "uuid": "fa360ee2-a4db-46f1-9919-d8c9c46e27cf", "comment": "Malware payload (Mirai)", "value": "aebe00aed91afc673bde28af187f1bf4d0973cba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223914, "uuid": "59ab9eed-60a5-4255-8291-725f575b343c", "comment": "Malware payload (Mirai)", "value": "b32b0ea7ba02d47e5d4d11d377ee7936bf2cf3b1e76979729a3f1561ce6a00435d44d6762c5671b20b46b5e38f852e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223914, "uuid": "7b3e5cb0-57a3-4c7d-957b-721f97caa7b1", "value": "T1D9530845BC91CA27C6D462BBFA5E41CD332623A8E2DF7203DD116F157B8A82F0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223914, "uuid": "b2e2e0ae-916a-412a-ae8f-0e44ed835654", "value": "1536:jA7IUuXIBg4tT1uRGfr3d13jI6cm7tug7R:jA7I+puRe86V7tug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223914, "uuid": "61a1cec2-2d2e-409c-b5a9-178a456a4ab9", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223914, "uuid": "53637e64-8be4-4443-ba54-8e87e4259903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223914, "uuid": "a9446caa-e9e0-40f0-956c-e06c60e3ec51", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f3f56d-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236881, "uuid": "417d0a20-a249-45ba-b529-fbd764a8d996", "comment": "Malware payload (Mirai)", "value": "6c07b98d8f3f00f2503b6f5544950880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236881, "uuid": "4f1b011c-bb70-4ae2-861c-c4e87dc0b7dd", "comment": "Malware payload (Mirai)", "value": "2947d98fdd6bbbbfb124ab6fe4130bc607103e5c339744573ce6745e1fde68fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236881, "uuid": "64283802-d68b-4830-8310-ebf2d7b4bca9", "comment": "Malware payload (Mirai)", "value": "2f1c07a12cbb6400cb60b4936161783113cebfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236881, "uuid": "b533d914-6076-414f-85bd-f43de8ae9d3c", "comment": "Malware payload (Mirai)", "value": "7683a2b7231cf4b16f1b3d66c0aefe1cb726f3c3b1280f784dcc04afc11489f9c90e1abf43ba18c8907c32a0f9a96b1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236881, "uuid": "8d5050cd-8da7-4efd-a576-78c7bb46eb9c", "value": "T15CD2E1161606FCA2E3209873DD7E96CB15CD7BB887FA514622405E3DED0E51EA9F8222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236881, "uuid": "077c8127-4be3-4025-a9da-cb5e3368bbd4", "value": "768:xSqEkxgmuaN5QRrY3XprGsQK069/Fs3Uoz+aF:xS1CuaQRrYH8OIzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236881, "uuid": "baa93086-a4e1-4804-857a-f19563202099", "value": 30968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236881, "uuid": "009162c3-f731-4feb-977f-682f56426ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236881, "uuid": "18de91e9-7d04-4c24-82d5-ab37550915ab", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a61a828-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764234439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234439, "uuid": "02a28d12-dc19-4322-bca9-4a6f3bcf7b3a", "comment": "Malware payload (Stealc)", "value": "eee6b7ec905aae7313ee7c15de4fe654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234439, "uuid": "26b045e8-6570-4fed-aa95-f27dce9b3049", "comment": "Malware payload (Stealc)", "value": "2b36a0ee0f856802d75be13c1537849cd61ac531d58bb5db719d4621c9102ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234439, "uuid": "96287a21-4da8-4146-9622-466850d86338", "comment": "Malware payload (Stealc)", "value": "76fbb1c4c989e7f3dd16bd3f7caf48906d5acfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234439, "uuid": "21e46cb0-22cb-4974-873f-f9342d48d994", "comment": "Malware payload (Stealc)", "value": "0305f7699415fc706fa6ce5330ce0b0c7ae3254128f9d2b2b9ad32831d49134ad285d85f20d58fdffc846800b15a551a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234439, "uuid": "7dbdd1ae-77cb-4cf2-b6fc-6321ac210578", "value": "T1DB251227FB037AE1C9E884F19CA641F26512BC5787001B3BB5A4B2291DD671B7D37A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234439, "uuid": "967a81fb-692e-4bf3-b1e4-c32d12cd4953", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234439, "uuid": "e75f5358-0b2d-4b0d-ba5e-9fc7f402988c", "value": "24576:zlSZNSOQmQ6Tu7HGnjWMmUTRS1Fn7Nm6ltzuSuHyflO+z2MNzdgwjo8xw:pSqOQj6iH6x7Tw37Nm63zxuHMYLYzd1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234439, "uuid": "507cf3d7-e275-439e-91e7-d73949d78913", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234439, "uuid": "09e9777a-1885-4915-8ed5-b46b88ec1703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234439, "uuid": "d511e554-48fc-42ac-bb58-806efb062278", "value": "FACEITInstaller_64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db9d576-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236915, "uuid": "66f37f92-8cbd-40b5-b96f-00eedfdea0bc", "comment": "Malware payload (Mirai)", "value": "75acd6070bd20985d8418e4ee854dd2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236915, "uuid": "fe64f035-82e4-41bc-8c76-8cc1355137e6", "comment": "Malware payload (Mirai)", "value": "2b872239f8936bc9416bdbf7385bf85400f4f09037b966ab4dcf50f51ea14f59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236915, "uuid": "d9ddcad2-a1cb-4946-9725-94fdf3a986fc", "comment": "Malware payload (Mirai)", "value": "6afaa8f1019294b76ea15ce056c2df5c1f423e4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236915, "uuid": "275e2171-2a4e-429c-8c79-a21a5c48efcb", "comment": "Malware payload (Mirai)", "value": "b414d43f9c19afbaba869f7ecb3e710e3557ea41c36e6e10cfa96a52b1227a95c819cd28aa45c7f2b0c859259c70122d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236915, "uuid": "f9b825fe-3aaa-409c-85ec-d643880f9cac", "value": "T181B329C0F98B81F6C40B8C306166F63FDE31D5A95171CAADEF959F36EA37601920264D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236915, "uuid": "9146caf4-9ce0-4b17-aeed-01c267ee2f43", "value": "3072:fTm/iNJ65Sfe/CsFuT09dZJUTMUfnDHGKgpuzFlo1Okm:q/ij6i8CsMTMXi9KcQ8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236915, "uuid": "80b9b499-cb5c-4883-a6b0-8793b9f10c8a", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236915, "uuid": "c7c021fd-0165-4f57-990c-17c4967d821e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236915, "uuid": "fa5a73bd-9abc-4321-9168-0565c37b7ff5", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880f5e3b-cb98-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764251642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251642, "uuid": "58e618a4-0aaa-4df6-9c48-57bf7e2a8e98", "comment": "Malware payload (QuasarRAT)", "value": "aa9532f77eb89f50f203b5e8e010c9bd", "object_relation": "md5", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251642, "uuid": "d712420a-c430-45f7-911f-f340d3ed5de0", "comment": "Malware payload (QuasarRAT)", "value": "2c0e2f2587de48b78b7dfe2a28c012ca3b6790a55896f8a173b7941ee61f9bc3", "object_relation": "sha256", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251642, "uuid": "f822b85f-57bc-46c6-86d2-7f66943dc650", "comment": "Malware payload (QuasarRAT)", "value": "95afdc4350dbfcbf9ecbd8cdf9ea860ac0b8e7aa", "object_relation": "sha1", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251642, "uuid": "ce435b08-dbfb-434d-bd97-7d38b3ed73c4", "comment": "Malware payload (QuasarRAT)", "value": "4e887262ae418fb7e9b97c926555c8d06f0f04da766707c77c048de2bd8bd6144ebfbb3fd4a39ac33416a6eb0702edc9", "object_relation": "sha3-384", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251642, "uuid": "7a39bedd-4d2c-4d00-9511-fee10e3f5e66", "value": "T12FD6428DE43A94D8DC5235F07C93188C79485DE59FBD422E442CC4A522EB6BD029BBFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251642, "uuid": "e7ac9697-ada7-4436-8707-9997f4cd1cc5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251642, "uuid": "8a0b9d31-e22d-4d20-bb22-38b7ef0b3e53", "value": "24576:pVvzqDtQFBumDtQK8tYKFUFZhNpEX3S0ibLU+mgmJUbS3vfnkmutbapbU0VtcK0d:/WDwDYoqtGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764251642, "uuid": "255be3ab-7671-435c-b45a-def37104e20f", "value": 13234288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764251642, "uuid": "fe78617d-f0af-4401-b710-9ff26031e821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251642, "uuid": "cddfce5f-951c-4449-8e15-5a49db17a5f4", "value": "libfilezilla-43.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0f929e-cb2c-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764205263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764205263, "uuid": "869aefc1-5023-4525-840b-ab8f9c660b77", "comment": "Malware payload (MaskGramStealer)", "value": "9448b8bd581eca83d8ea9f08a5622575", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764205263, "uuid": "567047d5-88a3-4f11-9343-9649258d67a3", "comment": "Malware payload (MaskGramStealer)", "value": "2c8552ce73d9c383418a8f6f597a26ce5c7e0d6176aa8c36fd417af234dc3fdc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764205263, "uuid": "c0ab71bc-2bda-4267-9496-238f00cc13f3", "comment": "Malware payload (MaskGramStealer)", "value": "da76048e1d0ff9c318d9755a30948c712f8035a7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764205263, "uuid": "2a990e32-7cb8-4919-8e9e-4a0145d06365", "comment": "Malware payload (MaskGramStealer)", "value": "cadea22bf5f5217dc27e99a7644ce9a47f018bd64480a4bdf0067000b6cb195bbadbd05ddce871bb6f5b5b3d0a94e6a4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764205263, "uuid": "85b14e9a-4b57-485d-9496-6f0cae0b78b1", "value": "T1A66623E256C992F8D0CB8B30914A62FE37C47D6654BA196D3DC67C038F30DA98499B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764205263, "uuid": "3c6811cf-c3ff-425f-92ea-9449baf512d3", "value": "ea281082cd6342019a4640d5d7089aef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764205263, "uuid": "f4904fa3-e410-4468-adf0-c410e7d9e699", "value": "196608:S/11JkvWl768V2MSo51jHVbBzQautY/8HF:St1JkutPNpzutY/8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764205263, "uuid": "a6960ac0-61dd-44e3-8b14-eeac74150a82", "value": 7088128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764205263, "uuid": "0f579881-200f-4f90-8c56-6eb2528d31d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764205263, "uuid": "ed61abc6-906d-4933-9ddb-8516f643a62b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d74ebaa-cba8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764258523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258523, "uuid": "fb817711-2ad0-4203-8425-b19e1dcef17e", "comment": "Malware payload (Mirai)", "value": "81c79e37bdc024e96ba80a619b397145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258523, "uuid": "8cbf715c-7e26-4705-9939-427fa39cb7ca", "comment": "Malware payload (Mirai)", "value": "2db5c1a22fc84b5ab0fec2dac1e95154cf54751d9c222c61fe081d8594e1306e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258523, "uuid": "db9aef3f-11f9-4806-8888-1880333486db", "comment": "Malware payload (Mirai)", "value": "0fcf18ba21bb0a4c26ea1ef726d39a370f6109ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258523, "uuid": "91c701d1-878f-4320-a6bd-71496b996107", "comment": "Malware payload (Mirai)", "value": "adc4946c6125550737ac3437189da7cc20ab8078b5979a9a4d9f0df1585c5c2799bbe4555638e785510033d797a7ce08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258523, "uuid": "a4b95041-3a5b-4392-ae4f-38d4babc3e5f", "value": "T111C37CA86E0E3DD2D3C7E37DCE484E21712B75F1C62192B07D02536ED6DBCAA89E0951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258523, "uuid": "413668da-9278-45f6-9849-0c06cad96545", "value": "1536:fqQfH+ov2hEtR8SUNbcIZz2oY+EJf1VdfR/fJ4tWuuVTDlceKf84:CGtRvUF2oY+EJtVLwWNpDWeKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764258523, "uuid": "b7a54693-43d4-4617-ab0d-7be03434f3f4", "value": 120616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764258523, "uuid": "f412800c-f544-429a-bbac-65a753648a40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258523, "uuid": "1b9ff020-3ba6-4e1e-a12c-b847d0f70b13", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4019ef6-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223825, "uuid": "65f4a13e-7bcf-4152-a2b1-0682a2284ee1", "comment": "Malware payload (Mirai)", "value": "b41d62a8217cc2dfc1850b3ac285d390", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223825, "uuid": "149e1eb9-d8aa-417f-aee2-8588e4512013", "comment": "Malware payload (Mirai)", "value": "2e042c52b4b51a79f45726752a1fc41340838f57bb2a9803a8871d17b0f1b764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223825, "uuid": "cc0db548-4164-40c8-a42c-e167b7155cad", "comment": "Malware payload (Mirai)", "value": "8aa8e22f018e25e16076edaea6027a5f0f1b9be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223825, "uuid": "63fef8cf-e2ab-440f-a980-142617bb9c90", "comment": "Malware payload (Mirai)", "value": "c957c51442a18d4563098cc4c5a51c84c48a75fbae27d05ab8c39b44d8bda9f9bb4f725f19daef13433e12cd63b107d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223825, "uuid": "a94c1882-3ea4-4b98-baf9-5bd8e5aaecdd", "value": "T1E7533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223825, "uuid": "20c000a8-930c-4d6b-89ef-5e6bcbafae32", "value": "768:PtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaal6:VMLSBq14Se4GHLTBygfGXAgIVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223825, "uuid": "58b556f0-8193-45be-9b96-56444f0c5087", "value": 64248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223825, "uuid": "be36ad23-2ca4-4cbc-9b22-ed3d94757a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223825, "uuid": "5d031244-b1e1-4cc2-833b-4b7ec20284db", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8758dfdf-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241763, "uuid": "35bbc886-95b2-41d0-992e-89165c35226e", "comment": "Malware payload (Mirai)", "value": "72a92f2dcc3200ff1db868466fa1ab0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241763, "uuid": "9562d637-b47f-4b93-b272-5e89992aa094", "comment": "Malware payload (Mirai)", "value": "2e2f4783cb1eb83828e8685bbbe50c329acbaf71b5ef8d424c7c146210ea9162", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241763, "uuid": "b0a8ef87-471d-4cac-aef6-f4d34b4587d4", "comment": "Malware payload (Mirai)", "value": "36d0fba1d4ad88ed4765dde284eac1fb0cc10bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241763, "uuid": "d8a882df-b6ab-4bf2-aafa-558664058c8c", "comment": "Malware payload (Mirai)", "value": "dc13148001f107d94aa878546523d4365949c9db6d8a87548474952e8468a6737442faf6264efe52a5b75cf9a0e7e71e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241763, "uuid": "eac7777f-ea4d-40a4-91f8-f477ba4b3061", "value": "T106730A85B9819B25C6D513BBFD1F018E331657E8E3DE73129D201B607BCA91B0E27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241763, "uuid": "2da320b9-0545-4d39-8666-ba0a8f031774", "value": "1536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241763, "uuid": "8ff9a5ed-d20b-45dd-82bb-90bbf7ab8bc1", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241763, "uuid": "beecbdc9-9ff6-4064-9134-4d0bfb5bec95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241763, "uuid": "9184e023-449d-4058-9618-2ed57b1d9b36", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5324cc98-cb65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764229649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229649, "uuid": "e113afd1-e894-4c44-9b29-3d58f289ccd7", "comment": "Malware payload", "value": "fe25856f6797e9f887ea9409693d3c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229649, "uuid": "33ad7ac6-2b56-4552-9b79-6470f6f9c912", "comment": "Malware payload", "value": "317eb24e331b029fb832c339ccbd0e79f8fd9b2d2b8e506463730f6b0a1f9571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229649, "uuid": "4f269a90-3622-49e2-af11-cc083878461b", "comment": "Malware payload", "value": "ecb25fdd450d66e93dd084bb2b88c2abfd517672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229649, "uuid": "c5b72cb4-db0b-4961-927b-6ec36545ef95", "comment": "Malware payload", "value": "17b928b498e7e1e1580fb3b6620ddd0e3911fa3045e69fcc979fd44e775c73f88482c73f3124a412fde12c543a022336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229649, "uuid": "502ce40c-5f9a-4c87-9790-64c6d7bb339e", "value": "T15255BF11BAC2C072E5911670617ADBBA4A3C68341761D4D7F3D43F77EC202D2AB39B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229649, "uuid": "117f748a-1b3b-4afd-8caf-2bc251272e06", "value": "23f20f26a15d3def163ec2913c659767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229649, "uuid": "7bb9f40e-d855-4319-a2ef-bc91a8d34ed9", "value": "24576:epZFZ92V15YZFWiDxZ6H0pAwTnqRwaXLXhRgw4Wu8mzb6KibcZ:aZwV15YZFvluwTqRwat6CmyNbcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229649, "uuid": "67bf2114-837b-4031-8599-f4d123060b33", "value": 1333784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229649, "uuid": "1ec78e1a-7802-49ca-9b9e-950d76d4aca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229649, "uuid": "1580b4ed-2b58-41af-87bc-8f47749ec93a", "value": "317eb24e331b029fb832c339ccbd0e79f8fd9b2d2b8e506463730f6b0a1f9571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239fab9e-cbc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764271660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271660, "uuid": "627db42b-d6c8-40d4-93ab-9a81d3809e01", "comment": "Malware payload", "value": "f5d05a50d6f44c79c053130ff51114f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271660, "uuid": "fb196dee-deb6-4b1e-81b2-92021d0b6561", "comment": "Malware payload", "value": "31b621fca2f7404e28d983f34a8f5acb87ee630429f988f37c69e622b3c4a34e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271660, "uuid": "ac1af20f-e092-4b9c-9ffa-90f41050e0ac", "comment": "Malware payload", "value": "4fcdb53c21690c99d4d5e209214fa2e53baf69ae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271660, "uuid": "03ef6c12-4aeb-4b10-8ed7-f9fe9274ca95", "comment": "Malware payload", "value": "2c5aa0cf883ee96dfdcb699c068804952622b1a9d5756f222e5b84bf5d5325d90eb690f48826eaefc84221c1eb42634c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271660, "uuid": "ac2302c4-7af7-4786-b455-254663a8c347", "value": "T1B3463A279991CA88C4D5A238F7D3E78AA6547CDC0B3433EF5E9065260E7B7C90837768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271660, "uuid": "9f607f1d-45b0-4459-a1d0-e66c5b56ab41", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271660, "uuid": "25e7693b-b068-426c-95a0-5b37212d071c", "value": "49152:meaBlmZ119wBQQSIZ8Ey1AnutiRoZ0EpSfstaLiTmQ1UBklwMKPv3lSNTKS834:mjlQpHZ0E3taLiSQei+MKPv3lSBo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764271660, "uuid": "673bc7fd-21a3-4290-b9d8-e2a800f8db22", "value": 5774464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764271660, "uuid": "7aa7d818-e8a2-4e23-b63e-d194663d968b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271660, "uuid": "2b829d71-8856-4d53-a1a1-0580bc4eae29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff50a7c-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257373, "uuid": "e20d57e8-eca6-4c99-9d8f-f840f43fe69b", "comment": "Malware payload (Mirai)", "value": "233744f978c25330189b08d8968726b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257373, "uuid": "b28e9dd3-a250-481b-b855-8de50fc9fb01", "comment": "Malware payload (Mirai)", "value": "31c28f2da578bbddffeac801035704856e321b2cca89dd11f44043749a620ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257373, "uuid": "f9a84645-433a-4e60-b311-0de5475b4eba", "comment": "Malware payload (Mirai)", "value": "b6330ccc17323ac89435d86530e24f9ea65b9ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257373, "uuid": "36889a19-3728-4501-b187-83daeb97d177", "comment": "Malware payload (Mirai)", "value": "e2a5c89a67e0b839640486afc6be216f5b53e6e715505059b9689562437859f2a55dcd7300ac8a67ad9367905f4592ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257373, "uuid": "43963006-1304-4a93-936c-25bb978727cc", "value": "T14123F17D9C3E8857C80255F64F2303112D8C0BA712C3C9A6B684D2EEDA835AC7A87ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257373, "uuid": "107ba3a8-ec9a-4ebc-9c7a-b6c21caa5a9a", "value": "768:D+jm/igUe0HCLCO63QTxr4p8c5zQbP/sdY7vZciCjnn1hVT4jKxeHSxhHAcai532:DFigU7M6q4mc50b867miynvVTaweHSNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257373, "uuid": "e3ae4b9b-a0c7-4958-9bd6-bbbdb1d6d54d", "value": 48704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257373, "uuid": "cf8e2830-ed11-4e0a-ae8d-fdaebf6bfef7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257373, "uuid": "1cccacdc-d3b1-4f5e-b86b-0331e9fdea41", "value": "SecuriteInfo.com.Linux.Siggen.9999.28447.25832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e94818-cb83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764242428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242428, "uuid": "39b1ade0-e66f-4454-a6e6-2021ae2d8e8c", "comment": "Malware payload (Mirai)", "value": "52fde777ef0c5ac5b4bc779d7da0eb3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242428, "uuid": "7297b19c-1c33-47b7-8bd2-4f3d477fe330", "comment": "Malware payload (Mirai)", "value": "3297c330348c04db005ffd296a5c7eac1f393059d49c1b96d3871231def4a09d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242428, "uuid": "d7e19823-2ca7-41f8-ba7b-90e74554be88", "comment": "Malware payload (Mirai)", "value": "78ea405dac768479f284784a5029bfe6d5a5e9b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242428, "uuid": "d3afac38-0fe6-47cd-b050-270ad8bcce5f", "comment": "Malware payload (Mirai)", "value": "25def1600451a9f13a8a47f9852bf140baf21249725a08c26dd688f7128f842c5950a0935c56bdf2b5399401ca27ce60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242428, "uuid": "b669eedd-81e8-4099-9115-feb063f93fe4", "value": "T15363028F9994E64ACE086473158D5BF9903175E0335F8360A3490DCFF1C666EF82EAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242428, "uuid": "a34e4260-ef59-47ff-b729-8af6eeecc9fc", "value": "1536:DRi6ljYLH/kk8LWST11SewxLoff8Lyhohp:DRDmLH/kHTTkFoff8LTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764242428, "uuid": "0c1e1566-2c4c-4bac-b7d3-131248428261", "value": 70776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764242428, "uuid": "2824b5bf-f04c-452b-952f-8f1297ffcfd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242428, "uuid": "71a59432-a48b-47cd-93bc-3980b9b0826f", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bc350f-cb90-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764247981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247981, "uuid": "7de23191-bb61-4960-8c78-85e2fbd0804d", "comment": "Malware payload (CoinMiner)", "value": "51af695c38bf376ca6fe09914488e14a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247981, "uuid": "7ec05a56-1848-4659-bd7b-9cb695503b5e", "comment": "Malware payload (CoinMiner)", "value": "338c9c91cf6ed929a1ae73e0b104ab7a86374cd049d442ec27323e8b74f40262", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247981, "uuid": "6aad17ba-9dae-4f00-88f9-f778dfce9fec", "comment": "Malware payload (CoinMiner)", "value": "93452bd197a4afc3f639f017a679a462def1a05e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247981, "uuid": "5fcd9b34-635c-44af-88e2-06be99bb215c", "comment": "Malware payload (CoinMiner)", "value": "b84bb31ce7b9ac9538e60ee2141c4e87164a9a98fcc284e40683f0b9a6ae44aadf50ac04d9ec323703cd2c8228572f9a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247981, "uuid": "01b7014e-d02d-4fe1-a0aa-71694bc6c829", "value": "T1C602B60E66B52227E6C32225A99B558228674073020A1E647BFCC3C1BF91B79CBDD3D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247981, "uuid": "5a744b78-1a40-48c9-8d29-35a08d339015", "value": "192:y4EaO/Y6oAViZiicY8iXepyP4C0JaSzyi83aZldJX5youMbiSCyiKwVVU:iGPwZldBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764247981, "uuid": "bec227b2-1304-41e0-bb5c-9c3647f07710", "value": 9001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764247981, "uuid": "03ef95d7-1086-414a-b02f-0dee5ba978a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247981, "uuid": "1ed533e4-35a2-4a3e-bbde-e4685cb9357c", "value": "ihrewq.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5876ccce-cb65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764229658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229658, "uuid": "31430a3a-61f8-4bdb-adf3-e0449a9d7dde", "comment": "Malware payload", "value": "e11226487c2d9ec673933e5bb96e25ff", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229658, "uuid": "a73c3780-4b80-440c-b823-e716f264fd4c", "comment": "Malware payload", "value": "342cb0309275d3ffa2750749b44d7d0b8ac904dce28bf987924572d31df53616", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229658, "uuid": "1edd2310-2613-4f93-900e-3dd13ad1ffc8", "comment": "Malware payload", "value": "52ba07210cd1d71ab614d045fad36b94fa0ae40b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229658, "uuid": "0a2972cf-30b0-4b67-8e4b-cf9dabc10a55", "comment": "Malware payload", "value": "d551281a30ea0a70186e36c17e196ed87491cca0c1f1a89cdae55de944740aeb4c47fcfd7c1e4d456230ba13ebc9af1a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229658, "uuid": "e9ad28db-127a-4520-9705-1965b1792d16", "value": "T114157294CBD33EE6CA694E75E4827FB11200C851F961C9B3072519CA7FEB635DE130AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229658, "uuid": "d8d4efc1-2df5-4e58-9b03-c9044c8e9d31", "value": "12288:d9RGHWOBpqd7RZ97UkWfBRCk27r8OihgGpelO29/66U475:jRIW0Y7RZ97NWfBB2OHp6Od6U4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229658, "uuid": "d42fa8cf-2ca1-4756-9b11-c6bd47bc4a3d", "value": 948122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229658, "uuid": "3bd07fc8-63c7-473d-9dd4-dee17989bf87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229658, "uuid": "5afaeaff-3ae6-4884-924e-d773ef0f745d", "value": "VERIFIED 3.11.2025.II.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413f3adb-cbbe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764267844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267844, "uuid": "18f3d5be-1919-4465-a11b-adb801755c03", "comment": "Malware payload", "value": "cefbe272bf01a323515dbd40e20f005a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267844, "uuid": "40ef1236-a3d5-4002-be00-3bb96bc0d163", "comment": "Malware payload", "value": "35a04f4c8de8774eb25a2aae3496778813310290003541ce69b4b0b847ece650", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267844, "uuid": "54349c90-44e2-4cc9-a356-c94692eb548f", "comment": "Malware payload", "value": "e64964549d615b5fad2e86425bc6fd61e7aeb030", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267844, "uuid": "9026d263-49ce-4f7d-9bb4-b7a75c69cabb", "comment": "Malware payload", "value": "23c51a2279da7b74e0c0a3ec12272f775c73fc1cf0b8040ae7bb346c73bd442b61dee2abc0756e052aa32c3b051c3806", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267844, "uuid": "61347f89-7d09-4c92-8c8e-ed8f9ed4bae0", "value": "T11851733EA1C25B1081641D60A476EC4613E5D2C7CFBA085BF0D6A5C64FB630CDFA45E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267844, "uuid": "52897b00-69de-4d43-bd6b-56610750ae80", "value": "48:P4DY777x/WDtSteiu5gXdm4jZZJngO1I2rXawGbMJmltEt+tyh/:P4D3DtSteiu5gXgIZCyXawukgSYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267844, "uuid": "340a3cf7-2c73-4e1e-83af-ff5e894c61e7", "value": 2466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267844, "uuid": "6e37cb5f-4b44-41e0-83f9-1630415c1eac", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267844, "uuid": "e3df454b-98cf-4553-aa65-e53c07efa380", "value": "SystemUpdate_6598.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3a3dc8-cb73-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764235810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764235810, "uuid": "62063f2f-5561-49d0-b96e-a2ff771ccd71", "comment": "Malware payload (AgentTesla)", "value": "1e8fd87bb96ef849e132817a1aad762c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764235810, "uuid": "7b274c79-dd7e-4126-a5ea-a203ab6ea1a9", "comment": "Malware payload (AgentTesla)", "value": "35c4d93f942a492df6f2c7a905cc0c05d8d0013f8361ef0453762ce8ed74a6c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764235810, "uuid": "c88a5891-0a6f-414b-ab63-7e9851154c67", "comment": "Malware payload (AgentTesla)", "value": "b9a4487d6028ebc4c8c295cfc8410001087bc5ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764235810, "uuid": "f037b7cc-83e0-4c11-b9a8-80d180f737ba", "comment": "Malware payload (AgentTesla)", "value": "374ca1dc7ee1e37f13f3f463f2c100cc936eec044bd81e8573ca38fcea4772b23ace100d4ead23c9a972a91977ec097d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764235810, "uuid": "50b5b500-08d8-412f-82c9-ba1d06e3866b", "value": "T180D401982B6CCF23D8A66BF24575E23143B55E9EA462D34A4FDEECCF7511B104A00B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764235810, "uuid": "4332a4e4-c3c1-4be7-96c1-92b765e6142f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764235810, "uuid": "45dbf6ab-609c-4f27-bd2a-a445094f2326", "value": "12288:wLURA0+hK6MiG4JuC3HifyRapuRpI8FhPDw:VicN+3RCuPLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764235810, "uuid": "6b8c61c0-2c55-4a11-a733-931ba44e8b8d", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764235810, "uuid": "2244e271-d8ef-48fc-95c8-77404716401c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764235810, "uuid": "3103c461-7173-4135-bfed-8b450abb5935", "value": "rnewenq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d703e4-cb52-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764221710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764221710, "uuid": "742e12c7-81ff-4265-a07f-7dd5943298f0", "comment": "Malware payload", "value": "81fe9fd5212e59895831b19aa24bf4ea", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764221710, "uuid": "2545d6fe-4ea9-409c-8966-ddeb1b393502", "comment": "Malware payload", "value": "36dcb71c3e6ad260b231c9534ce9a4eae136610bff409e7bed6d3c49d545e136", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764221710, "uuid": "58aaa4f4-c2f6-4301-96a0-a04ec2174286", "comment": "Malware payload", "value": "04cafd6fa2fdb9d762d6022ab25f66e5a7d07265", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764221710, "uuid": "50177f30-8a21-4818-b227-a78cdfceec3a", "comment": "Malware payload", "value": "f32b220507108d2258a761926d54dea5bf8b2dbc878c51f98aaa46b1d3f3c8b8ffd9de5ffac39f666d868547bebaf5e3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764221710, "uuid": "085b5d07-5541-497f-8fdd-d9c827b9efcc", "value": "T1C5C2A81B1B5A842684D7D372C89BC592EF3491882441058B33DCD0F7971B1AEFB6BF6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764221710, "uuid": "3895958b-6f80-4b25-9d04-8bf898b5d20a", "value": "384:RnSpHfXdTwhq3nwfP5zCpiOSFdgA6VguA6VguFolRdBFolRn+73nw0PPYCogJdjE:dSpHfXdTwhCivFd3/Q7pNe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764221710, "uuid": "c1e39b38-512d-4aec-9ce1-378205000fd8", "value": 27319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764221710, "uuid": "fd550d20-eb17-42fb-bf8f-06434fbb5f5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764221710, "uuid": "a40bd9e9-55ea-4f26-9571-9afb0ea2a5a3", "value": "9293.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafefb10-cbc6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764271538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271538, "uuid": "a901b15b-1131-4c57-9999-3c3d42e68f04", "comment": "Malware payload", "value": "2cbf785c3d88db0b1dbcfc56123afd5a", "object_relation": "md5", "Tag": [ { "name": "fiscalia", "colour": "#81534A", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271538, "uuid": "16a2d295-b362-4e94-897a-4745a479aa92", "comment": "Malware payload", "value": "37a93478c75770fd1ad5543ce880376a593fcc7a2abf0858ad70ecc768f24abb", "object_relation": "sha256", "Tag": [ { "name": "fiscalia", "colour": "#81534A", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271538, "uuid": "6e920ced-2f45-414e-9b71-9e4d5e7dd161", "comment": "Malware payload", "value": "08c3fed94bfe109caa7aa18860338984db08b044", "object_relation": "sha1", "Tag": [ { "name": "fiscalia", "colour": "#81534A", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271538, "uuid": "6b1e1f6d-c4da-4fea-bcb3-981bdc0891f7", "comment": "Malware payload", "value": "0b7d4edc5883bdecedcf42c7dd90cbeda541cfd5517900c825fffcf6949adc4fb1ba1f5a39095e53d0ef72eefedbc082", "object_relation": "sha3-384", "Tag": [ { "name": "fiscalia", "colour": "#81534A", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271538, "uuid": "9490b04e-6dd5-4707-b519-1cf1f1d1a3d6", "value": "T1C086339E4895295D3BCEA8B48298DCD5783BCA4DE079843F96CA5F602F84D8B1E71370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271538, "uuid": "6a8cf8f5-f4c8-4b30-812d-4af672c4720a", "value": "196608:q+IHVzDQX4JS/52j4GeoxnS4+4aGjwvd0Y1fTv6JxTHThzyT:FIBDQXKS/48e+4Zwvd0QTiJxfhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764271538, "uuid": "4d670c70-493a-46aa-9583-2ee97070742b", "value": 8486212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764271538, "uuid": "2fe0ac07-2403-4c8c-85d7-3e38f9e6270e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271538, "uuid": "d72ffe46-2097-4f24-b899-47b22676ca63", "value": "COPIA DE DOCUMENTOS CITACION PERSONAL JUZGADO PENAL DE CONTROL DE GARANTIAS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e619fd9-cb7b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764239117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239117, "uuid": "d910ce3e-e532-4010-a503-7d4294d36ba5", "comment": "Malware payload (Mirai)", "value": "55d4e055bfbab966303e75e72c9be3e2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239117, "uuid": "dea3df04-a140-452f-8538-583633064099", "comment": "Malware payload (Mirai)", "value": "37d98ab4a7615caa8e54c667852d73a6e1bbd07ea9cb5758fbb02202cf5e3d84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239117, "uuid": "9d8663ea-f8df-4800-b9a3-4d293f795fd7", "comment": "Malware payload (Mirai)", "value": "c21ced9f498f814b402318f012a37a5dad35e72e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239117, "uuid": "65783882-c3f4-41e2-861c-7b968d99c6f2", "comment": "Malware payload (Mirai)", "value": "530df0608dbe6454ad699417016b9ff4bc3e4c9c0cae448507f1939e42a9f7d58bcf86aa87246108b3401279bf493150", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239117, "uuid": "c6460ecf-7137-4db6-a92d-c81aebad3639", "value": "T1E62129DE3799D402DF2D4EC43075881AA28D86E077250B88F6AD44F769DEB1D7329E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239117, "uuid": "37ee8e4c-8c0b-4125-a1a0-f0d0ef450768", "value": "12:qlUSsVUUNIOOAU1NK4HUFEUbUWTDkwUesHULKAUSvHUCcAUAHAUR:qW2UNIf7K97IWTDk1l0+lPCgGHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764239117, "uuid": "f119deff-da99-4d7c-8bce-ed4e1dc4067b", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764239117, "uuid": "7ceea156-72fb-452a-b300-c39217e94988", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239117, "uuid": "682ea228-4637-4e7a-b49c-db3557150011", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6118bc30-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223660, "uuid": "8a618215-6ff1-42a1-aa0d-ced46f82f1ea", "comment": "Malware payload (Mirai)", "value": "909d89409fb5099a1afc74843bc2d2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223660, "uuid": "7061aab4-90e2-4920-875c-66acaabb969c", "comment": "Malware payload (Mirai)", "value": "381ee83a1f62372df832db1eea9626ac7803a7ef490c8b48729df6c36e4de0a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223660, "uuid": "3c2f6540-8095-462a-8f63-3e11443236fe", "comment": "Malware payload (Mirai)", "value": "5d1b1acccf592323d3b88572a68aaba7e5c65566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223660, "uuid": "916620a6-a41f-4249-bc69-05de380e948e", "comment": "Malware payload (Mirai)", "value": "a24abc353581975d5e38e48f6b5eea8696c2f64b9616985b1162d40504ba314f3bb51ff49802b4f66a7184011489e56b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223660, "uuid": "46612b7f-fdf8-4c87-83d9-f49fde63bce4", "value": "T163B2E1A1A1863E72D770313AB97CCA00577B97F8A0FA72762524B7BC4BD2C4750B814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223660, "uuid": "7a07815d-dcdc-4407-a4da-40e160dcc654", "value": "384:5ZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdIhymdGUop5hKa:UX1De9kONQG5xD+jHMDzuIs3UozYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223660, "uuid": "53ffade9-a1fd-46fd-aa42-24c44ebc00b9", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223660, "uuid": "0267090e-b42c-4f96-8e82-58877f1bd793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223660, "uuid": "0b5a6f99-ca22-4d8c-ab32-889a142cadf7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0d5ffe-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236912, "uuid": "6bceb20d-ecdb-430b-a512-4ae2ad97611e", "comment": "Malware payload (Mirai)", "value": "fcd739dba63680a13f4a87f783e2bbb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236912, "uuid": "253332c8-6d5a-40f4-b976-a944fc2fa088", "comment": "Malware payload (Mirai)", "value": "395e672dd4d2a3a167e55b085a4ffba44108296dc448e5975cc43b47dbf35274", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236912, "uuid": "f455ab26-a27c-48de-ac5a-307914c9b203", "comment": "Malware payload (Mirai)", "value": "3225ebd4ac7e1ab0801bf8b130a198916078b27f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236912, "uuid": "25999963-aa62-478d-8cb9-789587fcbcbe", "comment": "Malware payload (Mirai)", "value": "e80f725d791dd53633fd6aa5db86ab4f3f855b93551dbbe7b8d98e32b368a21a966885dff6599676a11ebb1b5ad07d5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236912, "uuid": "5d417079-6c10-45a6-8509-e642102ffeba", "value": "T196144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236912, "uuid": "ca341374-5fe7-4825-9ada-3e625d0a8fd9", "value": "6144:9MygR/fQdiY2xN4aTBMvlZe5cgCHMhCm3r5M/9pTKF:9MBR/fQA1xN4aTBMvlZe5XabMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236912, "uuid": "db4a7157-e07a-4738-bff4-8bc97a9a0fa7", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236912, "uuid": "f5c515f4-a79f-404b-83ab-62b353195283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236912, "uuid": "668edda9-6b03-443b-bda6-dd530b868f1f", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7375c660-cb65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764229703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229703, "uuid": "2070791f-a856-43bb-8cb4-3f3a4c3ad1aa", "comment": "Malware payload", "value": "1851ea94ae83c448e0c6be209e2fe384", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229703, "uuid": "904e1ada-dd1a-48de-a373-778faa977b43", "comment": "Malware payload", "value": "39bb176fa6f892447cc618334056332f7e06d42171ecfa4a80be8b05cd8526b5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229703, "uuid": "ae9e66d6-ccce-46ad-9ef9-413a0f2958fc", "comment": "Malware payload", "value": "91a50472b20c3894da35d3d7d2e53fdbef875e01", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229703, "uuid": "fa22120e-0d07-478c-aace-339399a9a2b6", "comment": "Malware payload", "value": "325406d6ad6f0a037a33427aabdaaeccc5858beb55fba392976043cdb669eaca0b6362295366ba79ed39660ece285953", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229703, "uuid": "99051e87-fa82-4a62-96ee-ec54173e2fa6", "value": "T1BC25CD25F4A63671E88DC4B009B02DB003E57DB5136B67C423723A9F97A7F6E8A60D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229703, "uuid": "8f4d48ed-1409-418c-8e4d-359f1177540c", "value": "12288:b3wju47FCVNLz0MdiTmRpbdui07SG/eYxLDSN7rLCrt:UjugFHMdiTmRpN07Sq3x/4mrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229703, "uuid": "d7d08648-9b8d-4b8c-9193-347825c2a021", "value": 971245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229703, "uuid": "2f7284ac-564a-4a37-ab20-bc0cfc232367", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229703, "uuid": "267f629f-28f7-4542-b415-90dbe0ad5e7f", "value": "583cbc3cf2633f1e326b7e85d7117693e35373cd994b4c2b4b4c0d78403d4369.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f4811d-cbca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272932, "uuid": "704fc101-a11b-417b-be92-fc68b466550a", "comment": "Malware payload", "value": "816e0d78474a4dba39e8ad020b28bc6c", "object_relation": "md5", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272932, "uuid": "d02e1929-dad5-41db-a913-7460c4c01ac1", "comment": "Malware payload", "value": "39c3dda8c61c214b87670d156f82217318d47c396b366908b24b22bfe6f8a1ce", "object_relation": "sha256", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272932, "uuid": "183ec727-464a-4e88-a70b-8e0ea0e0281e", "comment": "Malware payload", "value": "7ce55a7ab2bd089a17d01a1f9509119c33859870", "object_relation": "sha1", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272932, "uuid": "c4b8e94f-06fb-432e-b7dd-f7d3b5fa1a66", "comment": "Malware payload", "value": "d9dc699f6b94374d560e4804e13c8a3a991050123827d6bff4439ee4eee26859cabd82189f34be55ea45fefa116d718a", "object_relation": "sha3-384", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272932, "uuid": "de7a6436-dc4c-4ab5-9d6c-d18c5fbed6ed", "value": "T14087233AE39C5090FF578AB3C7694E4C44DABA9016B7D8A53B3879114EAF2C14B32747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272932, "uuid": "fa2ed729-b031-4376-b854-1bd5414f1ee5", "value": "786432:jVkuJ7bHE+qCVGXPK1XhQOsYseq7XoyXPtIoKZPJaYUN2p:yuJ7TmYjQ7Y60EQsYnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272932, "uuid": "f8e7ed43-d065-4125-80b0-e053ab1c9863", "value": 36212085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272932, "uuid": "5d84a851-5305-43af-8099-6cade8fa33ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272932, "uuid": "72b2bdaa-cc20-4475-8c6c-33467993fb05", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e28e7bc-cb65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764229668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229668, "uuid": "9f055d35-22a2-410b-8aaf-0cc2a21c4734", "comment": "Malware payload", "value": "f78fd7e4d92743ef6026de98291e8dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229668, "uuid": "e4343683-f466-4c35-9b87-8b6d4f89dfc6", "comment": "Malware payload", "value": "3a4f47c60edf1e00adb3ca60a7643062657fe2c6dd85ace9dfd8fdec47078d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229668, "uuid": "c46f745c-6b30-4924-bccb-54b8b53e4f09", "comment": "Malware payload", "value": "0559c07b81a6816a816d461c6b2e292a9291f139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229668, "uuid": "af7b625f-8146-49a3-814b-ee66c3b52df5", "comment": "Malware payload", "value": "5ffbde863fddbe1da97906b14e1cdb761eb64d06f097a17fd78130de596a639d0b6fa9f7fd32683861c4cde854d53b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229668, "uuid": "3fe01203-2d28-49b0-9a8d-2bed0cd508c1", "value": "T1B155CF51F683C0B2E59102B16476DBBE4A7C6C340762D4D7E3C43E77D9202D1AF3AA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229668, "uuid": "1cb39aff-a409-4384-9a84-ec02c240378b", "value": "23f20f26a15d3def163ec2913c659767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229668, "uuid": "3a976069-d65e-4552-8c6c-c006f6a7e582", "value": "24576:XaBoYT/tl04dzm6lNbAELuqINTJfc6RxfoW4E43MOqcK:KP/tljlZLYNTRbB4HqcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229668, "uuid": "c5bc49f0-aabb-4f88-a4ac-9117fbe46005", "value": 1313384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229668, "uuid": "e9a6b7e8-ec4e-4e88-b199-4d1200b5f0bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229668, "uuid": "f49c78d7-143c-4c0f-a30d-3eed2bb1ea56", "value": "3a4f47c60edf1e00adb3ca60a7643062657fe2c6dd85ace9dfd8fdec47078d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3119327a-cb83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764242477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242477, "uuid": "cacf17a5-cb02-45c8-bc12-c41172ce4faa", "comment": "Malware payload (Mirai)", "value": "c252d95da6d16cc6df1e3330f1469f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242477, "uuid": "11fb6846-d127-498e-8641-170aeb6194d7", "comment": "Malware payload (Mirai)", "value": "3e4e05a0b2c28dbbe0e7ecccda1e8f7d61e32a30b3585711700df2acf8291aef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242477, "uuid": "53575f2c-2df2-47db-9c2e-df4c80220e53", "comment": "Malware payload (Mirai)", "value": "6a0faf14801014abe1d33622d1379d6b256f851c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242477, "uuid": "dbece24f-bbc2-49c8-a256-c9e3a2e09a33", "comment": "Malware payload (Mirai)", "value": "cc2597ba48032adfe1e986e2eba483da629fc25bbf2792eabd4f7d0c4417668077d3d9b017e712f8f821688646849bd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242477, "uuid": "1666ccf1-ab4d-4978-82f6-63847b20e6d1", "value": "T11D24D60AAFA20EBBE8AFCD3306E91B0124CC651721B87F357674D518F50A68B59E3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242477, "uuid": "9e4e5716-30e9-4b2b-afdc-131ae2861355", "value": "3072:TeUc9NbjWdFzhNb+ULTWeHTaCZFiiyZNeXwBQaB812/s3:TeUYNbjWdFzhNSULrHViTzeb1As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764242477, "uuid": "7b831c6d-b555-4e72-b572-ca0f5e6923d0", "value": 227224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764242477, "uuid": "c01931fb-fe1a-4191-9ba1-e05bcc8a6be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242477, "uuid": "1da6f7e0-12ff-42a9-9f03-a5cb1fc9e508", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823a2ba2-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234453, "uuid": "c8347c0e-5055-4311-86a0-1291c33fcbbb", "comment": "Malware payload", "value": "15ed0608c2c0819e99d59bd6e88857ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234453, "uuid": "cd14a02b-7d89-416b-a43a-d540e1761985", "comment": "Malware payload", "value": "41487f546420de7413316b7f9b77dcc8134f8689c4347a46e6d7f9ca8427c81c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234453, "uuid": "539917c0-2b8b-406b-b815-1de39d9c05c6", "comment": "Malware payload", "value": "1d38b37f8b900bb338bcb94709dae72174868fe9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234453, "uuid": "718615fa-da74-4604-a10d-a493242409e8", "comment": "Malware payload", "value": "aea2fd299a29e29e7e250f02b07a9bd2eda10ef7a1c910eb156d6b341e4bcf6f8cee00396f3922cf5d5ee703071edb82", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234453, "uuid": "d3b23cb7-4373-44ef-95de-dd8bfd2fb8c4", "value": "T1CAE61227F74A7DAFD8FBE330897A15A54029AD168F07A287793C733D04B74D59A862C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234453, "uuid": "1c84a36a-a432-449d-be04-efbe2d1bc0af", "value": "393216:B/9MfPCssojkuvaNJHn6AAHNy5faR+uGCm:l9MfPTAMYn+HkMsuG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234453, "uuid": "b93e131e-ea12-4a2b-886d-e91739a75ff2", "value": 14108254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234453, "uuid": "0dbd6b23-f99c-446f-a8b3-2ede6b8a45d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234453, "uuid": "c14d3b9e-9dfd-4b31-96c2-3a42919c1fe1", "value": "RODONAVES-RASTREIO..apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57064d90-cb7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764239963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239963, "uuid": "6a212911-cf57-434d-a5ca-e457fc3edcdb", "comment": "Malware payload (Mirai)", "value": "50de7cdd6490b4d1ce6a53fd0745d160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239963, "uuid": "d8f61a73-7197-4a36-a2e3-4ec3e62336ae", "comment": "Malware payload (Mirai)", "value": "432fd59805e28c16056678ac0fd5a211782ac81c39f06c239c64eb4060647425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239963, "uuid": "69c983a2-53dc-4125-b6e2-ada1ebb65b86", "comment": "Malware payload (Mirai)", "value": "8301b4e7b11aadef4c34077cf25059af17f02d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239963, "uuid": "0dc3f326-5ca2-43bb-b97f-a72672c7e776", "comment": "Malware payload (Mirai)", "value": "cc1b9f7274693227f775d2b410d27c40f02657842daa10feea64e13902d89bfdf7ad7d994529756915a7c473053113b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239963, "uuid": "257ece2f-fde5-4b06-8205-1a51a717b528", "value": "T1FAF32A86FCC18A12C6C262BFFB5E428D372657A4D2EE31039D665F2037875AB0E37645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239963, "uuid": "7c9fd4f7-9e8c-4abb-adb7-2f2ce91a4bd2", "value": "3072:45EPkPKKrx2gJnw1C5XF4XQ1rqkOIL5DnS:45EPkyKsgpwsJF4XsrJtL5DnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764239963, "uuid": "23e1bbd0-5355-4339-b229-66499967cd1a", "value": 170752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764239963, "uuid": "cda0eb86-1ef3-4d74-8e30-78cb84b62107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239963, "uuid": "4ed8d028-244d-4ead-a15a-3a04f3c19fc1", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e774f58-cb8e-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1764247304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247304, "uuid": "a179eebf-2f18-4949-b597-dcb0cb684d42", "comment": "Malware payload (N-able)", "value": "bfd717c55d116a31fd605dc57fce807b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247304, "uuid": "622f6209-e1cc-4a86-8144-70a1e91d0543", "comment": "Malware payload (N-able)", "value": "46a32d339828d82efd819cd9cd484bb985da500cfe1d48d350dd297c4ac603eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247304, "uuid": "e647ebca-1a82-423a-93f0-dba887fc3d0a", "comment": "Malware payload (N-able)", "value": "9068438e0d8e6516051b5864a46ee986055eff9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247304, "uuid": "ed7459ec-6538-4a78-9c4c-9352a2cfc84f", "comment": "Malware payload (N-able)", "value": "8bbb8795c555ba0840e573470e6bab336cd971669b86bdac06482082a825741e21c7c53259801acbb64eeb0d80044ec0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247304, "uuid": "5ce834f7-9836-46af-9171-26f2ce990d6c", "value": "T176E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247304, "uuid": "615bd513-c6b7-447b-a0ab-0b939df0973a", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247304, "uuid": "1445a2c1-f235-4fed-b0e0-66eaba1ce568", "value": "393216:odF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1M:wrRxvoC/7a0jUxX7h1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764247304, "uuid": "ca8109ab-70f7-4a00-a5f1-4970df70da59", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764247304, "uuid": "bf61fed3-070f-48e5-be29-8c84fef15ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247304, "uuid": "e371560d-e868-43ee-a642-e20e771d6a9e", "value": "OR\u00c7AMENTO NOVEMBRO.2025.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8d4936-cb48-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764217290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217290, "uuid": "adcc9db4-1ac1-4de8-86c2-1cf63e7a28cb", "comment": "Malware payload (Mirai)", "value": "4a3c9989c0ee42f892b80f330fb35f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217290, "uuid": "d56b717c-7f9b-415b-b4a0-1bf7e6544fba", "comment": "Malware payload (Mirai)", "value": "47ed17ad448e0b61bb28f9e75f412b7ed72c1e39557079b8e749f070f22a7c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217290, "uuid": "95760ab2-360d-4331-8cea-da01f1b74f81", "comment": "Malware payload (Mirai)", "value": "5e662d8e113d760724f12ff93ad2c7d77d20a437", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217290, "uuid": "dad8f76f-b264-4898-a53b-9892c9dff25c", "comment": "Malware payload (Mirai)", "value": "34bb00728d7711e55364151c20f37a4469facfd65d0fb53d4097aaed14ad42faeb0d9858a50de6d4a84a733ae7d3a95b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217290, "uuid": "e6062f43-496c-4186-87c2-0e8527bd255f", "value": "T1BC346C02B71D0643F2571EF03A3F67D287DDA6E035F5B688294FA6815276E372285ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217290, "uuid": "35dbfbe2-4045-4389-9d7a-53d1cb7ecdaa", "value": "6144:kRQxmOWt45KyTmNR4LjcBDVSfH4GpZk5JQi:BtxTqRtBBM4GpZk5JQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764217290, "uuid": "dbe363d1-ab17-4921-bb0d-177db5bc2a2f", "value": 250752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764217290, "uuid": "f9f837d1-38da-4011-b4cc-e31188dfd5af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217290, "uuid": "403220ca-2081-4714-86f4-606299331e10", "value": "powerpc.urbotnetisass", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4449eceb-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236926, "uuid": "9de67b8c-8807-43ee-b28d-929e1e441ee2", "comment": "Malware payload (Mirai)", "value": "b9d96858749eec790a8bebcbaeca3091", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236926, "uuid": "d774f617-1623-4541-9ebc-7df1dc5abbae", "comment": "Malware payload (Mirai)", "value": "48209ada6e70b18c0ef4f91c926eec0b653e8f179e29cbefc6b16a9152701fe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236926, "uuid": "bb2d2e6e-5277-4c2e-96cf-54ede7717af4", "comment": "Malware payload (Mirai)", "value": "39a101c771c8042335e6432f2e18089b25cb9bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236926, "uuid": "96d3902f-eba6-4da5-81a4-d335ac674ba9", "comment": "Malware payload (Mirai)", "value": "eb35c6b0fea78d04b23a3b2b56da64b6eb22f74500b648a89c136803ab6076ccd85b19a2daa6211fc01d3654fccc8d99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236926, "uuid": "cc0854a6-7d7b-4a2e-8b0b-b1666ffd0705", "value": "T1B9830842B8828B3BC6E0237AA66F658E37A167E5D3DF3117DD249B21378111F1D67E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236926, "uuid": "74955ded-a3f6-46b7-8240-6f4b33fddb71", "value": "1536:EPmBcPJUqiBlU+utCt12AGIkyxFXyQ2csFOQOCHFmKgAHCe:EPmBcPJUqiBlV34OQOCt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236926, "uuid": "851163d6-ab8c-408d-b447-7a64597f1283", "value": 81500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236926, "uuid": "71d3561b-c316-4df4-8ccd-187437ab2f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236926, "uuid": "0caa8496-8871-466d-bd0d-8ab1e15d37b3", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2220108a-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236868, "uuid": "7282fa94-c567-4ba2-b06d-22681adc6c36", "comment": "Malware payload (Mirai)", "value": "dbce680497b3c3425a7a0e2b57581415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236868, "uuid": "97e17247-edf9-45ae-80c6-8653e312b4b9", "comment": "Malware payload (Mirai)", "value": "4993faca41f1d8c2a44adb82741cf8b569a81eb02a76a8dc55a607e474efbf4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236868, "uuid": "c9d69d29-c841-4bd1-afb2-3a7301355126", "comment": "Malware payload (Mirai)", "value": "7d21bdba58b0517c45f3691c9ea8209ba53a8f6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236868, "uuid": "c672497d-e84f-4f67-9cbb-117b68bbea36", "comment": "Malware payload (Mirai)", "value": "4ea9a8ac58acf5c73dd68d0f6d0b851a38bf01b8c6eaa705da588727b38f8f40888e346ea658ec7a827060974ae7f82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236868, "uuid": "9e86841d-297f-438b-a9e0-166479f09713", "value": "T1F3330154EF5764F3C7F81876CBA4C54BEF3E87A8F05B11420B658A28A4AE26D16EC143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236868, "uuid": "b30c1ae2-7a96-49a0-a74b-31d82405885d", "value": "1536:vO26s+W5T7wktU+YbeZG5C1X8k+XdVSjfAzTAIiLv:m+5T7wkR5irhzwLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236868, "uuid": "044341d4-3671-498c-bf38-3a28b8efa161", "value": 50320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236868, "uuid": "e67014af-a497-4e26-80ec-6ffbdd776774", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236868, "uuid": "2783b83c-0bd0-4ca1-b833-399aa158b62a", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d578365-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234444, "uuid": "5fb11bc0-fe41-484d-a1f9-f6b34a8180f7", "comment": "Malware payload", "value": "b8b758fcba1e22bd6bf55679c3429b7c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234444, "uuid": "08899ef4-9f9f-45e7-8085-1e04e576de43", "comment": "Malware payload", "value": "4b7d8b8a1509ad2cbc8ab60bf8d090c2a26bca8aae42d19b845a44ccb1d714d8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234444, "uuid": "596f8b76-a9f8-4b42-9511-15fcc353ca5c", "comment": "Malware payload", "value": "451fcd947c71f10d662bd2e9ae6fc1f810742797", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234444, "uuid": "8f8ad168-c0cc-4bda-945f-6fcc00f24a50", "comment": "Malware payload", "value": "fcc691b0c2c9720ea4dc26cc3eedd428a674bd078ee71b43d8e736c31bbb7aff8371f8c9bcaba2c0105314c2faa7a51f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234444, "uuid": "b1a43a7a-29f0-4b05-94f0-5d1d40c165b9", "value": "T1F0F533AF6B09B2F5FE7284C42BDA513BE8DF9A849F399FCD54036506226D953D38010B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234444, "uuid": "738d3c05-b832-46a1-857b-dddb36e347a4", "value": "98304:hVdWn6b2WZEbona4bNMfoxE3/8F9P4bIpV0vAzXHza:tWkaEGfoS3/+2IL0+ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234444, "uuid": "87cc5e59-980c-42c3-a777-e3fe80cce8f3", "value": 3410167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234444, "uuid": "93065df9-21f9-435c-a86c-00666b317d57", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234444, "uuid": "e720eee2-aaf8-4231-a068-86992bca5296", "value": "Hiep217v3.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4b0935-cbb6-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764264585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264585, "uuid": "5155d283-1eb9-4ac8-b9a9-48d5b6e09e51", "comment": "Malware payload (SalatStealer)", "value": "a9a4710c1bbdfade91e1feb96327a5ab", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264585, "uuid": "17840dcc-6202-48b3-8e01-ad07a47d7999", "comment": "Malware payload (SalatStealer)", "value": "4c2e33337ed4c8624d4eba268791c20755d88844d637f0c1f823d5b12d71b2d3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264585, "uuid": "5fff6f2d-7edf-4f10-9267-c2bd4dad74f4", "comment": "Malware payload (SalatStealer)", "value": "41bb608289effba0ad31807c9879d93384e8cdb2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264585, "uuid": "20a853f3-1d3f-4238-a118-bbb32e5d1899", "comment": "Malware payload (SalatStealer)", "value": "40209746608712f94376555e008620b25aa6976a7d77a47360bcc2099ceae75a57a7f3aea2abb23441372beed6c3b666", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264585, "uuid": "7336148b-1e65-4426-a126-b92f53deefe0", "value": "T1BAE5336C252033F7DF3A53B3058E044797E4A0636A85BBBD96982E47E84B851ED6CC8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264585, "uuid": "eb8b405d-de44-4afc-8523-165894545912", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264585, "uuid": "cb70c992-da40-4571-8d8f-408f22cd89cc", "value": "49152:vA3FDJrgcahRF+/btMV2uM+8lUDC2OY9QP2hD4oW7VfHuZKLii0JKHWA9Y0:v8SXZ+/beT4yw2hDNW7VfuZKv0JK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764264585, "uuid": "47190acf-ef96-4327-8cf7-8250223145e5", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764264585, "uuid": "75316dec-34d5-4600-a33a-ed3f40d6f69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264585, "uuid": "defb3321-0c98-40bc-8ceb-21f1d2af7860", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d73bd7-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223698, "uuid": "7a8f89e7-a21d-4c6d-94e0-bee8a3447a7b", "comment": "Malware payload (Mirai)", "value": "ee44ecfd0d0d1843b4188deea006562b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223698, "uuid": "5b24c781-5367-47cb-af25-269aea383c9c", "comment": "Malware payload (Mirai)", "value": "4db9511a5566a5428105b1aae381d6a2dc9fb76781378e02a0fa464e925414eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223698, "uuid": "5a22bfeb-a9f5-4bf6-aa6e-31abbf06ea59", "comment": "Malware payload (Mirai)", "value": "b5d83716f478e3e17bd1a3f532aec95ca89702ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223698, "uuid": "19d30845-9d51-4b25-a820-1aab791f7708", "comment": "Malware payload (Mirai)", "value": "91ca02df4c921f9e03f72adaa14a3c309c523b6fdf9668669fd1db6044556ccb04c197760d3c9b02a15b3854d4adc902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223698, "uuid": "cf4332cb-08d0-40ce-ba2f-7503d9a9f30f", "value": "T1BFE32B46F6418A13C5D61777FAAF41493322D794A3DB330699285FF43F86A9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223698, "uuid": "4f63370b-9c0f-4081-8770-569825353255", "value": "3072:FYvMxqixyDJAmUzdBJXu9WRtotmLFQTihv5X0clM/9h4b/kP:yvMxqixyDJAmUzUSotmLFuiLX0aM/9KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223698, "uuid": "02f9fd8e-c344-4f19-a739-68c6542c3d37", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223698, "uuid": "57866f3b-b337-4d07-89f5-0eead6fc222d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223698, "uuid": "7594f858-be90-486a-8bd7-b8e16faf68e8", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43101e2a-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236924, "uuid": "0e59767d-01d4-4c65-a1fb-098436513d8c", "comment": "Malware payload (Mirai)", "value": "1bb5ca7c2d26d0d9d51ecb634db19204", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236924, "uuid": "dcc62daf-f7d7-45c4-b66d-2864d8cc1543", "comment": "Malware payload (Mirai)", "value": "4e4818a6544bb10b1d65c2a61f4da309202a215bd94c095ea78a4f26dbcb2d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236924, "uuid": "39e07481-7242-42dc-906a-77ab3066c904", "comment": "Malware payload (Mirai)", "value": "975f37aadd59e01d902e56e3aca2536cf7e25653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236924, "uuid": "8b219e3a-a4c5-484a-865c-fd3489a3ca7d", "comment": "Malware payload (Mirai)", "value": "35ed617717e3e7f8ebab3548b2d34c6e0bf4455107b712daa640b157217c084cd8646e43a49d65c1306c5f4a6a1719b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236924, "uuid": "70667b5d-794e-48f0-9c54-29be39a82599", "value": "T100B33A51F8C29A62C6C7237AFAAE41CE332227E4D3DE7117CE256F21378251B0E67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236924, "uuid": "f5fd236b-dc2b-4ee6-913c-e48ba6ac2866", "value": "1536:eKOxMi7VgxWNioQRnRoHi2X1gaBwP6Ks/XkmSlx3lJX6s03zxsvAx6VB:eZxMi6xWSaB9jSlLJ6iAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236924, "uuid": "f604b6db-5a63-4416-8de6-dc9b9c1204a1", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236924, "uuid": "c5f8a52c-3d34-4407-8185-f943e2804f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236924, "uuid": "f666df6b-e0aa-44fb-b89e-65f009d36ed7", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261f1233-cbbb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764266510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266510, "uuid": "08449e2a-f813-4aa5-80a2-2e8eaee8a790", "comment": "Malware payload (Mirai)", "value": "4cd5abff9028e8f8c1e5266e9f565496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266510, "uuid": "8c8b6cc5-19bd-4ddb-9639-618c799ee9dd", "comment": "Malware payload (Mirai)", "value": "4eb8f2bf3fd85e095b2f240ddc01526c4ed59cc1c86eee8937e18a8a8ab4f061", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266510, "uuid": "c034cbd1-1065-42ab-944b-2a2aebfb31b0", "comment": "Malware payload (Mirai)", "value": "2507d3d8d69913c420f959bc0e60d4de4292df56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266510, "uuid": "0b9e9ebb-f8cb-4d61-b620-8f7deef05e4f", "comment": "Malware payload (Mirai)", "value": "81c6b214c5f45329dd1737295f3c1795dc7cc4613ddac09b27fdf3dad2470f267021c5c757d3b8da18b401833b8302f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266510, "uuid": "d80c22bc-81ad-481d-92d3-67428eed30dd", "value": "T1F343F155A9BD871AF119B13AC1CBFE530D25A31A368F42DDA09432572D2EFBB250C3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266510, "uuid": "82de9baa-48f4-4b82-9362-88f34bab5376", "value": "1536:YCoEygGf3MBWzfvPPprhZFwr09lYod8nouy8tyd:sEFU8B+PPpVZ2r0jooutE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266510, "uuid": "7fdce7c3-c886-49e9-b359-fd39c8bb22c5", "value": 58100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266510, "uuid": "f8ef017a-bf0b-4835-9ca4-ec2070eb62c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266510, "uuid": "2773fbe8-6a03-4c3f-86fb-aa9b4c702384", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d2a5dd-cb7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764239901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239901, "uuid": "930eb74e-7726-494b-a8b1-f300e5d6cda4", "comment": "Malware payload (Mirai)", "value": "543eeb5eebdc3b63253221a9bd3385cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239901, "uuid": "c5e76803-24db-48ad-94d0-00ac727acfec", "comment": "Malware payload (Mirai)", "value": "4f58e8af8f23cb9cf4e646d1d7c4197a3d52863938289c52b053f9a2d1109cdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239901, "uuid": "e2a859ca-dc4f-4cc6-904b-68caf3b513ba", "comment": "Malware payload (Mirai)", "value": "98fcb9c06d9856e7229e906b5f9b50e67a959566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764239901, "uuid": "d84e7da7-ddb7-4031-9386-6890454bfe07", "comment": "Malware payload (Mirai)", "value": "1674818e3c45280238850223e507878be282c238dd6723fb1f7d1d78b0c93c5b8eddf78e73158ee03caa54e49549f24f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239901, "uuid": "9c1a1bbe-95cf-4394-9329-1875ca41bab7", "value": "T15053F131D312C9F2D1F036306E9A8EC538179B7F7075265FB82256B99A470D742ACACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239901, "uuid": "8459910f-1b4b-41ea-a03e-a442c29861ea", "value": "1536:iXw/U2MjCzg2JgV9y/wQCcap5PTE16yS97EDzNpb+vvMztV:iXwc2MKg9V9yicapBEVnNpUM5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764239901, "uuid": "8751b4b0-3680-46f9-bff9-6a539ba524a1", "value": 63564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764239901, "uuid": "59d60ada-0bef-450d-a788-b4a3379910dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764239901, "uuid": "d2b2aae2-bb3d-4f46-838c-b1d779b631fe", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc62fc03-cb6b-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764232429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764232429, "uuid": "4f3d1072-62b3-471f-b97d-ac2b6dbc0be4", "comment": "Malware payload (RemcosRAT)", "value": "38bb9282346ed2e04f558d023b11ffd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764232429, "uuid": "d82a659f-737f-43c7-b840-3a411c8db1c1", "comment": "Malware payload (RemcosRAT)", "value": "4fe34e5958a34b04a05f731aeec5eeb6c69b7e4b38c1bd0dd6d8bcb3e532f25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764232429, "uuid": "8b729d92-d8d3-4426-9ed5-140be684299b", "comment": "Malware payload (RemcosRAT)", "value": "6182000d0f4b8ec13b5647494009ee6d12492684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764232429, "uuid": "85ff2082-b4e8-4b91-9df1-8221a7d0e1b0", "comment": "Malware payload (RemcosRAT)", "value": "0320a14afeccd992396ebd9f474176707cf95ef223cac0baa9a737d1a4c28f3a8a9e04b4b39a6a5c14ed66212eb1c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764232429, "uuid": "f0ec732c-bd5f-45f7-b0c7-dc2d83657556", "value": "T1E725236426A8D733DC716BF62475E23103B52E4EA263C70A4EEDECDF7265B204A50B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764232429, "uuid": "1ec913dc-cf30-4d1b-b1d3-bb5d76231d12", "value": "24576:Ymx0Pq5mMbr8CftV3BMV1hlXmEOBX9Sn7EA11ad+vOZ/TamAT:YmxHrIEN2HhgLX92YW1sQCW3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764232429, "uuid": "7d9314dd-9230-4a82-8b1c-f51dcc6e5774", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764232429, "uuid": "1a82414f-9d63-4ed3-a99b-b3696a1a9b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764232429, "uuid": "8365d64d-5ca5-498f-911b-1f2ed38caa0c", "value": "VGM Declaration Form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddecea7-cbe2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764283300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283300, "uuid": "98c02fe7-73dc-4b27-a350-56d24c39a6ab", "comment": "Malware payload (Mirai)", "value": "b8e6dc387799fb89c08cda50c8f35636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283300, "uuid": "9b7e9b9d-bbdd-46e2-a9c1-af17f8a0ee57", "comment": "Malware payload (Mirai)", "value": "500d9b2a176f8f07022293f4f42cc1063181c6f75840c1bd248b8f6875f3997e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283300, "uuid": "23b3b749-ecc1-4973-a4a6-5d93ff2858e3", "comment": "Malware payload (Mirai)", "value": "0b88a49772b488464d7ba38943347e5cac3d8587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283300, "uuid": "4848cf78-07d2-416b-aeee-b3e3e778a801", "comment": "Malware payload (Mirai)", "value": "3b56942f73238973bb00a381a9a34c9d6f57d24bcbb82d72a923f14fe58ef3f2470e44bf2dc9d8df3d852a88e6619620", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283300, "uuid": "3aa9dd8a-cadf-4f7e-b6c5-292c5f6a26d9", "value": "T1D1835C22B93A1D1BC4C8B87A62F74325F2F6570A21ACC61E7D710D4EFF24750225BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283300, "uuid": "f14b6c41-41ac-4031-ad12-23be19bacc16", "value": "1536:BduSjosnWkImf6kqs1ZeJaQqedKbpkgPvhtCSQ5wb5tEeQchtf:zvqfmPIaQetkSowb0eQCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764283300, "uuid": "579b4909-4f6d-4c71-b458-d5296b898da6", "value": 83152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764283300, "uuid": "962cbd2c-42f3-4141-b720-6e76f97c70d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283300, "uuid": "c0724f31-ba52-4192-a68e-bd8d857285d1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f56075c-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272512, "uuid": "f8a40bbb-3220-4bbf-b30c-d8d737bd5953", "comment": "Malware payload", "value": "96b5545e10c96098eafe1ca2b32623a6", "object_relation": "md5", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7722", "colour": "#D11C6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272512, "uuid": "3e48682b-b545-426d-bfa0-2dd9c2ae2af2", "comment": "Malware payload", "value": "50ae851be44c249accc26b0a4dba9c3c93ee6434b7e87a4fcd55f6f387aee84a", "object_relation": "sha256", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7722", "colour": "#D11C6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272512, "uuid": "822c7442-4f81-4361-8bda-c74b9e9dd0e3", "comment": "Malware payload", "value": "c65292e919961ee9f835dc0ef9338b60caa9aff5", "object_relation": "sha1", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7722", "colour": "#D11C6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272512, "uuid": "7b48dfda-af55-4163-8f1b-236d3d8c9ab3", "comment": "Malware payload", "value": "43659e2a837e3b767f18341ac8cf02e2a458a172bac26e5d71d55451f040fcb9ed8879a1ba97363f9ca815f84034e264", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-7722", "colour": "#D11C6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272512, "uuid": "5753a158-4c76-48eb-85a7-37074916fefe", "value": "T19ED633760B023D938908CE6F9AA8E0566589F971D8F6F317E7308937F3C90192D4997E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272512, "uuid": "42c4d130-fa18-4759-8762-1e9a9a4c8f52", "value": "196608:PARDRJHVGUaL0998Nhby9BNmyfUO/WkGdcZUA3vCsPAEu9PLYDgR:ODRJg/SIY9BJpwcZU4CIAEut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272512, "uuid": "17ec8e7b-3c33-4098-b33d-aefa5a6fd430", "value": 12906170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272512, "uuid": "d78bb10a-b3e4-4937-ba9f-97b806ab44b0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272512, "uuid": "622cf770-df14-412c-924d-77743a4731da", "value": "\u267b\ufe0f \u27ff \ud835\ude73\ud835\ude7e\ud835\ude86\ud835\ude7d\ud835\ude7b\ud835\ude7e\ud835\ude70\ud835\ude73 \u27ff \u272a \ud835\ude49\ud835\ude40\ud835\ude52 \u272a \u27ff \ud835\ude4b\ud835\ude81\ud835\ude7e \ud83d\ude807722.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7b6a4e-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764237129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237129, "uuid": "8243d582-bbbe-45f3-a60e-dbf03020f45c", "comment": "Malware payload (Mirai)", "value": "6b4030b08b15944db8de1cf97fc0cc5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237129, "uuid": "a8be110c-87f0-446d-be04-0ec0c90e3307", "comment": "Malware payload (Mirai)", "value": "50c28932d4519f101c14d6fd24b62f4e2c3bedea86d397eac92adf2a6d6e14df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237129, "uuid": "0b19d29d-67fd-4213-898e-89f6f6aad4f3", "comment": "Malware payload (Mirai)", "value": "90856662ff096405129e54bbc751d2e92946513c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237129, "uuid": "c37b5fb4-5e18-482a-aedc-3a32bd702b2d", "comment": "Malware payload (Mirai)", "value": "7ca88d0af62296731056f359c407d9dbf39021509ca5a77fd9a4a845c8f26bca98165d200733d4695afcdf26be9abd6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237129, "uuid": "1efaf9a5-2d5a-4a26-bd66-e0bc73e76eeb", "value": "T1ED530160D2907C95E5CABC623EBEF3F5A3B11E4573DB2B80A08A6790760881651D27FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237129, "uuid": "1b6e19da-0590-4c34-a390-10acade44af5", "value": "1536:rakVLB8Q8tZ72PLm5U4fNJdUR9iA7FmCxn8Y4u+qgw09w:zVh41J2sAACx8Y4u+qgwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237129, "uuid": "078de9f0-571f-4675-a3d8-01e3f9084516", "value": 63088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237129, "uuid": "9c47d23a-ec74-4c55-b495-cc13b84a13d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237129, "uuid": "5d11a984-68fe-4a88-91bf-db6141067ac6", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894edb25-cbdb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764280421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280421, "uuid": "519e9d29-0a6a-4993-937e-0ca9b6754396", "comment": "Malware payload", "value": "31dfcc4c75e21f42dae445247e0a2980", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280421, "uuid": "5c8f91b5-4af6-43a3-8f84-d6bd60595c19", "comment": "Malware payload", "value": "5124e2e3a0d5d14bb8464b2097c119db4e8baeac275908d58c0d014e4c334422", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280421, "uuid": "b09a0ef8-c503-43fd-b389-2920640f6b2b", "comment": "Malware payload", "value": "6d90e1077764f0051b1d874c194d03fed9513df8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280421, "uuid": "cb2c886a-4911-43e0-b7f6-32182486036b", "comment": "Malware payload", "value": "c8d01618960507fd064c87dbbb9f239e1cc18259256313e3f845a7c31bb8c939ceeafd9214de73a03ebad502a213cbd0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280421, "uuid": "d217837c-fa45-4d7f-854f-3ca9c0283a76", "value": "T12373314C0ACB44F86B637568898F8C01E7E989231B1CD6A1BE6DA5F43F12539A1FC5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280421, "uuid": "30090c44-1c31-40cb-b881-e04192d46675", "value": "768:up4xigTGvDaS2zwGKM2QeJHHt14svINEVLwoIY6XLU6rB/r8nTpy6RQHDctbN81Z:imS8M1FvV+oI4/PPI1/57X6XpJYFL1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764280421, "uuid": "21e5ffe9-c1e2-48f4-a425-20abe17052ac", "value": 75677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764280421, "uuid": "04bba410-7a64-4016-9cd8-04dc1e4d48c7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280421, "uuid": "85d19fb1-0131-447d-ba2f-4b49e7513556", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c65c8f-cbba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764266107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266107, "uuid": "60140b41-55c9-4f2a-ba99-67724a423378", "comment": "Malware payload", "value": "ebe0c2445c5cb109270481589d491e87", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266107, "uuid": "7635ff10-882b-4781-9891-27aeac434db3", "comment": "Malware payload", "value": "519fa983292aadb39249c783c9fa5a5650786977418589c47f601e48242166ff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266107, "uuid": "dc1faa51-6c96-42a3-89f6-e38748cd1280", "comment": "Malware payload", "value": "fedb07bca389ffc7eb1db8da3c2f51aca32b34f1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266107, "uuid": "7e662804-e46d-415c-96c0-6e30a7fba230", "comment": "Malware payload", "value": "f3af13fc69fa78657fc98990b87ff4f24afe33b5517c6c73c4aaf17ee25f95d1ab8c030db4895939357f43c5f937fed0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266107, "uuid": "7bb8e648-03c9-4024-a387-be2e60dd0459", "value": "T1ACC38D25F9D181FEF8724070A8FAFBB9857ABC340B250CE7755C3B568A322D11326697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266107, "uuid": "e82b81d2-9ee1-4bff-8fe2-3b46fe3f71f5", "value": "cfd6165c9642a630826063b1104a2d9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266107, "uuid": "6d0f35ac-85f6-4ff2-bfb2-3c7d1c2f87e1", "value": "3072:OuEOHQw4X+YaBYxKpnPA8wjeUjsi+T7Gd:Ca2OpBYxKxPpwSIN+T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266107, "uuid": "4c179781-dfa0-413a-ae93-d9f8aa54d6e1", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266107, "uuid": "ce9ddd2b-4c58-45e1-812b-fc6e0c07e4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266107, "uuid": "a094dc3f-7f60-45a1-a79e-8f1642548263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5e7d24-cbbc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764266897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266897, "uuid": "c3e0522b-5688-4cfa-b8b8-2e46a31c6e88", "comment": "Malware payload", "value": "8ee5c728a02588feb2122daa3a8f12fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266897, "uuid": "e39de400-d4a3-44e5-be35-d4aa4b8e3cbb", "comment": "Malware payload", "value": "51c5ca5399f1d103a75aaa39183c389bb8d0b1a14b8fa4a141dd30b31fe3775b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266897, "uuid": "ea86f6c4-8390-4ac3-a633-0e5d0901dcf0", "comment": "Malware payload", "value": "da6a084dd1489e6d8e3feb130e01d6113593f20a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266897, "uuid": "168fa9ee-b80b-4203-a2cc-e538f3e76b85", "comment": "Malware payload", "value": "e36d07749ac61f139dcd9905b4a9d0bea840ed7e35528b7585ce96db4ee3f3043773323667c17a20323606953af73a9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266897, "uuid": "3e071439-7fcf-4175-943c-07be8d82074e", "value": "T10AD30945F8405F27C6D622BBFF5E428C772A1769D2EE72039D256F20378B85B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266897, "uuid": "8698bda1-3af3-4a5f-8ce1-37445e31b119", "value": "3072:VhN9+o1r8MuIqjRMr4CCvfA9NdAlagO4RIP++BD:h9+o+MuIqjCr4CCnA9NwKP++B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266897, "uuid": "efe87a7a-a0b1-40ab-8ed8-6e2a3a6fcd08", "value": 141952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266897, "uuid": "4b04e917-d11a-4512-a60b-458df74efa05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266897, "uuid": "1de9401a-0235-4c4e-9962-f3c06e76aec9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b129d4a6-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228518, "uuid": "44c034d6-266a-490b-8f51-874d561bafe4", "comment": "Malware payload (Mirai)", "value": "dc98461c0fe76173ffe836640a066306", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228518, "uuid": "441d03a5-4ec3-4470-b956-6d35ad9d01b9", "comment": "Malware payload (Mirai)", "value": "531279abcddc187ad6309acfb31836e70bf736453e5eab22879d3b1249e76503", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228518, "uuid": "16b84011-c128-4f5b-89fc-f38cfcb4ef0b", "comment": "Malware payload (Mirai)", "value": "96e223244179895c34999b0cdc7dfe40c94987e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228518, "uuid": "b4548521-e842-4db7-b6fc-0e387b5c9653", "comment": "Malware payload (Mirai)", "value": "df1d3beaac2ce4c4717c0c3dea7dd4e3af450cc95537bbd1e2a9ae0cd91356a1b016e6b2a5095197a80a7945b66653b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228518, "uuid": "778428e1-e90a-4afd-bc86-ee449231386a", "value": "T1094192EF106220772989CF94F773D854A51D66D22DD3CE4D7CB8186B917BC1CE948AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228518, "uuid": "ff5732d7-4b8d-499b-835a-ae3ce614905f", "value": "48:SOjn6fofvtE46fofcrUfofWjoKYfof5LSfof0f8fofVHGfof4LMfof0G4Wfofhpq:SOjnYofvt1YofcrGofWjnKof5Lwof0f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228518, "uuid": "f6fce37c-f8f7-47e9-a61f-caf8a4fc8b22", "value": 2110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228518, "uuid": "13f404b1-0e4b-48f2-8363-34e891afc7c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228518, "uuid": "bcad938a-92ce-4af2-91ef-5ab98d0c751f", "value": "go.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a422f1-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236874, "uuid": "ae2d1f9f-8bce-47b8-b761-5d81d0984f54", "comment": "Malware payload (Mirai)", "value": "6e8c764a26a097aebafeb3fb66fb44a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236874, "uuid": "6b7db7fb-d13a-41fe-b323-2424d40df693", "comment": "Malware payload (Mirai)", "value": "544c10d18002e0aa0d61e415160312171bc5773d87b509ebec2bccaad6427111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236874, "uuid": "5647ef73-8e74-46a1-9947-9434ec78b504", "comment": "Malware payload (Mirai)", "value": "9fc424a7f34c69cff3f001e6104acb9abcb2b16d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236874, "uuid": "ec7bb2fc-471c-4f93-8780-862784b041ed", "comment": "Malware payload (Mirai)", "value": "14fa144bb1a6035aeeec90d32685815b275a16e19066f66cefff606c2f5bff3349ddf17c716835b010dce1f842cd10ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236874, "uuid": "72a42478-dd25-4aa3-ad2c-486a2a3db1e3", "value": "T118D3AEA7F34715A1C86342F407CB4BDD2E532282AF6B98E37D6F757B68750CA4406B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236874, "uuid": "d58f6004-4e8a-4a2b-9fdf-68f2208bc154", "value": "3072:F0H21ZnmrUjUGcF9n4FN7njJL3sdugpgy+Nq:Ff1ZmgZ64Ftnj6kNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236874, "uuid": "89c16491-9384-4ead-8604-fe65d799a156", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236874, "uuid": "b6bbed57-777d-4ad0-b439-1fa495735f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236874, "uuid": "c9a6cf26-6167-4c6a-85b4-a5514eff38c5", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e74821-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223699, "uuid": "4b3f8bfa-faa0-4b46-939f-f7424bfc46ce", "comment": "Malware payload (Mirai)", "value": "2042b1cf42ed907d844ec1dd12428ddc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223699, "uuid": "1650a837-a2c9-4946-9e53-5824be0fa9a3", "comment": "Malware payload (Mirai)", "value": "54dd51f257bdf825d605210c6027f6455bc268f04b4122d8304fa2f2d5136d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223699, "uuid": "3d9cb194-e70d-4fae-b489-89fe63961b66", "comment": "Malware payload (Mirai)", "value": "aba7a032030598e17a3036200974011a75d5a660", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223699, "uuid": "68978273-55d4-481f-bf60-04ccb2793b41", "comment": "Malware payload (Mirai)", "value": "47d70117e00b0d007d28a4cad8a71e1e9f17b6de48f1c6704b21c4ec0dadabefb16642859b422ec9b6d16213f156f160", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223699, "uuid": "26445d93-44c1-4719-9476-9f29e3636a33", "value": "T184630891B881A626C2D1137BFA6F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223699, "uuid": "52259d18-3875-485b-b0e2-70d68d1113e7", "value": "1536:eOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:eOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223699, "uuid": "394b1747-50ef-4105-83fa-2fa5170dda98", "value": 70860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223699, "uuid": "0984ba2c-6ca3-4cbc-a874-0ada56a114b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223699, "uuid": "11d42c60-49fd-48c2-8166-e0faf9f742ee", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7e1d47-cbb4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764263674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263674, "uuid": "031e0c9a-97c3-4781-a0c7-9e1227a19c3e", "comment": "Malware payload (Mirai)", "value": "b4e70d053c2b7db0e5fb8e0441d4aa07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263674, "uuid": "d586288f-7acd-46d1-ac3b-ef8240adf138", "comment": "Malware payload (Mirai)", "value": "57b7976fa1baaa51bfb733d5c47ba992923c3e527a9bc9cd625180ad7c11b888", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263674, "uuid": "5ab7006b-cf5c-497a-9e34-b9b2808fa9d4", "comment": "Malware payload (Mirai)", "value": "e97c5cc84b9c5ef237352a778309d086e51ec59e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764263674, "uuid": "96606059-59c7-4976-81b9-c60d6998716f", "comment": "Malware payload (Mirai)", "value": "d60bc4f2b5f0ca4ae0809e8d047918242e962c87b93d7284db514a1ed6cc6a76ce2e03aef11536d9a0fc5946a206cc6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263674, "uuid": "36a4b229-94dd-4834-9eee-220da58e2090", "value": "T119C3E659F8819B21D5D615BEFA4F528D33231BBCE3EE7212DD245B2437CA91B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263674, "uuid": "8f5089d4-6f14-422c-9dd0-af12d6f445d6", "value": "3072:WATwtUYzxFI3LFKHKEn3czDrfeVBT0wa3PDqQrTcarKb6S53E3n5mm:dTwtUYzxFI3RKHXnsn6bowa3PDqQrzr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764263674, "uuid": "379976c7-861c-404e-bfe3-65ef3f0da059", "value": 128468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764263674, "uuid": "a1c37937-f04e-49bd-85dd-9d83584e97e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764263674, "uuid": "94a0515f-9786-4358-8191-8cc6bfcb4396", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eea890-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228525, "uuid": "37be1007-11a1-454d-8d20-4a5e2bc132de", "comment": "Malware payload (Mirai)", "value": "17cb06abf1eb566863518dabe189b999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228525, "uuid": "6df8e9d4-7c79-4396-9550-8bde5d0505a1", "comment": "Malware payload (Mirai)", "value": "5803872bb60628ce0e5ea4448ca57cc583f76407dcdd54485d52d71ae03f8be8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228525, "uuid": "7e363738-5ea9-4ae7-9f68-450e4fc27532", "comment": "Malware payload (Mirai)", "value": "092cc188ec1bbba6f783703025604e54523a2fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228525, "uuid": "f06fa3ea-6e7f-42ce-8c77-73935b1af1ce", "comment": "Malware payload (Mirai)", "value": "4c82da509fa9297de3ceb3a92a430760fe8e625b942e14131c0f6f9fd44669f36581f2bb7c4ff9f8ead6aec01edac506", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228525, "uuid": "436438b4-0897-4d05-9ecb-347244c75090", "value": "T14E43293727A6C9AEC09753F41AEBE6219423B83D1B339107B3D9BD2A9F268D41D1D305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228525, "uuid": "4fde3f71-c523-41ea-be17-cd659de45ad4", "value": "768:ZFDbpZMfhgA4VK/4+ZQ6PKQ5FDub7GDUhSwkgC95+Sk3h4KgA4urC:bbpuB/4+ZQ6PKS6uDokgM5pk3fVrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228525, "uuid": "5482619a-5018-4b3f-845c-6f7fb487204d", "value": 56277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228525, "uuid": "94321aaf-f2f1-477e-95c4-f2cbf2676630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228525, "uuid": "1ecedeb3-935a-4b1f-8bc8-e375a3df245d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc370e8-cb79-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764238388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238388, "uuid": "de713346-646f-4998-8b1a-5ad625187bbc", "comment": "Malware payload", "value": "4980dc3627c788cfc17a2c78f7c68a25", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238388, "uuid": "e08de09a-61bb-4268-a041-b858b94995a4", "comment": "Malware payload", "value": "5806ef83824c1d4ba933fde47c9b437d92020701528803107440038b1d2f7408", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238388, "uuid": "bc4b5966-e221-44b2-a728-a27fabf04b11", "comment": "Malware payload", "value": "9bbc4220b10b3bdfa7392ae4f1ca5c5283af5304", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238388, "uuid": "10fcf169-2b1b-4096-ab94-8fa1694ad5fa", "comment": "Malware payload", "value": "3ffffd19364db653630d2c40e80415b3c9633159a9d1915feb127b0b9d8813e8cc195239055fd81dd656bec33534b48d", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238388, "uuid": "2df5fe5d-61b5-4b04-973a-1708bdfc677b", "value": "T1AB868E72C827BC793D8D394694092E814EB85D6B6718CA95DF0077BEB0D4D74BEBC0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238388, "uuid": "1567e406-04b5-4f1d-8894-b374d7938e42", "value": "49152:sy3YxLvgGQwcnzm/y/5pH73ypnB4GN/fGFLphz9KG7/nr/qHsKms8/I9IT1+yVA5:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764238388, "uuid": "badd42e4-c12a-4d81-ae86-efe704779583", "value": 8244503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764238388, "uuid": "f3514505-a428-4373-9652-0300cf70595f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238388, "uuid": "62a9d68e-d46b-4838-94d1-863ab32b3c1d", "value": "google.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ec94e4-cb8f-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764247619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247619, "uuid": "97358b26-08c1-4a02-8e42-b122898098ab", "comment": "Malware payload (ConnectWise)", "value": "63d44d7fccdf666da22a775a1b72cd6e", "object_relation": "md5", "Tag": [ { "name": "banco-blogdns-org", "colour": "#A55330", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "departamentofinanceiro-org", "colour": "#819B2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247619, "uuid": "c4d0d76a-9bed-4a26-a0d7-b5e95b27728a", "comment": "Malware payload (ConnectWise)", "value": "5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2", "object_relation": "sha256", "Tag": [ { "name": "banco-blogdns-org", "colour": "#A55330", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "departamentofinanceiro-org", "colour": "#819B2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247619, "uuid": "7c865c4b-b8c4-4962-a206-4ac4d707f0ff", "comment": "Malware payload (ConnectWise)", "value": "b7301a8e6d702e9dc01f4978bc8c176e810f2305", "object_relation": "sha1", "Tag": [ { "name": "banco-blogdns-org", "colour": "#A55330", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "departamentofinanceiro-org", "colour": "#819B2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247619, "uuid": "33f88b60-097d-475e-a2f0-6919ce2ed74f", "comment": "Malware payload (ConnectWise)", "value": "c70f1983a6bf731f7089c51bb6cdf328aae5a745f4b8551c4087c6ab013c6b2e5f04c240e373008154a5b12649025478", "object_relation": "sha3-384", "Tag": [ { "name": "banco-blogdns-org", "colour": "#A55330", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "departamentofinanceiro-org", "colour": "#819B2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247619, "uuid": "57bfeef0-1327-491d-82d5-1f0060f3f9d5", "value": "T11AC61202B3E58675D1BF0B38E83996656631BC149722C3AF5794B96D2D32BC08E36373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247619, "uuid": "c1cfb145-dccb-4a43-9b6b-8d533f84a316", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247619, "uuid": "b6e830f0-690c-4da3-86d2-1216d862d181", "value": "196608:VRefefPVF1+sPlEFFUdq4ypH1+sPlEFFU11+sPlEFFU/1+sPlEFFUx:VDPNSF8qtpVPNSFAPNSFsPNSFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764247619, "uuid": "a58c73e7-fa0d-4f1a-b500-eff608838a05", "value": 12572728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764247619, "uuid": "fec5ed9f-2215-498f-bfeb-d9299f362c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247619, "uuid": "494782fa-cb07-4a12-93db-39908d0232b9", "value": "NFCeEmissor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924bc392-cb54-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764222454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222454, "uuid": "cd4372e6-bf62-4764-9010-64d71ce479f6", "comment": "Malware payload", "value": "dd500b234830de93d255bae382452967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222454, "uuid": "24512563-89e9-4711-b136-5bf5df43bfa6", "comment": "Malware payload", "value": "5c2bbb00f32b9b196fe1ca35263516a7ebf9fb64ab29b3c85cc320618a6cc6c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222454, "uuid": "88770f98-3059-4f5b-9795-e2d7a1a3011c", "comment": "Malware payload", "value": "e71d6d9efc6ec50a771ce54e553cc2bf9b9ef64a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222454, "uuid": "aec407e7-b49c-4eff-b295-a5bb223fe58d", "comment": "Malware payload", "value": "1b1440f078dae5b4cfb0c6738e2a886f9cdc2231c48f56b0bbcc6899648678939cedf0aa96d5f0256d7ca7e9e969ee07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222454, "uuid": "d6cc97fd-9353-4671-a9e3-183dd2b8ece2", "value": "T13083C5497B650FF7EC5FCD3B05BA5B04289C950B21A83B367974E818F64B24F19E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222454, "uuid": "73a2fa47-5dd6-42d0-bb9a-7863f4d55aaa", "value": "1536:A4RdloDxubbMYcWdRbx58FSYOX/+itp3VTQhLTAFug7R:A4j+Nubgj2Rb/bYOdQAFug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764222454, "uuid": "2d96a8ec-5658-4602-946e-b044961cfdc8", "value": 80764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764222454, "uuid": "b51eb70a-7e23-466c-b1be-a1fd5ffcd069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222454, "uuid": "0e401af7-78a0-449f-9d77-2157b193fb17", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa371c90-cb5d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764226359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764226359, "uuid": "79e37b9f-3329-4b91-a9b9-af4d670575cb", "comment": "Malware payload (Mirai)", "value": "e887ae5fd225f17e115c1063b21185c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764226359, "uuid": "a906624a-b1ed-4013-85ce-c0a921560632", "comment": "Malware payload (Mirai)", "value": "5cdd93fb024d35239f4f8185e3fd9387ce3b714b3f711139ac06827138f7ad7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764226359, "uuid": "6f83edc0-6a45-43c6-b0bf-17d8c4741655", "comment": "Malware payload (Mirai)", "value": "d8987afba3f4fce96c8afda48f5175246544e9af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764226359, "uuid": "46271a8b-4b90-457c-b988-afdc8856e034", "comment": "Malware payload (Mirai)", "value": "2d47d2f15b1e3d25bb4347603026445f4996ac068485100635ffcee17c2ba7cb65c8c2b3ce925e60f673dd7a973b3115", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764226359, "uuid": "c4803ee9-dff2-41b3-bf05-60f3c3341526", "value": "T17411E24F51233A20846ADF3A32EE11C87131E35560BFD7E618CD44BED8DAEB065E1E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764226359, "uuid": "7fa9c016-90ae-4db6-a467-3b1df7e3da10", "value": "24:yeHMypPWFy+saakgapGMazClsqx/vAC3B+yst4N:aApzolB+ysM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764226359, "uuid": "9cb7fb5f-bb1e-4bc4-aca4-1e782f0eb132", "value": 967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764226359, "uuid": "779e539e-08f9-4801-a6e6-99c46098c5d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764226359, "uuid": "b21131e6-6dac-4af7-9a4b-87cdbcd444df", "value": "dock.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b666f2e0-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228527, "uuid": "0a1afec6-8cc7-4b5d-87bf-87614aef2071", "comment": "Malware payload (Mirai)", "value": "edd2eb3e474698752823e7a9674bd95c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228527, "uuid": "5ed8459f-c316-4e02-a1a3-5fbae99aacaf", "comment": "Malware payload (Mirai)", "value": "5d0e5b8a6a831be96298de791c5216fbf20f5c5acc420258c3a5d81782bedd6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228527, "uuid": "88f016ba-cdf4-43d5-a5ad-cc3a3250625c", "comment": "Malware payload (Mirai)", "value": "f2bcd0efa308021ccbcddec11260112f73e3ba96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228527, "uuid": "e7405868-4296-4e0f-988b-175f34d6f79a", "comment": "Malware payload (Mirai)", "value": "87952594a2cc19fb203b64f73c97ebd80fe929735469f4812353bc20990b5d667a13a8074eb7ad4d20202af5fd3dccbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228527, "uuid": "4a21b223-1fe9-4445-9fa2-87fd5d279bbe", "value": "T167430B93B911FEBEF40BE33A88C30735B230BA5645930622A76779A65D3B3C4345AF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228527, "uuid": "9376c858-d744-4d06-855b-f0c20c6bad0d", "value": "768:V+F+smsdxQa3JNfhZ9yBN8CZyCagD5xBXLhvIVkyYizAwRAudw:szmsdewpTQN8CZAgD5xpLhfy9pdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228527, "uuid": "11b600d6-3cc5-4c18-a978-39db95406779", "value": 55806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228527, "uuid": "ac77d714-387c-4422-99f7-0a3e7859d24f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228527, "uuid": "d832c0fd-a4c8-4ef5-a5ec-89f2235e2390", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b607af7-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236991, "uuid": "c86485ef-75eb-4b60-bb51-bc339f0f0117", "comment": "Malware payload (Mirai)", "value": "22e649659177e0e427eeb324f04016b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236991, "uuid": "8b75139e-d151-4298-8739-64a96f2fd3d8", "comment": "Malware payload (Mirai)", "value": "625f679c32c1ecaf1051a219b874a06e8cdace0cedb7b2c0458282fdc94c248c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236991, "uuid": "ee3b10fe-38ff-4380-ac5d-65c16381c30a", "comment": "Malware payload (Mirai)", "value": "83ec62481372011209099213f805e2afbd92e2d8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236991, "uuid": "f115b65d-6917-47a9-a86f-73e952a2139e", "comment": "Malware payload (Mirai)", "value": "deb0bfcfbfd0b2ab170460f7d33c47a88a8d8f49be321a134b00e168c0ffae4359bbd7d5e78687cbe2d36b3af690b3eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236991, "uuid": "44d4c08a-7543-4d48-92a4-d98081080799", "value": "T1E16161F6014807346CE2AB9B627E804D3295969750FE7F26A7DC2CA44D8EFDCBC41663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236991, "uuid": "0e26a10d-e5de-4fc6-a2e4-a5919d625de1", "value": "48:iw9/P9/dGVsw9u95w9V9/w9G95w9o9Vw9/89/UPFyRw9rV9rJhLw9b97w9E9ZLwm:iypdGVsxWl/y+UPFyRYQvL2hDuMJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236991, "uuid": "193ff9f0-2563-4a6d-8d9a-0955b01aa9f1", "value": 3194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236991, "uuid": "97abc25e-9a83-4e5e-88c3-2594b8a18fb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236991, "uuid": "dbb16c01-f8f0-4b72-8345-a638ede5a179", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4fed49-cbd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764279379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279379, "uuid": "d94027fa-3033-465a-b7bb-e0ff0e567ad1", "comment": "Malware payload", "value": "5571294581fd91f0a9e672ff690e41eb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279379, "uuid": "559e7c75-7310-4985-b24c-3d0ea333a397", "comment": "Malware payload", "value": "628bcd7fa27f482ce88559721970f7057b39990159bdc2cc0e270833c7e98138", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279379, "uuid": "e01e36cf-4c68-4fbf-8d13-3e170be611d9", "comment": "Malware payload", "value": "da9341aaacb18669b196e093c4c2eba6f1f2bd16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279379, "uuid": "c4692be7-be46-460d-89cc-2793da23a5f0", "comment": "Malware payload", "value": "6d345748c1d3bd37c367460a6877290a61fc5ce95e6c7f25d4b5f32bf3f3bcea9566c28ad02d01ff0db5bbdd6f3e2e40", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279379, "uuid": "371bf4d0-77a0-4b8d-a7cd-f94506137510", "value": "T1D88633A774E0662A1CC8BEE9C0D172EAECCC1B57CB9768ECE8AE4035D0550DF41517AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279379, "uuid": "fac72e02-1ac0-4ad2-8cb3-b7dc44321772", "value": "196608:4HnTmAPSEnCTOxArqUWMv1xLM+5XIR7KHqCu46xmRYjVmbYcm7lay6GjGxolTIa:4HnTmA6EfUWybHFq7KKCu4CmRYjVzcmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764279379, "uuid": "26e5bc26-0ed1-4f06-86f9-177c7e5d9f1a", "value": 8308229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764279379, "uuid": "d999eec5-1725-4b4c-b7a9-49d84b60db6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279379, "uuid": "cd753d61-1823-4780-9d44-563f049fc101", "value": "2bb0cd071_Env\u00edo_de_informe_de_avance_dentro_del_proceso_administrativo_de_cobro_003_195643407920_62811021259415807_b5a9b9ab_d673b70eb2_f0461ed43.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246ff983-cb82-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764242026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242026, "uuid": "2310fbc1-9327-4b8c-aaf1-6ecaafeca044", "comment": "Malware payload (Vidar)", "value": "5fe477b71131d33513317df1a2b7adaf", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242026, "uuid": "bf28aaaa-f76e-4a8a-a49d-2662642545eb", "comment": "Malware payload (Vidar)", "value": "62d22a6b74b299d7a7b1bf795806f30cf23742f678830d3580b347cc16c75dfc", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242026, "uuid": "62af3727-3d90-4c05-94cf-659342d605b7", "comment": "Malware payload (Vidar)", "value": "aac2578f956dca6f38b29b2b2d51ce0c63de1243", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242026, "uuid": "0c914948-3ff1-4027-818d-cbb1a07c78fb", "comment": "Malware payload (Vidar)", "value": "c8b3f0b754e3c9eb30d486867046df56278c6263e72ee23ab775065022c4d20742bbf193ba14019c79caed27b9f68604", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "x", "colour": "#5D3042", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242026, "uuid": "b0cfd346-2abe-4345-b054-4567621ceef3", "value": "T189D5335313D010B6DCB95FB658F302426A71B661DF56A2EF1260E0BEAE326D0743DF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242026, "uuid": "b33a6219-6d97-4eb9-9bc8-a72fe7dcfc2a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242026, "uuid": "560fd2a8-cd61-4779-932a-7fa6d1caa844", "value": "49152:7URVbx0k0WgQTqYhrOrjKykZW7sM2YZKTK/WpcBOiEjGQO:QOvSqY1Ej3mTM208lGQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764242026, "uuid": "cccd256f-9c54-4eb8-85c5-fe07ccb60996", "value": 2760120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764242026, "uuid": "ff995a00-ddb2-4e67-b6d3-712a11b9ce3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242026, "uuid": "f986627b-6bbc-4faa-aaf1-add1573401b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dd72e0-cb87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764244522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244522, "uuid": "ff4caaad-4cc4-45d2-a951-ba214cdb94d9", "comment": "Malware payload (Mirai)", "value": "f1f4239c2da2583d94613dc5ba45abdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244522, "uuid": "2e1ce725-3516-4ddc-9b0a-9710a3cfd92d", "comment": "Malware payload (Mirai)", "value": "6364e6492787148b2cc770dce1eef4b31638b6e5450ed4b0dfacdadd1c186eda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244522, "uuid": "de6f6bd5-bae4-4ef0-b2a6-5d9008a540ee", "comment": "Malware payload (Mirai)", "value": "bc026f401ac36c560fa96f88717e83ea8d622130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244522, "uuid": "6205e500-4d26-4e39-8a07-353343af4e53", "comment": "Malware payload (Mirai)", "value": "f2678de5fc11c585dd6c2b0e2633d83becc2ed8c5a0218e36b5384bfadd5b36ba86752e2a1ecdc3f82d0598aaf386f32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244522, "uuid": "489478b2-448d-4e0a-93cd-f6cc2bbc47d8", "value": "T11D630982BCD2555AC1C0637FA66F759D3361E3D0D2CA3517D8A70B2133C62AB1F66B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244522, "uuid": "05dfd43f-a30d-4987-8d95-ba6cc2a0e18b", "value": "1536:6NOMRSLfmXHbrltBZXFZkOHEcmiyruvSpDz7cl:6NOMELeXFZX/kQLmcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764244522, "uuid": "4f440826-ddbe-43a9-9ecc-89fdd67923e1", "value": 68560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764244522, "uuid": "c8d97c0b-06c6-4ec1-ace7-514b1b9c9523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244522, "uuid": "df34dc5d-dfcd-4009-a020-b893e39348c0", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97647c5e-cbea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764286887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286887, "uuid": "274c9f9b-d368-4343-a98b-fa49ec8ace21", "comment": "Malware payload (Mirai)", "value": "4780c57b6a4f00dccfcfa0db69590415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286887, "uuid": "4bda1b2b-398a-4821-9cc8-b8934106e74a", "comment": "Malware payload (Mirai)", "value": "6382a8453de7da60f5803084b57f4c2eae393356bff00d9f3322402aa902530b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286887, "uuid": "8eb0e031-aaf9-4fa6-ba03-6641732107d7", "comment": "Malware payload (Mirai)", "value": "e826988d85f432d52aa9400d01d6f7084f406708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286887, "uuid": "ec953e10-b96b-4923-b466-fc0d55d5f3d6", "comment": "Malware payload (Mirai)", "value": "9fb7a546fbd5f52156d0b911e8b26e2efa7ebaabdad80c988cdc07e1b6deddacf58124e151f666d7f1d952c8234acdc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286887, "uuid": "8bdfed2a-353d-4e28-b139-3663f8553a2a", "value": "T18313F148B719C2B6D0400B341C5D7EFDF6043976BA1BCA156A28BDFC10E208D9BB4DA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286887, "uuid": "d3472582-b0da-4577-83ed-f8047c7eb66c", "value": "768:H/5o9oU2caW6S1t5hUcoHqmxNFubBSpuDMLGqFp8LobQ8X/bpbtgocaxDobRsI/:f5rU2GdLUTnhubBSPLGqr88TX/bnHca4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764286887, "uuid": "6234c619-6db6-49f9-b49b-17328c5df55e", "value": 45444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764286887, "uuid": "230000ef-5e27-4376-bba4-da0afca664e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286887, "uuid": "78ad8c4f-09d3-4109-8437-526c65ebb351", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abca6bee-cba9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764259004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259004, "uuid": "dacf11aa-d2b7-475f-b627-9f21f8046f13", "comment": "Malware payload", "value": "398d3f0a636489a4107beee00fd10d26", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259004, "uuid": "1221a19f-3713-4864-9305-6898279397af", "comment": "Malware payload", "value": "63d0c47e9c20a43af2c677d01607cd3fbf2357dbebedac5f84936c69025819df", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259004, "uuid": "7d525a14-9105-49c6-bec6-7e2402eb444a", "comment": "Malware payload", "value": "e0882481d7d15fa4b0e7d82598adf8c7e5471d96", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259004, "uuid": "07954dea-fd9b-4fd7-9948-7bfaedbaa0b8", "comment": "Malware payload", "value": "5b90f11165f258e7c4cbcc26d7cf732dce18d1b185b38c375de5c204db3a65c6994592d6cdc2237736a27c4784f46a9b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259004, "uuid": "53bdc6c6-4054-401a-90e3-d7947b8b3138", "value": "T15673314C29DF45F8AA37747CC9DF9C02F7A58903063CD6D5BB8DAAE02F1142952E89E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259004, "uuid": "119c3075-9c64-416a-9bf4-9995724669fb", "value": "768:bxHDYM7lVKgkW6XP81NRZxyEEp9gSNwS9aCa1HNTVHWHwFmbf3CEbZpcvEU+6Imv:bJ17GgJyP81NRYK5EbUQ6Impg0grNra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764259004, "uuid": "9804ca46-60f2-4789-816b-befd2e3b5903", "value": 76248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764259004, "uuid": "8faca4f4-7e56-4fc1-ba96-eee80d19651f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259004, "uuid": "b4e25e9c-a615-477e-876a-2a7d7c9572e7", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d675178c-cbc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764272390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272390, "uuid": "2a28f9d2-20a9-4687-86e1-ba5d38493423", "comment": "Malware payload (Mirai)", "value": "a63da85a53b088a03b286668c9134b43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272390, "uuid": "abb7901e-9cde-45d0-a371-620cd57e6baf", "comment": "Malware payload (Mirai)", "value": "6470cb98d220cd707d0d63fde1016339ecf8335bbe556d130b5ca1df8b0a8d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272390, "uuid": "73660338-015f-4de9-ba40-bb6999d87943", "comment": "Malware payload (Mirai)", "value": "665d3ec2d54af583684c90aa4439674e32ace749", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272390, "uuid": "bc60342b-cc67-49f3-8f28-95f09eb0c5a3", "comment": "Malware payload (Mirai)", "value": "0200d1173bfc304af6fa25a717eccef084e40c1a76119fc193dae21f08d00517ec8c5cd9a4f7976b229f663b8e18f36e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272390, "uuid": "5c24dade-4c9b-4d0a-b044-600f446480aa", "value": "T165233B49E743D5F4DD4605B0106BF73AE676AC312220E9ABDB99FE27ADB2602904321D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272390, "uuid": "3948b506-4304-4007-92d0-8f0e532f2548", "value": "768:7drJpBbmHkKsYfdxgfMlYkbIjs88GUS+oxKm2mTqyeTzT1:BDBb3YfdxBagGUS+hKeTX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272390, "uuid": "30e6b1cd-740c-4893-b873-70147536e052", "value": 49748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272390, "uuid": "9689991c-ecf9-4fd4-9205-bcd113223a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272390, "uuid": "0730da76-d693-4523-839f-1dd31a49a69e", "value": "Mercury.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c162d70a-cbc7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764271925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271925, "uuid": "3e68f24b-cfc9-4bd5-aa1d-fca347c0355e", "comment": "Malware payload", "value": "4ff3f536d412e684350434e5fef0d347", "object_relation": "md5", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271925, "uuid": "8c715f96-0d1c-4e09-ab8a-945482092d80", "comment": "Malware payload", "value": "6503fbfdf0af502ca5e5f83e7f44a1d91087bd95cb06863c336308e47785b16e", "object_relation": "sha256", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271925, "uuid": "b8b448a9-a41f-433a-a4bd-256981d3de24", "comment": "Malware payload", "value": "971a49c228d176f2aeba355734f7279b8b195c86", "object_relation": "sha1", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764271925, "uuid": "4372b543-408d-4cbc-b697-5215728e4264", "comment": "Malware payload", "value": "585a20b209395fae10c76acab56e8ca942b07030f99e59013e6bf49754503179c50a24e24b5af29a8dc8f63385a3325c", "object_relation": "sha3-384", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271925, "uuid": "44ffa2a4-b712-4d3a-bdbd-c1f2269e3285", "value": "T17AA68D7F76B4C12CC269A23AE0A74F54A536B4751B36C1EB128005650F77BC1AD3E3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271925, "uuid": "50b6fe4f-2b17-4c22-b9e1-7a8bdd3dbdb5", "value": "274af8ec5a37a2a35fb2173e17612f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271925, "uuid": "2ec08fca-e2c5-494e-b739-7d0d343e2ff3", "value": "98304:Z17ZAIwXaqHJluNH3iY+DL6TVK8ngkfDEGWDv3XPjVggxDeQ6Ts2dhbnTFjp+RCJ:l9n3uL6k8ngkT+a3o2XbnTlQRCH9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764271925, "uuid": "e709eea0-af62-46b9-96b2-86b3be1ce804", "value": 10182192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764271925, "uuid": "8cd20cf5-4b07-426b-87e5-67c7077a39a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764271925, "uuid": "31b5d1e0-feb2-4b39-a7a0-d42686cf5a09", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b8fd8f-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764251120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251120, "uuid": "ab97a430-5cd7-4131-a9d6-a11fe8ef25f9", "comment": "Malware payload", "value": "2ddcb927d9262253b6a2b4dfe344030d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251120, "uuid": "94923947-9356-40c4-a040-c1dddd99bd17", "comment": "Malware payload", "value": "660aaef6f6a3f9e1be311a5cb89c208d60c5f9eb28b793bf478d01704ffa1b25", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251120, "uuid": "3290ffdd-0a6f-46b5-bf2b-46a423c6c975", "comment": "Malware payload", "value": "08ea81a92c1f954cd92ddde8602eea541cbcb405", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251120, "uuid": "fbfc7fe6-766c-4842-bd5d-a76a43848d08", "comment": "Malware payload", "value": "4ea85081e457867ae19b5eec79c8e3def39f6b28bb773b02c1657f36524608d1d1fbb8b2daf386161ee79bcfc09bc6ee", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251120, "uuid": "f430ac02-65fe-44d9-a21d-16e36a9de2c2", "value": "T1CA75236098549B17CA1A2C789743E1E5903CFC353E664B1B7744333E993B2B913A376E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251120, "uuid": "8e22d953-a7ff-4efb-a007-006e92cfe70f", "value": "49152:GOtyGLsObgi/0prS39agGbQovoUB4rnN:4Ji/09S8bLVBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764251120, "uuid": "802aec06-200e-4344-af1e-d416af73e628", "value": 1577472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764251120, "uuid": "9a6cd232-e4fa-46c8-be04-cd1d0a3543ba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251120, "uuid": "14e7874f-e1c1-4e76-8cf6-36e4fd3d9e48", "value": "2025_11_SOA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34517c4-cb49-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764217811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217811, "uuid": "06dfa586-914e-4809-9539-149e82f86c46", "comment": "Malware payload", "value": "b58060790c2a921829f8e84efa4bdb18", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217811, "uuid": "5ad09dac-83e7-48af-9838-40d9e78d2034", "comment": "Malware payload", "value": "68d3af22491445146e14042dba15e54a6e3e08529fc78659f272f7838f38a188", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217811, "uuid": "f46bafa8-478f-4510-b6f1-cd2a4c94f3bb", "comment": "Malware payload", "value": "7a16d94cc7b956d422419dd2930e442de24d30ba", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217811, "uuid": "9704f530-486c-43f1-a3f9-b60c975e1af9", "comment": "Malware payload", "value": "25444486506eb3ab6da365c2b92c97374cb74a8c1628cb77f7e15c3fd482b90eb34807608a275ba36ca4478702006653", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217811, "uuid": "edde76a8-4691-452d-9a79-778489bd7564", "value": "T100E36C57B3A530F9E1B78239C9610A46EB72783207619BEF03A447752F232D19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217811, "uuid": "ad5160fc-cd23-4949-98b9-fcc47fb0e3f0", "value": "35fcbe5f538b884ed463bbb4f1b0847d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217811, "uuid": "76957afe-437d-403a-b7bb-74e5c638ac44", "value": "3072:0z9YQUOT9P1S515vzwroEvE8DmvPdA76MNV0z:gaQ9Tsv9Ev9wd4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764217811, "uuid": "c1bbba66-0b7c-4b3f-a2c9-8b632265c0a1", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764217811, "uuid": "6643dd8c-189b-4ed9-87d9-7aeb237f8699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217811, "uuid": "8dd2f655-571c-4f28-b083-06c0b311e5fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ddb89d-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764251206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251206, "uuid": "9943b3cf-49c1-4de8-9f04-b8c1184ddd3b", "comment": "Malware payload (Formbook)", "value": "594ba44146f90e7c6a8b20c98c220039", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251206, "uuid": "3f310405-0dcd-44a7-af03-7b60cac4b6a0", "comment": "Malware payload (Formbook)", "value": "69bec4db765eff10333666fc060500e827a2163c9b3e3001aed16913a15ab8bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251206, "uuid": "b2c98576-a2fd-4e1a-922f-d92236afc9cc", "comment": "Malware payload (Formbook)", "value": "da9bf62c4fb126e1f46ca18aa76ccb2be3f6f726", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251206, "uuid": "c5192fcd-d2be-4664-b2bc-448062d6ebe8", "comment": "Malware payload (Formbook)", "value": "4c8765abe09087b2f696b5022f4387cf1f7dce8e60fe0ba9aaf7ff01f4334731b11b96fb44a7ede4ab4e9496f34048f9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251206, "uuid": "88a1548d-d591-43d3-b890-f3c2d4ede491", "value": "T1E2735B60DD5105B74F43AB48BCE68671CAAD9315853654B0F6CD870D800AEECF7BCAAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251206, "uuid": "53769df2-bc0c-41eb-94f5-b2b1d5a235e0", "value": "1536:StCYeFZXXKCrBtxvaEwY4B5PhwKkeQ/ULt8umuI4mRBciNtPf9qp5QC+2:UEoMNeQ/Uh8uVI4mRVNs55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764251206, "uuid": "4c26e8ee-bff8-44a3-9592-36ac9047a8ce", "value": 73829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764251206, "uuid": "941d36c0-1296-4ea7-ad91-e70d3f6af6c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251206, "uuid": "5dae4b50-7c71-4030-ac22-21389e5a6ae3", "value": "PO3279-0purchase_order_last_quarter.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e1fb36-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228530, "uuid": "aabaf3ff-d30a-4b28-a8b7-81d93156a7c7", "comment": "Malware payload (Mirai)", "value": "67afbcc9878148cd771cc9b99304ecae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228530, "uuid": "fc2e0d59-80f3-4174-a1c6-d79eee533a53", "comment": "Malware payload (Mirai)", "value": "69d3c6dc1dcfb9db3bb893a373d2c9611a79f71e71b2d52ca43ef8b369cf40e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228530, "uuid": "1100ecab-67be-436c-a45b-06638e3e4250", "comment": "Malware payload (Mirai)", "value": "3891ba2e816af3e6949c3962df0ecd0c5dbe1ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228530, "uuid": "58b5e9a1-b683-423d-a9d2-d3626e87e5d8", "comment": "Malware payload (Mirai)", "value": "fc4ed4554061052baf8858ca509aaba5a315f135fc32c06b01260e4d0dd134bc6d4ed532ec4747c3cfbeb138537820f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228530, "uuid": "a1702ad8-f648-43bf-8987-9c8d46ec53c0", "value": "T16EC33C09FB408B57C0E127BAFA8F424E33239754739B331A59289BF43FC6BA94D26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228530, "uuid": "407b3091-bb8c-44ff-b873-c992d0404d1c", "value": "3072:rzA1V/5LJmEUoFyGzxT/aaza4bMM/9vLpFdz:fA1V/B3UoFyGh/La4wM/9vLpFdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228530, "uuid": "e896f06e-1cd3-43ba-ae8e-b3ecea04d58f", "value": 118402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228530, "uuid": "8eb89ad0-1ba3-44fe-938d-8e3c57c1d6cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228530, "uuid": "b98b4ad0-facc-47cc-bce3-cd25838b860b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3b7be5-cb45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764215897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215897, "uuid": "78f8f30b-7c4d-427d-a8d7-82c2b15d18c6", "comment": "Malware payload", "value": "a5a02e915d0ec7abab24d409d0d20598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215897, "uuid": "6a9d8167-4fe8-43bd-9a43-5d9145b9d2a0", "comment": "Malware payload", "value": "6a7f7013d39a44467f8f8f2c27ec4e976bc7f71bcc5adb728f1b7d585ef34257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215897, "uuid": "39a903c8-4f4c-4c4f-af6d-bb048807aa05", "comment": "Malware payload", "value": "ba45e23a3f11bcba8f2208b95d2d2d9b47c301d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215897, "uuid": "51f13722-8c4e-424b-91c0-ddf4e74c8088", "comment": "Malware payload", "value": "93f136fb5d8d189b30b13bf0cd8c057972dc9e92c3a8fc46e98f7f9c97b72fe918541c40da7ec6ef82c1c0cd67b9c67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215897, "uuid": "2dab6cd5-9667-4c90-a2ac-76936b7aeecd", "value": "T1CF26012957139032E054BB384CA5E527E6FD7DEC2877B050A961DFEB7019F844AC32BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215897, "uuid": "1837953d-c70c-41ce-a9e0-6711a73f7815", "value": "66ffad0a659e3c87e6364473e5066988", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215897, "uuid": "464d11f7-b592-44ef-b697-a75cefb2d2e6", "value": "98304:95i8aXdCqsU6ATjFJoqiisAU2QDYmi5LC:lat8BCb+GQgNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764215897, "uuid": "8b2a542e-8a1e-46e4-a566-90d7bc5b0fb2", "value": 4612443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764215897, "uuid": "62734345-8858-4257-8b5a-87300201fe5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215897, "uuid": "32472c03-6e06-4f42-a2a8-4425138c98d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d24717b-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764251114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251114, "uuid": "e90a9904-34d5-439f-8a9a-ada1a6c3c7ed", "comment": "Malware payload (QuasarRAT)", "value": "be5dc28233ff2219f83c334a28ac7761", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sistervert-com", "colour": "#B1E5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251114, "uuid": "300363dc-1c5f-4f49-a9e8-991ff930e54a", "comment": "Malware payload (QuasarRAT)", "value": "6acc9df3e69a59d7f6ff827ab6b9098c526e2b4f288ce7a6063d7aab9c053ab8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sistervert-com", "colour": "#B1E5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251114, "uuid": "127fe90d-c1d6-4b5f-958e-0d3d62854808", "comment": "Malware payload (QuasarRAT)", "value": "d8cf7ed276fac9a42d6eeb6ccb117f761a39c8ee", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sistervert-com", "colour": "#B1E5CB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764251114, "uuid": "ee6b8338-d0cb-4d83-a24d-b4483cc869f6", "comment": "Malware payload (QuasarRAT)", "value": "e743d094e5b3cc305753261741469e50b904a47a6efe1584bf47acdaf5fd532893f004f086c3bad1f69241633c3fdd58", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sistervert-com", "colour": "#B1E5CB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251114, "uuid": "f460247b-bad2-4257-8a76-d1257574517f", "value": "T1A502DF212CE320E9F3375BB06BDDF9FB0AA5F4B4A51EB1B420519A4457B0684DCA0F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251114, "uuid": "6d151347-992b-4860-8ddc-03aa66568424", "value": "192:8D5Zc1xRvlO57f5c9Do4oID8IHT1Zm1cc//Q6aI0O12mKWBNVuI:+5Zc7Rvi7Bc9Do4oq8i1Zwccw6kY2mKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764251114, "uuid": "10f4de03-47b7-4885-a9a1-732a69c0ea76", "value": 8330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764251114, "uuid": "facd72e3-4f1a-4af3-8c97-8fab2ae73be2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764251114, "uuid": "ebe02dc6-0940-42e2-b46b-057a740a24ff", "value": "6acc9df3e69a59d7f6ff827ab6b9098c526e2b4f288ce7a6063d7aab9c053ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85893654-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234458, "uuid": "4b1514da-fb0e-4bd1-a828-b861286c6451", "comment": "Malware payload", "value": "9a070af9d54ba7f1e8a3618746889906", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234458, "uuid": "26c28352-4d18-4b39-b7ad-82724614e905", "comment": "Malware payload", "value": "6b18554a93ce3354b1ec85324879b903645e70e22865e5c4322f6a4126fcf07c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234458, "uuid": "d7de0b1e-3750-4466-b5a5-1cfa4ff9560c", "comment": "Malware payload", "value": "6bbaf2fb4401396650c87003c4e67ebf018043a6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234458, "uuid": "45ca2224-fbed-4e5a-847e-02e4aabb3b90", "comment": "Malware payload", "value": "0892d207bc5f40fa9398502b65958be6d38c6a95ef411a7a67209546b8583bc966d381d859d6b7fb440c7f7c522ccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234458, "uuid": "6ef2589a-4c87-47a1-9b23-6e8211637514", "value": "T1B1361257EB49E656E0F7C63A8376076396250C988343E3931A49B22C1DF7FC09686FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234458, "uuid": "3a60077d-cfe3-4133-a0c9-0b0f5db99720", "value": "98304:sUyiIEAEZpdaNwgW6gCH8An6vZ4F9lB4hSu+4ES+ikI4oM4PPzwJhSe:sUyAAKpd0X6B4TE94344Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234458, "uuid": "6c843c0e-4d5b-4687-9c8a-6ae6b2cf8492", "value": 5054231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234458, "uuid": "2a7ecbd0-fb4b-411a-9a4d-a2389ea27198", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234458, "uuid": "8ac71381-c78c-40e2-916b-27221db65d5b", "value": "ai.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ecc159-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236905, "uuid": "2f8f25e4-f725-4dc1-aaa1-f81e7a44f5c8", "comment": "Malware payload (Mirai)", "value": "977b0697fe53508b9b1fc88def71f5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236905, "uuid": "101e56f9-cc8c-4021-9be2-90395897b9f6", "comment": "Malware payload (Mirai)", "value": "6b37822e948ee60055b9dc2cf27fc4fd2ac855c70f1b384aff6d11bfb4eec623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236905, "uuid": "fca188e0-c8f9-453e-a390-e3cc1b211347", "comment": "Malware payload (Mirai)", "value": "fd848845dfaa89e789b26dbf6071d8a32b1fb848", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236905, "uuid": "e682dd7b-2c1b-4af4-99c1-3a49812e4d14", "comment": "Malware payload (Mirai)", "value": "49c8609546083fd5f0b80d37ca2815c76aa73861cfe6e8ee91296b4a195fba43ee103300bc5ae7dbfb7f2c3c1b656580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236905, "uuid": "9e69f761-53ff-4a5e-903c-437c581eaba0", "value": "T182B35BD9F643D0FAE81605302176FB376D72E9BE2228D983D3B89E327C12A41D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236905, "uuid": "5e2d092f-3457-4e07-a58e-1bf0265007be", "value": "1536:O1z5kayPMrO/5e2xKKO1lObIO2FDy7w5qR6U0NhbsnxA3S6qR4nS:KkMrG5e2xKKkIr7Aq0Uots2qRCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236905, "uuid": "f31bdc45-576a-4f04-a57f-e4098dd4b73a", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236905, "uuid": "e02695a4-d02e-4937-8a5b-5593b11a471f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236905, "uuid": "c9af7755-c3b3-44d1-8e86-6dd32e979bad", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9e33d0-cbcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764273425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273425, "uuid": "43a80eb0-4c9a-4e4c-9ceb-96c75c6447dc", "comment": "Malware payload", "value": "9c184eafe2a554e1410ab7838de1380b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273425, "uuid": "38a5a9c6-1f74-4791-ac36-fe13fc746dd2", "comment": "Malware payload", "value": "6bca02839862bb2942f412e3707a35fa2ecbccfc4731222da6f85102511c28b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273425, "uuid": "a472b847-5658-46d4-bf5e-dd4420a87fea", "comment": "Malware payload", "value": "2c1bf183bc6b4c790a91d5bebfa4c142eb383489", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273425, "uuid": "70e3bfb7-b498-4f2c-b052-ea8a2bfd45a2", "comment": "Malware payload", "value": "bdfd096398027ed89e109ea7767055e811ed5761fb9a836ecd3cf59f680819dde1ee4ace014b01edcecbe60a861024a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273425, "uuid": "2b06b89f-ddb8-4799-bec0-186118fb4d31", "value": "T1C3065A9669A58399C098C336D66361996A6174C40F31F3CB1E8475FA2FFB3C85C3B70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273425, "uuid": "f490c844-a313-4eb0-b1a2-4241f3687556", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273425, "uuid": "2f4fe3bf-51f1-435b-86fe-14e4df99a420", "value": "49152:QdyF9H+dv6oWMS8bwn5rPZ7hFUYGhGeb5w4ZFq8jkhTQ3:QA6Qr7NGhGGF9jk5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273425, "uuid": "8b26eb2c-5b73-43bb-b6f1-c559e621358a", "value": 3721344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273425, "uuid": "61a6ff0a-797e-45cd-9966-84058f8ee4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273425, "uuid": "8754dae4-70c7-4238-8b92-63cf9b325e34", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83a46bd-cb63-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764228986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228986, "uuid": "10fbdfb8-e765-4bd2-a7ee-79ddd667cc6c", "comment": "Malware payload", "value": "6a3dc0a886b8d56006b640ed06026ea2", "object_relation": "md5", "Tag": [ { "name": "bkndmn-com", "colour": "#98C283", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228986, "uuid": "15368ac7-8a06-4847-b3a3-dd228eaacb1b", "comment": "Malware payload", "value": "7076fe38eb203ea808fb99fa462d0cb406f59e402be5e9b7c863bda3b7a82a52", "object_relation": "sha256", "Tag": [ { "name": "bkndmn-com", "colour": "#98C283", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228986, "uuid": "8ae608f1-51ad-4df7-b297-cd8323c7b4fa", "comment": "Malware payload", "value": "dd21b00a1ec193b11e5ae7585f98f3e7ca75eb8f", "object_relation": "sha1", "Tag": [ { "name": "bkndmn-com", "colour": "#98C283", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228986, "uuid": "6b620aea-8565-4214-893c-e15d4e7bbdf1", "comment": "Malware payload", "value": "2503e78a744d03deff0e5db28a352eaa499bad4249e0e6ea181bd9f742c05f53bf5ba648fa320cecfb3226c22ba002c6", "object_relation": "sha3-384", "Tag": [ { "name": "bkndmn-com", "colour": "#98C283", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228986, "uuid": "f0a07e11-696d-4ee2-a891-e446915b0d42", "value": "T157D1AA8069124A8C603384975DADDD18E02503A7CD5B0D34B95CC8F69F70E9FDA75AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228986, "uuid": "d4eb2288-7c94-4c6d-b06b-1fad29de4d72", "value": "48:bJHapY7KQ8qcQXB2zOob0Nz7yk7yk28lX82LUlQjUzfD8ycXN0DNDDZmpzY62sNS:2rMcQR2zOoI3XyQjUzfGN0hXZQ2cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228986, "uuid": "99d61a19-0464-45d5-be30-cbd1086b00ec", "value": 6465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228986, "uuid": "3496c958-e17f-40bb-a563-7214972495bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228986, "uuid": "fc24dbe3-d3dd-4f5c-bfe8-ec8bc8a22e91", "value": "7076fe38eb203ea808fb99fa462d0cb406f59e402be5e9b7c863bda3b7a82a52.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8e41a0-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272700, "uuid": "997979cd-8c97-4b1c-88e4-54cb4d292add", "comment": "Malware payload", "value": "374cd20c33092021dec5f76bdeaf502a", "object_relation": "md5", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272700, "uuid": "4f2f55c7-4332-4ca1-a7fb-d8a8c697fdb4", "comment": "Malware payload", "value": "71d90f6e7fce7d05dfb817cc5d761d5e488ab87c814fc840c381ced01d1c8d70", "object_relation": "sha256", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272700, "uuid": "7922fd19-becc-41b0-9fc7-1f41b04c3269", "comment": "Malware payload", "value": "7a783eadebb22a3195412d7bedf109b800f9c129", "object_relation": "sha1", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272700, "uuid": "1fc78f63-7738-4bfe-b6a2-0c5dc24b1b86", "comment": "Malware payload", "value": "18cab1ecb721002e98f346672d384b7a46b84c9bff766f94c3a0c6fe1a67fcc36161e17126534e798d12e88f5ce8446d", "object_relation": "sha3-384", "Tag": [ { "name": "45-154-58-190", "colour": "#87FC50", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272700, "uuid": "82c090e1-aee0-48b2-8618-df9bb13253cc", "value": "T1B21733ECF8AAEA01E1BB71F1C4158B4D4F5D1C23F52A075716FB984259A22FC072EC66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272700, "uuid": "a94f81a8-c4d4-4a47-bbe9-22e939636d70", "value": "393216:opDRvM6w+Sbjyf314y9FoDfI1pmBcqg//egrgzzGao6EvY+7TvQA+o803Z:ope0SbjyfCmFoyMBFqegrxao6EAW+o8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272700, "uuid": "1c24f3f8-dff7-4bd6-80ea-2cb878e33161", "value": 19298860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272700, "uuid": "16358930-d51f-4f68-af03-6e147c6fda83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272700, "uuid": "72b0dc03-d1b6-4958-ac5d-405d1438e918", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5659bee5-cb93-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1764249411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249411, "uuid": "29bf3ff9-68e5-4dee-9a61-162dd1fdc01d", "comment": "Malware payload (Phorpiex)", "value": "b937df09706717591d8f47fa7e4663ea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249411, "uuid": "76306a98-cc1e-4816-9636-ec6add790b9e", "comment": "Malware payload (Phorpiex)", "value": "724e7d651f8d44249798db1a58ef9535ac956ac5e882c367475199c724a07c57", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249411, "uuid": "f01e6305-98ef-4c76-ac50-522d84b3bc36", "comment": "Malware payload (Phorpiex)", "value": "381efe8e46a9e6c685bb040febc9ecea2d9572f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249411, "uuid": "75cadcd5-9b5b-496b-adfc-7632ddb649b7", "comment": "Malware payload (Phorpiex)", "value": "6209f08f328ae0705cc6b744c24a0bc37c41d3ac9899390bf2ce69e4b52cb260d433e93050141b2e0787afceacbe4c5d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249411, "uuid": "69d470ae-3354-48ad-9909-2f01df9d36fb", "value": "T11E123B1B7E8A0071D3A14DF066B84B9D4B7D542337D652EFF773C28A1F64345A0472AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249411, "uuid": "b15d6c23-d089-4844-9c04-59d530ac02d1", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249411, "uuid": "ddd07f25-3b39-44aa-98cb-ee671f73bb96", "value": "192:vjgEffYwEoBPsZ+CYajKFJxTZ+zmFhyM:bPfQX4TajKFoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249411, "uuid": "09a89fc6-35f5-47d1-b872-591121edced8", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249411, "uuid": "1ec014b3-6e42-4795-aa49-b7ac72cbd289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249411, "uuid": "08cb733b-a05f-4eee-902d-28c68e341798", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02198bb6-cba6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257430, "uuid": "6bbd790c-9b4f-4b3d-8121-37a22680e0af", "comment": "Malware payload (Mirai)", "value": "04b38b099b2d51f1ce0725cf5fab76e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257430, "uuid": "91850c45-633c-46f4-8535-3ab6b648f24f", "comment": "Malware payload (Mirai)", "value": "72bde2a384ccc00ec37d673d0a3489821e5a8b3a0bc138e1044989a92c271410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257430, "uuid": "f73e7a38-30fa-4d41-a832-b95458c1d212", "comment": "Malware payload (Mirai)", "value": "4cd84add1c1b1e98bb2cc51b1ccb409d73dc4c47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257430, "uuid": "6b91bef8-d618-4c2c-83bb-fabba1d20947", "comment": "Malware payload (Mirai)", "value": "d19cf6e2831d62eb81178d13ceefa9586a3012fa6361cce8d08d9d2ddde271181584f3a4a14d35c89f6f3fd057d5cfaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257430, "uuid": "da9650fc-1d36-4d24-9cde-9c875f6a9a26", "value": "T131C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257430, "uuid": "3d7ee46a-50b3-419e-8572-1ad6cfccd09e", "value": "3072:HDWrFoeatGA59/qP98nTma9uk4cIXEuNGtj:HDWJoztGA5pm98niat4XEZtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257430, "uuid": "57baf209-b4f6-4859-a769-09ab14891d33", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257430, "uuid": "141da69e-24ca-4e66-90d9-97379a7fea66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257430, "uuid": "4f90dc06-10be-4208-abe1-e8ea54195330", "value": "SecuriteInfo.com.Linux.Siggen.9999.16189.20665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf58211-cbcb-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764273367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273367, "uuid": "b03a7abc-780a-4a11-bf1a-a3f72ec59206", "comment": "Malware payload (Adware.Techsnab)", "value": "44d1e143fbe897d52b976c76067442b9", "object_relation": "md5", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273367, "uuid": "72ac8550-531e-4abd-adf2-4a2c4fe88fe4", "comment": "Malware payload (Adware.Techsnab)", "value": "733fa368106785fd8e02b395c887507cb320e341a84767f79929daa748a6fb21", "object_relation": "sha256", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273367, "uuid": "d58af24f-c073-458d-bb15-6fa9e3b42982", "comment": "Malware payload (Adware.Techsnab)", "value": "00f187193718acd84e6fe5a84c5ed2dc7ba1b27e", "object_relation": "sha1", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273367, "uuid": "f4e0224c-05f0-412e-a991-bdca8787c77a", "comment": "Malware payload (Adware.Techsnab)", "value": "43aff607a38ecfcd0b161fefdb01f947b8514f7e66f3b0227c9deeb579ed7d84dd5a60b1dd378eff7846bd4144976560", "object_relation": "sha3-384", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273367, "uuid": "9f84c548-a155-4a1a-be6a-1414203aa939", "value": "T1E4D44B26ED875CA387D3DFA3D2E3E20CBE69949C900B5EC0B5B8C2825861D69075CF5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273367, "uuid": "f5a24c30-c52d-42af-9493-324be85174e1", "value": "6144:buuGJGRUyLIrOdgOWnOBygxRd+JodNRlzIzw/O9z716bP7bMb:SuGJMLRBdVNRZmGO9z716bP7bMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273367, "uuid": "a03d4ef8-b6e9-4cc1-a99b-b4f76fc2dcaa", "value": 624587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273367, "uuid": "0a5ac614-52e5-46e8-ab82-b403169eb3bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273367, "uuid": "9e9efd07-3fdc-4c40-b02e-504929a1f2c4", "value": "NvDriverDiagnostics.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fd52fa-cbc8-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764272149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272149, "uuid": "45b8b216-25b8-40fc-b5a9-8edfb97103d0", "comment": "Malware payload (AgentTesla)", "value": "efeac648e34cf17cc09a3c0a0410aa1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272149, "uuid": "d5f9fac3-dee8-443a-90f0-02b29f43a714", "comment": "Malware payload (AgentTesla)", "value": "74ace00f731591af315dda87a91dcad538db3fab7a62d9e8612eef59dc128bde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272149, "uuid": "94bdbf4b-6a15-42b9-8cf1-18d57bfcb44b", "comment": "Malware payload (AgentTesla)", "value": "7e274ef56e9d4bbe57e3cb008c3bd1de981feb7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272149, "uuid": "5bda0ba7-06ba-4f55-a9d7-56bcfb95fcb4", "comment": "Malware payload (AgentTesla)", "value": "8021561add1a0dfc5e6359f4d004afc386127b4614f47c95928d5223627564142d9be52016d91941aea35cdf83e88154", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272149, "uuid": "2e6a5141-e9b4-4905-b921-34ab982274a0", "value": "T1DED4126537A89F33E9765BF12571E13203B90E5BB821D79B8EDAACDF3A127110840B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272149, "uuid": "a7a05eb0-8e91-4275-8620-9b1754980cf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272149, "uuid": "abf00df2-c97e-420a-a479-eb500dec1a96", "value": "12288:hLURCp7zinGJ/NUFJIZlbPm70Eqy8w5ADrB+3ZUNZBZT:+tiUJ+ljS8qADFSZUNZBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272149, "uuid": "73d76bab-50f6-418e-864b-98030bdd2af6", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272149, "uuid": "8be81209-0029-4b6b-bdd4-2fe8991a0f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272149, "uuid": "c1053e44-63ec-40c9-bb64-7ef8d670bae4", "value": "jrmNeelg7a0j38e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e55888-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764250988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250988, "uuid": "868dbec9-a88c-45fd-b424-4718d47ebef7", "comment": "Malware payload (Stealc)", "value": "38af8d2949cd6619b6c6bc849844cff1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250988, "uuid": "08bb9cb2-6a60-44f8-8611-96c2a0ba89f8", "comment": "Malware payload (Stealc)", "value": "74c4062f5aa216082806be2ba33cd4b4a3b06e2e480e43486195e8260a413025", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250988, "uuid": "b5cd2d94-5955-4f84-9114-99ba63a738d8", "comment": "Malware payload (Stealc)", "value": "d571ef3d1b5db300d3f047fe116d6d45b31ec2a8", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250988, "uuid": "269cb813-0671-478d-9de5-f64524bb5b55", "comment": "Malware payload (Stealc)", "value": "03c12f03ffa008bbbb473b9d5f31d9e703aaca37e12852000368b8167e997c4d5523ce218681ae10a5fd4ac7149bb14b", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250988, "uuid": "0768e23e-85ef-4408-8437-021012fe5f99", "value": "T16A95234712E126A7E4BE533864F406B781B2B8C09FB402FF57E98CA57E636D86D31316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250988, "uuid": "ed4d940a-71c2-4c48-8632-15bb9afe2675", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250988, "uuid": "7eb44f10-8c8b-4235-b61b-629266e9bf8c", "value": "49152:31wQI8wZYgAx3LZTqtJCrz3TYN8xRacJL8/p8:l8YndOvCrzjFnJLMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250988, "uuid": "7731e756-bdce-4e4c-883a-a01286a2e91d", "value": 2034176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250988, "uuid": "443cf30d-c56d-4dcf-bbe9-3118bf78396a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250988, "uuid": "5958fc9f-7539-4433-ae29-2c2d2c1f0e85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e251cc-cb85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764243502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243502, "uuid": "d19e9d55-5794-41fa-8977-72ffedbddcc5", "comment": "Malware payload (Mirai)", "value": "a4e0485ecd68ca455aa71c22f45a8cc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243502, "uuid": "d75cf8ef-7173-4523-8343-8f6b3dd062b3", "comment": "Malware payload (Mirai)", "value": "74c97bb88b737c7d720ceb976c8a6a19c2b4b724f995e5cdae46e371cd07952f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243502, "uuid": "3d0bfa24-2c00-41d4-839d-1f7f6914e7dd", "comment": "Malware payload (Mirai)", "value": "8c0134730176420b32beb22a7d5f648fa7de21ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764243502, "uuid": "61c9fcea-99cd-46d1-84b1-efc124c126e3", "comment": "Malware payload (Mirai)", "value": "10c6cf856ac420b0a61f0c143b39844898b637acde402f83a1233e94cc97bb6ef85eb50e8b3ada17e57331376d8dafeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243502, "uuid": "b6eb5984-b4e8-4740-91cd-e72aa682f822", "value": "T1C434231B057B8500C87832BCB695536FCF2BA84B5EEA5055E8A0E7C0ADF06F5CE935C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243502, "uuid": "a31b7400-81d8-40e4-a0dc-a92d8c19d612", "value": "6144:9rZ1EOyAmNJQWStojE+EFhsRPeqYjVJbUl:dXTuTEojERbsBhsJYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764243502, "uuid": "bb0704bc-bc35-4c72-9e7a-3bb3d5a495fc", "value": 247064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764243502, "uuid": "5ddcb1cc-07dd-4424-9479-ca9184b25729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764243502, "uuid": "f7cdb45b-c233-48bb-b2a7-40efe24be8cc", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818e4587-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234451, "uuid": "ff14a830-d17a-4b26-9507-d95b716ab2a5", "comment": "Malware payload", "value": "60342853ed855ae1a549a63f9104f1b5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234451, "uuid": "7703fccf-1e9a-4a9f-8211-5f73924eb172", "comment": "Malware payload", "value": "75a8511b83604e6b10f58a7827f0640a222329f867c15b16b65d1e050078b7d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234451, "uuid": "4d0057c7-a611-4e03-87d9-61e27a10da0e", "comment": "Malware payload", "value": "53e9a7fcd4692272bbda9b8fb89d751b183744e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234451, "uuid": "9fbd8ecb-2054-444d-bedc-fb1962855bf0", "comment": "Malware payload", "value": "901c1b775eb3cbf84cb0d547e866b5445a5865d39f25e6896498655a3502951dec2a9fd57ad4942df08076bb753d8b4f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234451, "uuid": "613f1804-8f13-4eff-a6a3-cd55a8c216fe", "value": "T1DD9533E6FED6988BCB2F6979C1D29077F4C9408680F19291234752A8517FE68BB07F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234451, "uuid": "25bab88b-aee9-4f0d-be0d-0395f38a417b", "value": "49152:nevDsoVGRaPqi7N6xM0FZ7d+/K8aC5K7/fJFmta:nKVcan7caqpqK8x5K7/fH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234451, "uuid": "dff7dcf9-3bc3-4c0b-9dea-ff6fb3e89e07", "value": 1909260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234451, "uuid": "1394ba08-536c-415e-b50b-d5c8c87834b4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234451, "uuid": "99822ac5-653d-4f48-b282-20573696bf09", "value": "CustomFont.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6915ac7-cb44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764215669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215669, "uuid": "c7a1445d-7502-41b0-b542-6e3ff7769c78", "comment": "Malware payload (Mirai)", "value": "462e1c7cca235e5aba2b4392d5cb87ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215669, "uuid": "32ead95f-a14c-4274-ac59-177f5af824b0", "comment": "Malware payload (Mirai)", "value": "75d6febca32aabd342447ee22c0da1d09fe2f0115fa170ecb393e0a7eed5411c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215669, "uuid": "9b8c7944-3252-46b2-86b2-a8efb0dd99f1", "comment": "Malware payload (Mirai)", "value": "b41a04bea28ee2c0ec878c4beec22391d51bd9fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215669, "uuid": "4293b4e1-6819-46b8-b286-9de99b919409", "comment": "Malware payload (Mirai)", "value": "9a0154b7d3b9902d19b3df0a30a5fad3eb500ea69ec2dd4623d5945a4c1c44de97e5c2b8af013834fc520b062b55abb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215669, "uuid": "28ba3806-0414-4c12-9acb-79b755276405", "value": "T16313023D1D6B508FCDCCA170926E77DA144E364958F8388C176BEECE12335B9986E9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215669, "uuid": "3997d060-245c-4f71-8bd4-6eaf7d0588d1", "value": "768:gmD2+Wr+G2tMCHUuSPYUBlsoet4zBM7cMxq9VhvbVWFnT/Uqhncnli4IIOj:/2cG2tMUUuSPYUUb4yQmqj5cZT/LhnKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764215669, "uuid": "de10a677-23ee-4af7-9c1f-c7cc48a1b8f9", "value": 45412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764215669, "uuid": "3a6b9168-6dd7-481e-9e0c-3c197e3b04b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215669, "uuid": "fa495adb-cf86-4a79-8db3-2d85d3d2d124", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590ee2a2-cbe3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764283776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283776, "uuid": "8bd9dd67-2f1d-4ab6-a4b9-d918cf8768d6", "comment": "Malware payload", "value": "24f218239884167350acf99ffe0b0d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283776, "uuid": "1474055c-9c98-4236-9dd1-a913ad6b6a3e", "comment": "Malware payload", "value": "760e4cbfddd5bffa96eaf55daea493c9972ad0a8b53079b66d77cdb0b0d8fb6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283776, "uuid": "8395dbbd-4acc-4b00-96f2-ec0b74c5948a", "comment": "Malware payload", "value": "2f8207a224920f4edc0998bc626021a28ed52329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764283776, "uuid": "5c201bbe-2f05-4df9-8aa0-548d83aacdd7", "comment": "Malware payload", "value": "e6113bfbbcdf6effc63e219cc7f6c84b552308483d8d8b50ba81ab0dca2b9a6763557f74d72c207af2f5e7d771e54ad2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283776, "uuid": "e4138540-f57b-43db-b6da-1eb99e83fcf6", "value": "T16C532A2179396D1BC5C5B87B62F34735F2F2170A35A8CA2E7E620E4EFF2065026075B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283776, "uuid": "21e13f19-38ab-439e-b359-cdfe86e3ce2a", "value": "1536:4icRSqBH3mKJVdmwgndxZeXh+qML1Iel52Sq3SXeQchs:4bo2lVKmh+1lySXeQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764283776, "uuid": "1945a23f-6b5e-47ec-9172-bc7ae28fa36d", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764283776, "uuid": "258a2ce3-2aa5-403d-94b8-41e20de18c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764283776, "uuid": "844af34b-4abe-486c-8be3-89443470fe0d", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ea1031-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241606, "uuid": "f1c46dee-41a1-4a5e-8e91-a99582ae6987", "comment": "Malware payload (Mirai)", "value": "ec925a9a6a367f89fe586291d2c41d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241606, "uuid": "cc8a66f5-3b6b-4811-96ff-be34ee6c707b", "comment": "Malware payload (Mirai)", "value": "76a9b2464617325066ceaefbf896e0ff2d7059b4f3a7260e4258421a70ef43df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241606, "uuid": "a6c83161-1ea5-477c-b956-c8d32a7d2282", "comment": "Malware payload (Mirai)", "value": "55ac057612409cb356438e2ceff51bfc689aa9f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241606, "uuid": "c2ad60ed-f4a1-47e0-855d-21f3a5b17626", "comment": "Malware payload (Mirai)", "value": "f571f3c33561c40963e216d7f2697008bac061a507ae0ff576af17037db662fb13f655dc3958e26b55955bfe6587bd29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241606, "uuid": "f6fdfbf4-d1a5-4c2e-a86f-f1d04ed412f2", "value": "T17F53029221F7DCB9E492A9B650D68798F3CD7C9E791856E208EC32F9DC732802B10955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241606, "uuid": "1eb01d89-2608-4047-95da-d45b4b2d95c6", "value": "1536:NZWUXuG7FOVKV3gAs83YMStid9GMB51WBFTOitmiP04:7eG71/3MecMRs44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241606, "uuid": "a3da1494-96a0-4ed5-ade4-e6b6e4959ef0", "value": 65552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241606, "uuid": "cadcd1ad-103a-4c90-94a6-06a60f26ff23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241606, "uuid": "b6872e2a-e0a4-4cb1-a7ed-4a8a216699ca", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcbb37a-cb43-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764215255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215255, "uuid": "a8402696-f03d-4c38-a849-0b8d71324f60", "comment": "Malware payload", "value": "2e5d3eb935adafb22ff82e05156b00b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215255, "uuid": "219393f5-ca43-4e65-9691-35231885ba8a", "comment": "Malware payload", "value": "7724e9298465f768bbe777a17e9f5343f2aad38bef27c54b05d27b0d6862c7d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215255, "uuid": "288a1607-7dba-4be4-8c25-2a1385e0119a", "comment": "Malware payload", "value": "30aa8fe10b46297d51940ede4ff5c4fae3ad2965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215255, "uuid": "3321a6dc-a1d0-487b-80c0-882e1b863b20", "comment": "Malware payload", "value": "bbb0f3d33876eb3db015904ab9539bc7caea2a89dfea119c7f8a8695ea92ac494c8c44934d264ebd2d35486322206a15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215255, "uuid": "14e9c1a2-af8b-4e50-850c-ef6fee7eb905", "value": "T13C84231C0C1587FEC2C678A95F4213797DA0C10D5EB91AF9A60EB9825B90F3D5B81B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215255, "uuid": "b7dc2a71-80c2-450b-961d-e5ab9af755c0", "value": "6144:8WIy1/sKuVaG5cAeUnZ6ff5hzgneOFw5a/v27MA/HHDz/TgD/F6ioz/HCdnHkF7:SlpWOqzkFw5a/u7r/Hjz/Lz/CdEF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764215255, "uuid": "3d62fd54-1781-420f-9cf2-250d46159194", "value": 383720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764215255, "uuid": "7d4c8039-de58-4d6e-be46-234b10a5fee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215255, "uuid": "24155b98-7213-4b06-888c-59824d462598", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239d2f15-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236871, "uuid": "849d0c06-bd44-4800-864f-c89fea65ae9f", "comment": "Malware payload (Mirai)", "value": "11c74cae46a9717a47b0f1bce640f071", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236871, "uuid": "a4330d0e-831d-49f9-9a35-25e41bad1343", "comment": "Malware payload (Mirai)", "value": "77746a9734fded35d458bae05497ee40d4d169c26daabed1abba75f0fae8ae42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236871, "uuid": "79ba44d2-3893-4721-b108-118e8c187afd", "comment": "Malware payload (Mirai)", "value": "1eeab6f400c769cd310860fe4412c10cf19ff0a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236871, "uuid": "40ba7d5c-d104-4100-bdea-54826873a9db", "comment": "Malware payload (Mirai)", "value": "05c623652dd3ac30a401fea1b90381a9a1273f665df83e8df4d0f86e9eb5168a90e2ad40ca037caf9c2db6cb80d5e79e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236871, "uuid": "4093deb4-3996-4d51-ae69-97c58ba2920d", "value": "T16FC33ADAF802DD3CF80BD6B644674D0EB921E3A156835F26225BFD93AD331A4B813D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236871, "uuid": "db762e3c-5ef1-4caf-b917-3e97e9051930", "value": "1536:NVI1MQBlUwbswLQ657zSwISXqDdkZjPyVbhHWYpL3fPu8lgxFkGOEVK5Kx5vjLv+:N7wLf5ESykpq2sL3XunXVhxNAp47Zt4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236871, "uuid": "a483115b-97dd-450a-a4f9-adc93394be54", "value": 118676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236871, "uuid": "bb660e1d-4a3a-412f-b63e-92c2f526733b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236871, "uuid": "4d1fa88b-a7f2-46ec-bcf3-5669519253de", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aab9c31-cb9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764253365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764253365, "uuid": "e567ab20-807b-4eea-94d7-e9ede030a400", "comment": "Malware payload (Mirai)", "value": "f47cdcb43cea5cf5ab281f2121e20c74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764253365, "uuid": "bd4e83f0-ec9b-4266-96dd-3c8c692de230", "comment": "Malware payload (Mirai)", "value": "7775de9c06ec47749e02ce708c3d64359298894c4c8195c5b7d4f6b87bf8fc29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764253365, "uuid": "96e65ba2-c620-4ef9-932b-77efee63dab5", "comment": "Malware payload (Mirai)", "value": "addbe018d830c5b76077bc5bad16fb6c46e858e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764253365, "uuid": "0a377cf7-c015-478e-99b1-14448dbde0d6", "comment": "Malware payload (Mirai)", "value": "a98d06dece678ba4c7100589537bb8338f8429671ca85826991c367e641707d4901a59843a11743a921326c9df53a7d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764253365, "uuid": "3750ca89-f729-40fc-b6ce-3c34578eab8f", "value": "T1240196C026751A7138EFD4DB47324D9C3089A87B3D865CBCA8ABA0DE4995C11E04209D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764253365, "uuid": "3ee28eab-f1dd-4f0f-871a-e82d6c636cf9", "value": "12:YkF1kcClZF70ScpHFOpHFzpHFW7FSGMFM5gFH7FSsMFMDgFzA1LRPb:ZDkH/FbcpHFOpHFzpHFW7FkFM5gFH7Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764253365, "uuid": "27df7c80-f584-4bd0-8749-2b3d349dd05f", "value": 753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764253365, "uuid": "7fef332b-eadd-43e3-8a87-670b83a112cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764253365, "uuid": "edbea019-68f3-4c3f-b318-19a5f11bc7ce", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f6252d-cb94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764249847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249847, "uuid": "82959457-11a7-41b6-b8c1-69e061fb5e56", "comment": "Malware payload", "value": "e62d2b68f8730d6698305630fe4b7e5b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249847, "uuid": "bc618039-5a88-4309-a73e-7cd033ce506f", "comment": "Malware payload", "value": "77e14df7fb73b07b316c9b8d22af12cb2aec57c01fb6a861e9be3a7eba459892", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249847, "uuid": "8593ad0f-9c8a-4591-bc15-962c61cbc60e", "comment": "Malware payload", "value": "c0b0d6ad612a347d1c4f0c1ad652069eb58c4a30", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249847, "uuid": "3d341e0c-ebca-4b5a-a590-25e2d5364840", "comment": "Malware payload", "value": "567daf6d6ab015f0d729713f1e8e777cf50bcef0bd4b6a4bad2f4af934050f3ede03d391cd7a621e43f8e4d05ef15628", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249847, "uuid": "7ba321de-0875-4c76-8e18-a92e41387829", "value": "T10F74085077F94500F1FF2F79A8B205214AB7B897AD39D70D098A949E1E73B81EC60B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249847, "uuid": "06821e78-e341-4386-a70c-288a88401ffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249847, "uuid": "98c9feeb-9195-4c28-9c9f-4618b54e6d3a", "value": "6144:C1p9ZGm1+3rUQaksJeyqIpgvi/JS3JkkAPjG589bAIpX7NhQol:q8r340sJeo5S3dAPjwWbQol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249847, "uuid": "1ad17ed1-dba5-4601-a915-196b71302d7d", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249847, "uuid": "4dab8cfb-acd0-45c5-97dd-f7ed1fad1e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249847, "uuid": "0382ad52-9802-43b9-93f3-a02b49b6eb86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3ed6df-cb8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764246923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246923, "uuid": "3ca7b9b5-b1d7-4c62-a75d-740c542ec097", "comment": "Malware payload (Mirai)", "value": "a40ed0bd6a3377a5f8157d1e85ac7a01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246923, "uuid": "2bc66226-1aa7-4abe-8e1d-6dce2508a020", "comment": "Malware payload (Mirai)", "value": "784f8746ce04f5ef1caeb7c2153cb419c47a1b4ebf4c191af1d8cd5970a3839d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246923, "uuid": "cc92108c-af76-4084-883f-0601e9ca1852", "comment": "Malware payload (Mirai)", "value": "afc06eb1fbf22a831db95fdb72cb16b2a66d7d24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246923, "uuid": "4877a6ca-d371-4788-a5a3-5c80405e5e64", "comment": "Malware payload (Mirai)", "value": "f4850975772ada5c2bb71a271624de58fe35c4599a57c12090b5d4bdbaa55c990a53c56b0378ffc6ca11cb689ce2c5de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246923, "uuid": "ab056bd4-db76-497a-b717-4e5d6946f670", "value": "T133434AC4B183FAF1DC05017C307AEB326E33F0B6613AED9BD7E45573A855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246923, "uuid": "c699f393-f7e2-40af-be66-de5805d1c21a", "value": "1536:MOssuiundFq4ZthwLi/pXUfx0WbsoPMdQZl7dDFfG:xzuXndFq4ZthB/VUfOWooPEQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764246923, "uuid": "35be9712-7af7-4163-8b02-427c88de0362", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764246923, "uuid": "f33762ea-f3c9-4026-9431-1e52b27f68d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246923, "uuid": "fc0347c9-e8a1-4736-8622-9da8ffc88650", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3cd4d8-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234473, "uuid": "b533a147-0348-4570-bc75-4e314662d777", "comment": "Malware payload", "value": "69f4005b796eb39d90fd5d65f3f2b1fd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234473, "uuid": "c0a5c561-0914-4d74-83de-261f02de64cb", "comment": "Malware payload", "value": "79485989ae3955e10e7fcdc9deeb33edae0966067e1f4748dcea3a98653e85d1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234473, "uuid": "404c134f-7a4c-47d3-bd34-938c0d726fcc", "comment": "Malware payload", "value": "1e94ae555d333b48e7aa20657d1855a48853dbdb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234473, "uuid": "6b0972c6-47be-44f5-81aa-32b03a5677ba", "comment": "Malware payload", "value": "2aab880280dda2a5cec3a60a9170a8287b56caa3c4aaca4134030f76c6f158d4bd75fb60fe8d0c0475643380fc905336", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234473, "uuid": "be9406ff-13c3-4104-acb5-29a235aea967", "value": "T179963330FB551455DD0F687C288A1581110FB295BA24A8AE3C10B6B16B2F6F97BF0F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234473, "uuid": "5a11833c-403b-4cb3-b83f-b112a53142d9", "value": "196608:a9ZJUC+zjzSVE2Hvv+rh6jM+X6wte6OUtIF1ffhz8ibkOv0xmBs:a9ZJUC+zjzSNHvv+rUq8vOPFJhrrv0g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234473, "uuid": "9e5f3818-aa02-4dac-926c-415876feeaad", "value": 8976110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234473, "uuid": "18be5dbb-4762-4f40-9401-6d65d224e801", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234473, "uuid": "22b8f442-46bb-4156-8966-25c32236ddcc", "value": "naftkhodm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932da422-cb9a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764252520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252520, "uuid": "20f3c1c7-9d81-4a19-97f4-6a66ef0379ce", "comment": "Malware payload", "value": "10dec7bacb90e154508c214945512def", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252520, "uuid": "434c9703-4808-4005-87d3-3a4bba835f2d", "comment": "Malware payload", "value": "79669de0d033988a50ce5e69715f1aa1a0a7a41b7d5870fb84d80f63fc509bb7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252520, "uuid": "1ea54382-0fa0-4ac0-86a3-6f5a9f283b0c", "comment": "Malware payload", "value": "de632efde090ea867293f6a89050db0d9a04535d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764252520, "uuid": "0f1dc9db-e1f5-425d-a12e-50e22342cd49", "comment": "Malware payload", "value": "72cadb4824216f69e3dcfdf3a6037b231889177b44d2cfaf34d070a5ffb512cd105a935244835daaac34a8351a2f9590", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252520, "uuid": "3618491d-66a0-4f59-a0dd-609e25a6627d", "value": "T192112ECD1290676986CCCF0BF6934E6C25498ACF898D1BC97DCD987693C4BD4F024D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252520, "uuid": "b415d922-7616-4626-8cdc-ca429ca53e31", "value": "24:KSKZjmvm967mcsUneL8pHmbyjgII66lnN:KBpuYKpjeL4sCgIinN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764252520, "uuid": "3ecbbc04-54f1-48d9-ba74-3ed8cef0965c", "value": 943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764252520, "uuid": "613837bf-91b0-4c58-ae30-76db343959f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764252520, "uuid": "1ee3af94-02be-4230-a8a3-8a9212f424ec", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007a867d-cb90-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764247979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247979, "uuid": "77fe5ef3-4d54-4778-87d9-6719e8a75feb", "comment": "Malware payload (CoinMiner)", "value": "f61e712fb0831953d3db7e34dd13e114", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247979, "uuid": "d54011bd-f493-484e-9310-2bfc8e505f27", "comment": "Malware payload (CoinMiner)", "value": "7a1e4f70eee2e623e59867467b1e9174faec5731d6e598a921f838d97f31677e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247979, "uuid": "ec86f2d3-65d5-4638-8f0e-13b9d8896d11", "comment": "Malware payload (CoinMiner)", "value": "6763aae6db7069aed2962ec0134fc9fb7fdb2a21", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764247979, "uuid": "736c2cec-0e16-4df2-beef-afbccfbb140c", "comment": "Malware payload (CoinMiner)", "value": "c80679ba945b1b4509b6cb810662862244b92a357438317e682026e8dd9633ada877beae4ca09ee96e0217b51331351a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247979, "uuid": "51ad1e05-2485-4501-8bb2-d5102b022c21", "value": "T140569D14A3E804A1E57BDB34CA55C333DAB07C925635D24F0598F2422F73EA29B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247979, "uuid": "6b4ce330-7fb4-46bc-bfb9-4914c45cb9fa", "value": "3b4eedc065e14ea4fc4b76ba549cbf80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247979, "uuid": "f35ff039-2ed3-4ac4-a8d5-b8aa1a337292", "value": "49152:L8/hvMRFdmBSn1k/X1mH6/RkOhGzuInFnwX1fcWLQJU6S5vdrlhFOsZphsva14xS:Ww41mamfnq1fcWLQ+ZphsbNKbJ2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764247979, "uuid": "2ed424da-b43c-43ce-b337-90b1efede762", "value": 6177792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764247979, "uuid": "199ad6e2-27fc-41fb-a25e-59664f27a237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764247979, "uuid": "18dc8f94-e83e-4490-a004-831e71eab347", "value": "ihrewq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d38143-cbd9-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764279455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279455, "uuid": "fcb4a09a-7199-4faa-90e1-276f608d59e1", "comment": "Malware payload (Socks5Systemz)", "value": "8554566888e5ddb6b7d5f362d30b389f", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279455, "uuid": "d1ab9f41-ba6e-43d5-82a8-a6c7217d16d8", "comment": "Malware payload (Socks5Systemz)", "value": "7a991e373fff304ea6e3ae4d14ff7b7eef29f453c3f509477ee1d87a8d12ca10", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279455, "uuid": "99f6677a-1665-404c-8fad-246741730bc4", "comment": "Malware payload (Socks5Systemz)", "value": "423ca10c9acfe5ee5345c8e58310b42726107777", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279455, "uuid": "53d9f35c-e41c-4887-abdd-ac3a4f88721c", "comment": "Malware payload (Socks5Systemz)", "value": "8396e704339bcd183808f39a2625337cf7e6383c012213e37ce4165fba528c68c03df9b2646a87813115154e6e6c9df3", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279455, "uuid": "2f0f3c2f-786e-495f-8b1e-2cec02b6ecaf", "value": "T1851633528EC260BEF17BFA74A6847EBDA5BFB85558247E5200DE628C1E331CB075D708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279455, "uuid": "a1275a81-52c3-49a5-a0d2-c64b6607908f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279455, "uuid": "1d757688-161d-4712-8eca-fb9358103b0d", "value": "98304:MZMam0fxw8z7mdr2zaozqNVLCW7WkN9VqDOiB1MziZGWOILLQ/fs7U4cCP:rP0fxhPzaKqN9n7vnyOiBuzikIyfj4ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764279455, "uuid": "ed81e28d-01f6-4090-8bcb-3e95f8789c80", "value": 4245328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764279455, "uuid": "a3e46e53-a3c0-4ed0-b86f-48ab669353e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279455, "uuid": "88a47d4d-1b98-4944-9982-fd9287c5c6cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d037adc-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223706, "uuid": "25d17f6b-e91c-4865-a755-0e1643d7fd8c", "comment": "Malware payload (Mirai)", "value": "a203c1ad1f4ece80d2bb65222d4bce20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223706, "uuid": "6c786016-6226-4959-abe4-0f702f28154f", "comment": "Malware payload (Mirai)", "value": "7bc2031ae684185e147746701a0c5ea84fff1ac3d04ba35844452a749df1b9bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223706, "uuid": "881c4484-f96e-4bdc-99a9-baff89ba03b9", "comment": "Malware payload (Mirai)", "value": "9bf876da8887d290dd1ddfe64c7dc722e30f75a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223706, "uuid": "7f0b3bc0-4086-4db3-b382-74d416889842", "comment": "Malware payload (Mirai)", "value": "79dc68297217ce2d83f783f5a93291dd233361502a2889ca99e025d7e836778bec410d8d4c239415be4b191f753f04cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223706, "uuid": "5b21994b-c2e3-4d2d-8d3d-cd9ca3f511ad", "value": "T12483C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223706, "uuid": "bcf773b4-2496-4bdd-80bc-fc2473e60897", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAugR:x/8RHTgMcJ0fmqJZOpkM/tR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223706, "uuid": "0363b14f-f150-417f-bdb2-a6c4e7886e87", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223706, "uuid": "c1c98666-5225-4477-9d94-b9b6e55e7ca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223706, "uuid": "765d959c-7c41-4464-8b09-4da6d49093a7", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33e062b-cb94-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764249970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249970, "uuid": "661ba1d3-4248-4897-a5cf-28323576195f", "comment": "Malware payload (GuLoader)", "value": "64d033b001a6b02d4f8c7bd19421b52c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249970, "uuid": "bf28ed16-01da-4fa9-93fc-edda1fbe9e3c", "comment": "Malware payload (GuLoader)", "value": "7e135f20e320b5f2619d8ef43cd545bf013a37e50d4120fbef74a50f7795a1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249970, "uuid": "e218f085-beb9-410e-8c45-c573d3b86b9e", "comment": "Malware payload (GuLoader)", "value": "c458389c94da7eb80b6ed9efcd1c689cdb1b6aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249970, "uuid": "4335bd0a-6753-4fc3-81e0-bc43f4b22746", "comment": "Malware payload (GuLoader)", "value": "b43e4819617582871b9b40249d27a1a74d819226056b2a927c11f5b12bc390b7f2e03f5fca6693f58b1629558381b9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249970, "uuid": "7ec0becc-3a1f-43db-b0a8-42973172092e", "value": "T16DA4E007BB05D82FC16726395890A70E7298DE059B5327473764BFECE432E926EC83D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249970, "uuid": "1f9776e1-12d9-4532-898e-bc0c5e04c2ac", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249970, "uuid": "28d58eab-1e9b-49a7-abbf-5cee27ccc17d", "value": "6144:up+ggKWMNFaP6B0UX64Z5mmNHjFJweLpaE/sJEKTveyk9FfcRrtiX7x6sY0YTT6N:6BF3lX6m5rHjFJyE/+Pk9NcNt2EuY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249970, "uuid": "2e5d9908-eef9-4887-b969-2acfbcfdcca7", "value": 482208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249970, "uuid": "d22f958a-7939-41db-aebf-326b0aa350dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249970, "uuid": "2fc5aa94-595d-434a-998b-f81cb75472ab", "value": "Facturas_avance-20251124-08380962183868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8cae6b-cb24-11f0-a129-42010a9c0007", "comment": "Malware payload (STRRAT)", "timestamp": 1764201610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764201610, "uuid": "ceea3f73-8a13-4cfa-a13c-263f2c0b0c2e", "comment": "Malware payload (STRRAT)", "value": "a28c68095b869be649739ee18b7e2edb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764201610, "uuid": "47063a3b-63c5-4af4-a179-02aba47b9943", "comment": "Malware payload (STRRAT)", "value": "7e31b4cffc7101416f367206fa4f80d103f3ec130fb7d9a5312baf470d9920ed", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764201610, "uuid": "ca3437ef-a6e0-4864-b428-ea3006451a26", "comment": "Malware payload (STRRAT)", "value": "f73afb4c6a5e3e6d4e19e94c663b919cbc862c36", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764201610, "uuid": "a2111e8e-ce31-45ea-9092-ac785f58585a", "comment": "Malware payload (STRRAT)", "value": "93199ad909db3d467d8aea9fa412926a0bdb8c055ae6606ad9626a67c654304f71f74216cbf311d73a22281bb96e9ca4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764201610, "uuid": "1af34a23-8f70-4d38-920c-42a5a6e59663", "value": "T1E8541A1A3F99E0B2F11351334664D22DB9286AEFC200D65F1BFC5D5C9C74C980B96AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764201610, "uuid": "3a0f4259-3920-4c06-a4a6-54eb237bc124", "value": "6144:vjFzw6XfzUp6tN0pRu8HaPG2r2ol3HPUxe46+/z7Pm:vjFzwAzU0Y68HaPGOixeG/HPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764201610, "uuid": "96fa8cd8-b7ba-4ae1-b69f-2d9806ddd0fd", "value": 298848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764201610, "uuid": "c200cc68-ea9d-46b0-b3d8-64cc1af92a98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764201610, "uuid": "490790ed-75c0-4d02-80d6-ae7d53c10ee9", "value": "Purchase Order #3782.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827ddc25-cb55-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764222857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222857, "uuid": "829072ce-5e71-4c01-b257-4f1bf4017676", "comment": "Malware payload", "value": "7805598aa74caf14fb9d37ba020eb66a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222857, "uuid": "04b72bc7-618d-48f8-b618-dd15959f5869", "comment": "Malware payload", "value": "7e5fbce9bce17de629ccfc1f8cc40ff780c8be1b0efd42f726e2bc469923fbdf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222857, "uuid": "edd287a7-ea60-4642-bc4e-7eb8d88eea49", "comment": "Malware payload", "value": "172fb19e55327e241f7f6d27cef6977f441ff39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222857, "uuid": "e5f038e2-b246-40cb-a836-ee5768cb1787", "comment": "Malware payload", "value": "c2cb61720ddb45094cfd5a0c19ba5f656fa99776b5d20708d5462463710733e09b4868c58a85ed066fd73c3389e8871a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222857, "uuid": "ab769f8e-8273-4bc1-8dd6-941e213b4f1d", "value": "T1DBD31A45F8504F27C6D622BBFB5E438C772A1768D2EE72039D256F24378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222857, "uuid": "6536dbc8-89a5-4303-bc8d-bcf0a2c8f578", "value": "3072:egThglORhlz4DHkhWakCM2Ec6Udf7cBW:pT4ODZ4DEhWak7+f7cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764222857, "uuid": "e7928ae7-fe2b-497e-a3aa-c7dde24c0f02", "value": 141952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764222857, "uuid": "c58f4472-f965-46c3-9914-5c0fd78f9318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222857, "uuid": "3c5012e3-216f-4788-9ddb-79f560d58071", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418be94c-cbc8-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764272140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272140, "uuid": "2aff266d-815d-408a-8688-b7288b1861cf", "comment": "Malware payload (AgentTesla)", "value": "1c1028df6bac7ed9af6ff934bab64fa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272140, "uuid": "feabc0c2-b401-4287-8992-5a48128c9f05", "comment": "Malware payload (AgentTesla)", "value": "80f2a826cd8e1890cadf12d437880bf18d98f05d8de4a4817db1d0b33890de22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272140, "uuid": "393185ba-3e8e-476a-b5ba-0727883730ee", "comment": "Malware payload (AgentTesla)", "value": "a18556e7f13dbd074918d6abbdab38c5bf50a320", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272140, "uuid": "b623c709-edd2-4e7e-bc59-9b1bde81a059", "comment": "Malware payload (AgentTesla)", "value": "128d9cc73fd646cdfb92537ad8ed541cc1f67369d7bdde078f28df5d02918267a1c00fdfc042b2e3037ed9131b70f683", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272140, "uuid": "602392d4-494e-418a-8f04-38b86d8d2a9a", "value": "T121C433EB769C701C6D26B3303BB5ED577C8CC88981ED056F764678C909DAA6BE0C3464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272140, "uuid": "99f818de-700b-4f48-b7bc-ba29ef6736cf", "value": "12288:UDbZjwhl2UkpWAtxbFpFXxbw83xxJX40B5WkaGdLDKV6H:UbodkpWipvFhbNhxJX7bFHoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272140, "uuid": "d4865e0e-0408-4551-884d-35b8b10f9b96", "value": 594998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272140, "uuid": "88df0c8b-f27f-4a92-97ba-8c1c086e82dc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272140, "uuid": "4237b052-4a95-4f3d-8124-61a1d24152cc", "value": "draft doc.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f773be-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228520, "uuid": "d26343d1-84a6-41f1-b833-d80ad0d58798", "comment": "Malware payload (Mirai)", "value": "67427f92cf70239f64b0435cfb731f22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228520, "uuid": "e7fd60e9-4fb3-4ce1-be4e-7b6482fe5cbf", "comment": "Malware payload (Mirai)", "value": "8130c4ad993f7a01e9bdb1fa83fd4d90b13fce33771041ea53b8882a6ca1ce7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228520, "uuid": "40ca14ae-fc59-4b90-b570-ff2b0d94ac1a", "comment": "Malware payload (Mirai)", "value": "55e0d2055322a9b72558aea5fb7bb4b7ee025a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228520, "uuid": "8e96507f-ee2c-4790-be66-20556ef7ff2a", "comment": "Malware payload (Mirai)", "value": "f06fac0ce121866f7d33420573c5cecbe603ce248103d62f558db8c78d32050201ab834ec6032f0670e95feb4446a950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228520, "uuid": "cdc5950f-8fca-4093-a404-c5fa67e51b27", "value": "T1DF7364393E61BBFEE67882300BF76F70C351219276A19345E26DDA085FB124C5C9E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228520, "uuid": "15a6a36a-cfe9-43f8-9179-cb63a9dc3f1b", "value": "1536:3JXiuDHjMhT7VupoT1g8kJe7BMHfdL+IBbldAB9ewDRnB:bdABbDVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228520, "uuid": "82748ec1-f9de-4433-9897-6f4f8854e49b", "value": 79636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228520, "uuid": "fb0c7da2-2097-4889-8031-47b43aa7ab1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228520, "uuid": "3ef606b9-e87e-4c04-b3a7-90e1501e98fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238c0f19-cbab-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764259634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259634, "uuid": "819f91a2-368a-4ef9-8be8-f96fc36a34b7", "comment": "Malware payload (Mirai)", "value": "b697fa67c10caa3185b8a36f98cc8787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259634, "uuid": "5c8f186d-b973-49da-aaf8-31e2257e9bd9", "comment": "Malware payload (Mirai)", "value": "8242868f7f1db81d9de299cc33a4c78d60d777e344a87dfcf181293b4a4cca99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259634, "uuid": "23ceeb7f-b92b-435d-850d-aca2702baa58", "comment": "Malware payload (Mirai)", "value": "fb69b007ed494f54beba8ad77694b00c53f2b78b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259634, "uuid": "3da33081-64fc-4996-8eb2-fe7c85be17be", "comment": "Malware payload (Mirai)", "value": "4458bcfbd4ebc0ef853f89e0322953e09cecac65cf66c0ab467002919526d715b2d1f24c3c49b51fb527f67d3eb0886c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259634, "uuid": "26e980b8-30f8-40d3-adc6-0987bfef41b5", "value": "T1E224638AAF913FFFD85ECD330295CB0A119C891A1294BF766A74D418F68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259634, "uuid": "ccfa8bd5-327b-4f72-aa9e-2bb22dd2dec1", "value": "1536:KNfP+gn86Upa2oBcMozm4IU/97Cpa9+k83smbDrC8pAmIjlUQ9i9UBq0MF6t8Elf:Kx+eipahBc/Ghk881W6PNBq0MFcn5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764259634, "uuid": "61afa2de-8a6b-4a1c-89d0-4b0d098c79e8", "value": 221176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764259634, "uuid": "a4eae457-807d-4fc3-bd68-b0032997d463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259634, "uuid": "63cdad9e-23ae-439b-9b78-9eed1e4ac932", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841ecf61-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234456, "uuid": "81680cdc-7694-41ae-8216-26cf981c314b", "comment": "Malware payload", "value": "cdabfe9d004deb5ad3dc32482143e05b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234456, "uuid": "5647efe3-0fe9-46ad-b9f7-758e9953c813", "comment": "Malware payload", "value": "832444cbeb017474800c28fe9891e2e64e5f6a67f4d591a91c16fa1cc1ce803d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234456, "uuid": "5158eb63-0e7b-4f71-8c30-1d212f2d524e", "comment": "Malware payload", "value": "a1a7bbaaa467aed55f815ba0600cb14842b51095", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234456, "uuid": "795361d0-b271-4047-ae67-2077088c45bb", "comment": "Malware payload", "value": "946c1ebeff501703a05854d3e33f07d6a26776b9dbe3d97d90cdec85add389a5c5ed6f0e755d03b6f42051372e3cf7ea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234456, "uuid": "f3c7cdd2-bc77-4428-8046-9ba744f2f6b5", "value": "T125C63379911B8C09FA10FBB43588C956FF5EC90A42E1F85AE749C9C168C783EA587F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234456, "uuid": "b32087e1-472f-46cd-a442-4d50ac3afe90", "value": "196608:t5bbtaeamVGX/tQdJspkm+NlJNB5qreSHQtPu8yMjByljk/q89otWD:7w8GKdJst+Nlqv98tkkS89Yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234456, "uuid": "fed7a974-1b13-4b8a-93c2-a5bd3bbc5e4d", "value": 11494998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234456, "uuid": "80e2418b-9638-49fa-9157-12cf94ad6568", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234456, "uuid": "11291204-03e9-4d48-8881-e1e017003486", "value": "UPdate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5199e7b4-cbb0-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764261859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261859, "uuid": "c875e0f1-59bb-4250-b8c7-670a18ee64b9", "comment": "Malware payload (GuLoader)", "value": "a5f05c8a89fdd3dfefd971b4061aac6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261859, "uuid": "c1f00add-13ae-4d55-b5ce-3bbf56bfccc4", "comment": "Malware payload (GuLoader)", "value": "84b37e5ead916c5d6f8745c23da01677b628c6436b893014a7295f2d1a6dbeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261859, "uuid": "09d80f12-6e58-441f-ac32-b3ffe8672d10", "comment": "Malware payload (GuLoader)", "value": "53675067c54386441a11db265d8ca40f77bb5622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261859, "uuid": "8b06dbe2-7e2b-4c18-a84c-1f87d3122284", "comment": "Malware payload (GuLoader)", "value": "22182ee773568b56e9b2af1781a662bf2f6db4fdef5fb88db6c4546cb02e1bedf2898ad76889d9860f334331b9c9d7d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261859, "uuid": "62360fa0-0b7a-4a96-b8e7-d1b57ba43091", "value": "T1050523053A71F5DACFA30A710DBA1F33D2DF2D1055099B2B47A09AA578B36C24E3B587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261859, "uuid": "df0063de-6190-4377-bb2f-c4aebdb3ebfd", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261859, "uuid": "3a9583cf-12ad-46a4-8342-f234c3002207", "value": "12288:lZT9uR02tKO5S1jVAukOlMTnvCGd59vXrL1CEEwADHyI6po06lzXpMbh:lZR6ZtfWVYOSvCG39vbLlEwZF6lrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764261859, "uuid": "1443d0f8-c942-4e81-abbd-0843a9e9fcdb", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764261859, "uuid": "8a4ae94d-8697-41e7-9ce8-4abb0e984bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261859, "uuid": "8242da69-bf5f-4e35-a753-74f8123762ae", "value": "INVOICE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21710ea0-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236867, "uuid": "310a8da9-2ad8-434d-b581-2b12f0049d5e", "comment": "Malware payload (Mirai)", "value": "2caf076b3d24bb0e979b3e0dd5034c7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236867, "uuid": "b913c18f-0534-419f-8147-002b611e4bec", "comment": "Malware payload (Mirai)", "value": "85ff0534653f5fd0e74db6a1d22c80de1224e7af3b9e9c95761281bc4649132d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236867, "uuid": "b692dda2-cae8-4872-85e5-be7da1a0e064", "comment": "Malware payload (Mirai)", "value": "526bc2513e6cda570bb18da8551813b41e4d6559", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236867, "uuid": "adacf0a6-41ee-4c4e-81d8-c9e965c297e2", "comment": "Malware payload (Mirai)", "value": "90f63bf7b9066d70b780e93fb219ed0ae1b639d472ed9072ff6a0989720ca08d45fba87ea41b35c026e42e02c478e181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236867, "uuid": "826e15b6-329a-426e-8dd8-a940e56e85f6", "value": "T1FF13F131F1A96D66DE677FA04C15E7D4B3B31F8FE39FB8439AC86A500AB07071211A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236867, "uuid": "08704b34-141c-41ea-90a0-310b605aec0c", "value": "768:wnlKSSUz94SKYgE0squkVK9Jyj/GOLnIv8u/Lgqm8uPrh4ThaeFLW4uVcqgw09P:wnXX59kcK/tLHu0IuPrh4TIeFa4u+qgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236867, "uuid": "3494767e-d0eb-4391-a4a8-17f27d1a9b82", "value": 45500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236867, "uuid": "953b458a-5e0b-4f6f-8540-8f78534106a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236867, "uuid": "5433db40-0e3f-4fb0-b95b-5d45778faeed", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b09de70-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236883, "uuid": "53d84e21-3da2-44d9-af42-fbe61f01b0b1", "comment": "Malware payload (Mirai)", "value": "85f5fd9594cc6411f0a4d852c4ab7a8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236883, "uuid": "6d4aa1c4-7bf4-4513-82ef-f22bca398619", "comment": "Malware payload (Mirai)", "value": "86bf803fef0733d389528a4ff753384548f2d6800c8416d02657bbfb4ce3b837", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236883, "uuid": "7acd1c56-bfd8-4e6a-bed4-ece6e5252216", "comment": "Malware payload (Mirai)", "value": "4f7c1478eefc6acbfe152ca7b7a958e354f697ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236883, "uuid": "3b60345e-643b-43dc-a234-5c43e94ca2b8", "comment": "Malware payload (Mirai)", "value": "0dba976c6aa611c1c38385c481b827140ee031832a2db7ae68d3b6096ea3557160fa25470fb097df661462db7a35e7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236883, "uuid": "ab7539c2-8196-41a1-b406-01a6e393daf6", "value": "T18C33F299451591A2C3794C3FA2CF0FE50F31E088777767C5663109CEABAA1DBE80E9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236883, "uuid": "6d57d686-1d1d-43c4-9b2e-7e0d4458bc7b", "value": "768:CVPEFUoG3LZ3abs+FIjN05WNDvJq0R6UCg5oP1M6QwS24foag9yVSxoZWb:WPEoZ3abs+SpoUJNbCXxNuVSxo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236883, "uuid": "00b17c95-6533-4d7d-b6cf-22bab39d8183", "value": 50536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236883, "uuid": "f4d546bc-6c67-46e9-84df-c77ebfb045bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236883, "uuid": "c62d816f-7368-4286-bdf5-2580505cde35", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82839e1c-cb95-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764250344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250344, "uuid": "9593fa4a-268c-4652-8302-233b3708cc66", "comment": "Malware payload (GuLoader)", "value": "a20575faafe893992a0b148e5f9b8208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250344, "uuid": "d662a7e8-9498-4e9d-a5ef-12dc6b3f9280", "comment": "Malware payload (GuLoader)", "value": "86ca358dca9bdd6ece4c14c1427a9ebf060143901af7fd7b35ffd5040fdfda7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250344, "uuid": "b21e9db2-1b6d-485b-ad58-cfae678c6703", "comment": "Malware payload (GuLoader)", "value": "65cd32a5636b1c862934fea6e353b529a9add7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250344, "uuid": "c7674fed-368f-474e-b158-ec37ccdb13f0", "comment": "Malware payload (GuLoader)", "value": "e9e7252c5bf1d55237473126d2cc33d4bab172c4513c0e09da05f5983538508384761f37f65b92668505687a1378bf02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250344, "uuid": "b076a802-f63d-4fa9-8642-f986b9383411", "value": "T14DA4F107BA04E82FC05726365CA1B70E73ACCE059A5737172B646BEDE433A959EC83C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250344, "uuid": "637c1cd7-2b91-4399-b3f0-cdd36e413295", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250344, "uuid": "b12103f4-8a79-46a6-9167-4de11ab15d6c", "value": "6144:dp+ggKWMNFaP6B0UX64QqQT/w3b3uvMUrHlFcKvPcAP7vV+371qZ9jw8bCc2QM+W:zBF3lXhJCvVIAVk1s88bn2qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250344, "uuid": "e1d4eb82-62af-4743-a78d-1507e1a8c4bd", "value": 492688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250344, "uuid": "804231e3-1486-411f-9091-884b5e1ac992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250344, "uuid": "53335e86-49f8-46b6-8e0e-5ad4e3446a77", "value": "Earthinesses.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663cbb3e-cb94-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764249867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249867, "uuid": "31406ded-854f-4485-bf75-07813f12f3dd", "comment": "Malware payload", "value": "df7cd3d6e39b4d2ef5042fa33bc373c1", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249867, "uuid": "af31543f-8b7e-42bd-af54-16f36bd05b24", "comment": "Malware payload", "value": "87062f41ed0aae54b39be57573ba5a7e27630d0eadde4fe0435716473f7ef4ad", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249867, "uuid": "16e716ae-5073-41c6-955c-869258bd88ce", "comment": "Malware payload", "value": "16d5e19194c83eb49946104e62ea06461585aea8", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249867, "uuid": "45cc471a-85de-49dc-89c0-7fa827e0ecfb", "comment": "Malware payload", "value": "b78f3c96787e91a87ff2be9c794284de45ea31227973e43ab2407e502c046310c0f23a8170df553030afe67212dd31fb", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249867, "uuid": "7ab85ed6-ba22-475a-969e-db4fca935970", "value": "T104235440BBC0B854139B1F67B62FB4D6FC6B04DE3889094FD111FDA0B9A470AEAE1975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249867, "uuid": "a6706c10-a224-43dd-a1ea-d975a9d6b995", "value": "768:9Qd3o8cT9JOq8SvbCxAlU88/JWEXnsFYR9ha4VXI7utqFxh1AnK8QEoL9DiGwJOL:SWupk/Qfb6HePiXsFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249867, "uuid": "f80d472e-0fae-4412-bfc8-b5c42a2845b9", "value": 48590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249867, "uuid": "3cc22316-88f0-4fb8-92e6-da4e62372f03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249867, "uuid": "a43afabe-f84b-412a-a1b3-d36568dda027", "value": "Notice of Intended Legal Action Court File Attached for Your Review.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d48374-cb7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764238757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238757, "uuid": "72544880-131d-4ae8-b8fa-890ef8de8e99", "comment": "Malware payload (Mirai)", "value": "9df454fa03263112a9fcb4d9a0220b3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238757, "uuid": "94c00874-697b-430e-8f77-9fdc0ff7c856", "comment": "Malware payload (Mirai)", "value": "871e023ad6cccbc7ca96ac0809d84f27dc7aa8da0887860154e3ae0abedafe4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238757, "uuid": "41fc46bb-1de5-4aa1-835f-bbaeab811446", "comment": "Malware payload (Mirai)", "value": "0c0927070d52148f400496754498e87c0805910a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238757, "uuid": "9b105a12-bb3f-46c1-a83c-c618a27cd253", "comment": "Malware payload (Mirai)", "value": "b498888c75f1596e34b56c5a3137dadfa75154dfebd88cb3d94799cad4f9de706a37e0adc338b842d2ab9d16bdb21bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238757, "uuid": "c1cf9b1e-06a5-47b5-bfe7-645becaa466e", "value": "T12B33014795BF4503EB6D6231269F3A1B75F05C28E99D1423DAA2B32A0B88F7C1509FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238757, "uuid": "5795ccb8-b8be-4d02-8118-ddde6c65ee7b", "value": "1536:Cs/NmUVEfWdOP1f8ztWzz8P3hAOct4vRyPGHnouy8Hyh:nOfWdO9YOuvyQout2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764238757, "uuid": "f5a470db-6c5b-472a-b572-5289523fbf4a", "value": 54856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764238757, "uuid": "575ad371-1d09-41eb-9bf6-434d1f8c7883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238757, "uuid": "dec2a2a1-0a6c-4057-b8e5-f8b78a381ff7", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d770b0e9-cbc8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764272391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272391, "uuid": "8ffe28c0-c905-4e91-b3e3-afb2bab2fcbd", "comment": "Malware payload (Mirai)", "value": "dd11bc879c6ebb1b80bbc373fc325716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272391, "uuid": "d61edf67-1d59-4cc6-974b-68da5c858134", "comment": "Malware payload (Mirai)", "value": "873cad5ccbf3be3b22f4f4c113b22773ea16a0f0be3064db769848e1cfeae060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272391, "uuid": "0d1daf68-b2f4-42f6-a98b-710b1f1e90d3", "comment": "Malware payload (Mirai)", "value": "82e56573c76afb4b49b6f0bf07ed5873451f5500", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272391, "uuid": "be706eff-3552-410d-a497-7a56d40cd636", "comment": "Malware payload (Mirai)", "value": "19906073099fa5ccd8da2ff892ab83fb1aaebb2a3f415597f95b3f84aa69f9586ad8f8e5ae1df08380bbceff7f823f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272391, "uuid": "f3a563ca-e8df-4f3d-b059-9be967f0f869", "value": "T1E4231A85F94BC2F5D80749306067F63FCB31D5699075D2AEEF4EAE31EBA76018203289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272391, "uuid": "6ad298ef-a042-423d-9107-d25517007466", "value": "768:dUmlQ1UTwCb4fib1seRIHY4nzy84hxXjW9ow3ResqkaMnd:d7lQK5b46bVIH/f4T1whesbaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272391, "uuid": "2a67da93-89b2-4cd2-8b8a-6157c9c20448", "value": 47516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272391, "uuid": "f44c7a93-e0f2-4bf9-a77c-3a932b230245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272391, "uuid": "786b9c5f-230e-436a-b5cc-89405ff559c1", "value": "Mercury.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4ea06a-cbd1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764276052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764276052, "uuid": "b1e20388-5977-4adb-8ff9-90c109911e40", "comment": "Malware payload (Mirai)", "value": "03df12234e06833c60da01aee3e01062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764276052, "uuid": "01fd80ef-1671-4b71-9c12-5ba2274f3782", "comment": "Malware payload (Mirai)", "value": "876bdcf1721d29bd3012a62f0d40a3a97f2871ac521728f35c0a1e131ea37bc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764276052, "uuid": "5147bf76-4625-4048-8a91-b8cb78272e4b", "comment": "Malware payload (Mirai)", "value": "9123d22483f5d92a6b81657f078d780461939c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764276052, "uuid": "8239e85d-2d4f-4c44-8aae-ea93b1183522", "comment": "Malware payload (Mirai)", "value": "02bb4ce727c98976bb48cfd1758aad82082738d689d8a170223bd46ec107b1bdc06f7b460f2120a695c68a029e153fba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764276052, "uuid": "af432248-2b8a-452a-966f-93bc7aaeb879", "value": "T13753392179396E1BC5C5B87F22F34725B1F2170A35A8CA2E7E720E4EFF2065026176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764276052, "uuid": "fcf24568-dcea-452f-88f6-9d66d7da9294", "value": "1536:tJbiS6MoU532L2t1g2kZesLoqmdQHnpS5sOwrPGPeQcht:tVLlULzpLofkE4GPeQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764276052, "uuid": "c5b258db-2a4f-43a1-abff-2dea2540a23a", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764276052, "uuid": "001eaf0b-9372-4aec-96df-6382af07b10e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764276052, "uuid": "d29f1011-241f-46a7-afcd-d502fbc241f5", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367b1cf9-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236902, "uuid": "b30ce41f-8c46-4285-b4b7-f01d7aaf43ce", "comment": "Malware payload (Mirai)", "value": "4c370cd0503be597ace4ea67de2bb6e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236902, "uuid": "8c0cd1f4-3359-4ae8-abc4-45257c50dd2f", "comment": "Malware payload (Mirai)", "value": "87a5b33c4561da5dc6b2e6a952a90c73add89aa54b94bd82b1feb82ef1102b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236902, "uuid": "913c52b2-8509-48ad-8a22-c6866fce286d", "comment": "Malware payload (Mirai)", "value": "15bde99a36a00864d7152f5593d2796a74a6324d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236902, "uuid": "dbcf1099-9e60-46bc-8a8f-b7211210328e", "comment": "Malware payload (Mirai)", "value": "639453b18cee792d7c22410533bf03ea62caa26b69bcff3012c1567148ebc6e47a4deefd77a2333b5652cd04d43465a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236902, "uuid": "492f3daa-54a5-436a-9ad8-67dc9db7cfcc", "value": "T144E3E70EAE358F7DFB99C23447B78E25965823C627D1C581D2ADE6011E6038F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236902, "uuid": "c56fbaa5-04aa-4afb-a9cc-b95a0d9f96cb", "value": "3072:jtRKxKYZt4wY6bludObqRSQ81QywJMQXb22rP/UXan1mKJ1x3C8pepHg/MjDhQi+:RRKxKYZt4wY6bludObqRSQ81QywJMQXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236902, "uuid": "9b32213c-db20-4c9c-95b8-29b3225f5fa2", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236902, "uuid": "430c1aa3-4952-4d0e-96e1-811bb10d433c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236902, "uuid": "172c279b-67dc-44c8-bb0e-c960f6b49d2d", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5b6e7d-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223702, "uuid": "8029b924-5eb5-4500-9fd4-24d9ee746600", "comment": "Malware payload (Mirai)", "value": "09c837f70311d5ac5583b48c53567d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223702, "uuid": "1ec3e78a-55cd-418d-bc8d-6908f32a0c8c", "comment": "Malware payload (Mirai)", "value": "88168401c1486cdd15c613acfe56e18d4cfbdb81712eb1060087883668920c5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223702, "uuid": "5baf4777-0d7e-401b-8456-27c25982871c", "comment": "Malware payload (Mirai)", "value": "0b2dd3d5dead009f4249e234c8a49d5c56983755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223702, "uuid": "7d7ab74a-5de1-48a6-aa39-8ffa17c9db6a", "comment": "Malware payload (Mirai)", "value": "cb0d3cbf31a2373e4025327e89ca91a23415767bd621bd437fab71acfcb7436099c3169e55547c4e2cdfdaa66c58be44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223702, "uuid": "4e3039cc-9993-4771-81ea-274399beff31", "value": "T1B553F891B8426A39C2D1577BEDAF548E3314A7D8D1DB3213C9244BA07BCA94F0C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223702, "uuid": "cd535fcd-4d0f-435e-824f-3dea71bf0e93", "value": "1536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223702, "uuid": "f2764245-d7df-4d2e-82f0-fddbe20c8b61", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223702, "uuid": "85151e8f-97ec-4e7f-8c21-19d5e4e5c874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223702, "uuid": "ae37a903-ae78-499b-bac1-5da3b8052ebd", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502731d5-cba8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764258420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258420, "uuid": "5a561d2d-b7f6-4652-97b4-eac6b817dd64", "comment": "Malware payload (Mirai)", "value": "02ca884aabc458269bf0e8cf5f79d843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258420, "uuid": "38f76ea2-67b5-4a6f-ab11-80656c59c8b7", "comment": "Malware payload (Mirai)", "value": "88524a1cf45708d2b3d2236149e325b8db71d2aeaa46e4fd3a199cf4051deddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258420, "uuid": "e3805bc3-e057-4bd2-bf44-11de070fdaa3", "comment": "Malware payload (Mirai)", "value": "12c9f25019b7a558292e7d3eddba9b6b8736cf5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258420, "uuid": "a41c49f5-3e3c-4bb5-ae07-5a1f0958b8c4", "comment": "Malware payload (Mirai)", "value": "c279f87623096f3602a48cd2a088ff256d1525fd238ffa3dbe49f053919d11408877c3d95887b6125ae7c745c2d5bc80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258420, "uuid": "6884e1f2-cf2e-42cd-88f9-1b4d1f13e6c8", "value": "T1D2D3930E2E314F7DF779C33587B74E21975963D622E0CA85E2ACE9011E6434E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258420, "uuid": "7cdc5bf5-8d83-40fb-8460-c5fc75b156c8", "value": "3072:VLYKZVA3fN3+a6t/8ChfCWib0lZIZzYflhFzL3l6xMx5r9/b710OhA1EnW4nf3oO:VLzZVe156BCsf43iaKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764258420, "uuid": "62b95071-48bd-4c48-81d4-58c4242138e5", "value": 138588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764258420, "uuid": "de854678-c83a-4fc4-b46a-59f3f6249a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258420, "uuid": "ef736da7-5a4f-454f-bc31-c9d965256e99", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f556a480-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764257409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257409, "uuid": "c6222991-3f73-4f69-a05d-3130d6a33c0d", "comment": "Malware payload (AgentTesla)", "value": "b7329e61c836275bd69df20703da0239", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257409, "uuid": "763c47a8-ef3c-4cfb-9eba-afe9044bd077", "comment": "Malware payload (AgentTesla)", "value": "89842c59fa10dcc0ada70e6208ff4d66bcc21a779d661fa656106af7c4506553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257409, "uuid": "899f7158-46ba-4bea-aab6-201e10e90d31", "comment": "Malware payload (AgentTesla)", "value": "9cf6b1aefe12fb316ac991d7176c59ef04f529e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257409, "uuid": "43961c0e-27bb-4788-9f93-21d3f0bca521", "comment": "Malware payload (AgentTesla)", "value": "873f87a2cbdc1071813cdcb87344279350e3b5ef9ef550fcead4991ead54c8dab70e7b5bbd5b32047445d5597860f795", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257409, "uuid": "738e21ca-3fcf-4612-b0aa-81b28d68f9b7", "value": "T174F4234135A2A551D7838A302979AB3FC7B5BF1931E011A72760319F7CB7A10AB5F2F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257409, "uuid": "2121c8d2-fb89-4080-aa78-298d30777420", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257409, "uuid": "41248e9d-9c42-41cf-800e-d8e575e5f7cc", "value": "12288:UH1UWFB9pFuz1D/PZHv47SWzBPAi1tnprNVg/WHU1y1yBbFZGPwqzz2xsXmNUR:61UoB9/u1HZA7SWdpxng9yEFRqfdWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257409, "uuid": "261527c5-81fa-406c-bc23-5bae560338db", "value": 733792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257409, "uuid": "7b1f642f-b9ae-4a7b-b707-6352e5adc8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257409, "uuid": "281982bb-5425-40e8-a0ee-3c1c80edaaac", "value": "rNoviembre_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2cd1a2-cba8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764258524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258524, "uuid": "aba7cf69-39a8-4bcb-b836-e1f360b5d27d", "comment": "Malware payload (Mirai)", "value": "3a0349d84451cda82dc3e5ac796c47ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258524, "uuid": "6b52cde5-23c3-4641-9d9e-c9f549ac6e13", "comment": "Malware payload (Mirai)", "value": "8a25d324db8c18a6c51bfca2ae38f8b34d58171ed856cb3db83bfff949e07b33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258524, "uuid": "3dcd0710-5d82-4ac0-a8c7-acb025b5be9a", "comment": "Malware payload (Mirai)", "value": "5db68491d99f8ffe0d27aab772c150ddb4bec4b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258524, "uuid": "ba07277e-713a-4fb3-9d42-1de2729697a0", "comment": "Malware payload (Mirai)", "value": "05a619c666eec0e785459d0e6ec41a5f01f93bb9f7867fa0268957c3fc8da7d9ee1f9ec7d4028c97a13017a3588a076f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258524, "uuid": "102cce60-67da-4e29-8d10-b7070150ed7f", "value": "T10A23F28FC1FE52E9E65E1037087DBFBB3414DC2C878DB16B1148149F7401F96596492B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258524, "uuid": "6349949d-2972-4835-852d-1a4f42f6795c", "value": "768:qZ+A1ENhFI6vR8IxA5w7l5LvpEQlK4dvZGKg16WTjoKjXUSXuvnbcuyD7UHQRj6:c+A1OR8IxbJ5Lv+aZwKg16WTjoKjkUuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764258524, "uuid": "830d0ba3-771c-4616-912d-1a7a044ade32", "value": 48420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764258524, "uuid": "f1c9162f-4bd3-477a-90b2-eaaf08cf7145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258524, "uuid": "64960559-a43f-48a6-985f-245e5eb62c2a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8f695b-cbce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764274841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764274841, "uuid": "b78d9ff6-8c1f-4122-b0a1-c4bcbe59187a", "comment": "Malware payload (Mirai)", "value": "4d14abe531f5660b6cacf17450960879", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764274841, "uuid": "6de1e23b-18d9-42bb-8d9b-f5bc386b8302", "comment": "Malware payload (Mirai)", "value": "8a5c191bd57641714622b1bec8157c79c2020904fa698df0ca7c8202b7a22de4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764274841, "uuid": "4577b1e0-32db-4458-84fd-d0696b6b42c7", "comment": "Malware payload (Mirai)", "value": "b36d718caaf1c1c0f01645251ce24d6f7498643c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764274841, "uuid": "4efc773d-6bb7-4057-a256-163eb0d820c1", "comment": "Malware payload (Mirai)", "value": "c3c8a52eadbb7ba2402ac33dd988f23f941ecb1be1f6d2d66af8b5d6a73cc5948fe49ecae3e272fa477cf2c0d0cf5191", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764274841, "uuid": "3b3f0da1-0349-4130-9025-a85a9d633e6c", "value": "T1E74185D409229B347CFE861B7A64885D7244F9FBB4D09D13E8DB68BD44CFF247054546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764274841, "uuid": "3aecd3e9-b155-4bf3-86ef-3fc405a3e189", "value": "48:iDfaDQMDYi3KnDD5oFDe8DB6DEkDOSDk0DewDjqDKl:iePynuFBUHfLJSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764274841, "uuid": "71a77feb-89bc-4518-bff7-da35b5794f4a", "value": 2416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764274841, "uuid": "9a8fda55-e2a6-41c7-9ace-0b8f248b7d58", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764274841, "uuid": "481d199e-9a9d-4c40-942f-65193a764da5", "value": "Mercury.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71b876b-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228528, "uuid": "1c9f6385-9814-43f9-a2c2-549be597bbdf", "comment": "Malware payload (Mirai)", "value": "636674c361f386ca99b2e6f0f1c7dfe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228528, "uuid": "99c1b8fe-2349-4505-a536-1d8224f1cdfb", "comment": "Malware payload (Mirai)", "value": "8cac54bc651e023650deec2d05080304f0828d30193f750979166eb8575787ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228528, "uuid": "a6047cba-008b-4a8a-b2b3-df64875c6653", "comment": "Malware payload (Mirai)", "value": "3c53109d8ecb44025ef3445117d05aa41dde5e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228528, "uuid": "b78ee042-5529-4856-a2df-dca5d1d7fc6d", "comment": "Malware payload (Mirai)", "value": "50a3b315646b2a58c9f9fa9199cb8fe6e27adb757ed11fa883e74fc56835fa8b4868929de66a821432c40fd10b0daa4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228528, "uuid": "4d3c42a8-abd5-4b74-be04-25c7e0b294d5", "value": "T1C2330A4798A19EF7D045BAB56AB75E24035BF9125F0F4E9A712CAEA0034F4CEB40F364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228528, "uuid": "c6490508-6e5e-4965-b1ee-ac73e904d4e6", "value": "1536:SesPQJoe/RNby+5ZoKXrl5PCc7Hl30E3Uw:Se/Jo+RN3oKXrl5PdHJFkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228528, "uuid": "6e57cc35-5ee7-453c-b784-a459f94b93b8", "value": 53802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228528, "uuid": "228e5ee2-f24f-442e-b015-1680f58fb809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228528, "uuid": "de991b1d-333e-42b8-92f3-36608c064c6c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1919fd-cba0-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1764255271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255271, "uuid": "781730e9-202f-4359-9f12-c86ad83264fe", "comment": "Malware payload (Meterpreter)", "value": "af12b8e2090ecd607e9afad5b9851556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255271, "uuid": "222507dd-a5ab-428c-be90-924dbec5f2bc", "comment": "Malware payload (Meterpreter)", "value": "8df12544c4595d66adbe72a5cdfd9fdd4aca09d2825509022b244cdb16f8449d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255271, "uuid": "b986b0d1-d82d-4732-b8fc-c9d0b87b94dc", "comment": "Malware payload (Meterpreter)", "value": "518be4a394b507925cf821eff5c9e7eaf75a5ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255271, "uuid": "f25c512a-8324-4253-8ed2-b8bd93388aaf", "comment": "Malware payload (Meterpreter)", "value": "dff7040c22a333b900773d8e50ca699021ac76af6303b869c70432b2609d63d92e2f935aa9a3014d8e4403564e00eab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255271, "uuid": "7d065495-2301-40c2-a620-be4f54eb5f07", "value": "T1F5F18683B62128A6F9790B7FC247EBDD65BCBB30B3521B494631054E78A28567821E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255271, "uuid": "8f39d37c-70a2-4cd1-b09f-bcd67081b923", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255271, "uuid": "a164cf13-7e46-46a3-b03c-842dc09863ab", "value": "24:eFGSG18lspFzknehtht6dp5/aY+mq9KMn2DOIRwSclFcabPDbuqiksvcLFp:iGSmQnehthEd3t+B9TCO1SUuanqqilk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764255271, "uuid": "a2c436fa-9c60-4cae-a1ac-6e640f9394d8", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764255271, "uuid": "35e1d0cb-495c-44e8-900f-50955e772867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255271, "uuid": "560ddeaa-94fc-4dfa-827b-20b28aa17b0e", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6468283-cb7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764240204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240204, "uuid": "8256ea1a-ac29-4985-b52a-82d32b7e0794", "comment": "Malware payload (Mirai)", "value": "59a4c335945795ad825c61f99e6ecdf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240204, "uuid": "273df06f-2ff8-4bea-8ef9-2b1140f34784", "comment": "Malware payload (Mirai)", "value": "8e6a0d59349add127f1f9ba6a775e8fa906e342e93399040e880b9db0ccd3193", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240204, "uuid": "177d09ff-9531-400d-bda6-759c1d57e2e6", "comment": "Malware payload (Mirai)", "value": "c377f978e1910f9311b75af0f0e326b0e75f7cf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240204, "uuid": "aa9b3c4c-52cb-41a6-b953-d0ba8644d8f9", "comment": "Malware payload (Mirai)", "value": "863290892992792c947005f26081224098f74cebaafa71c539ff92ce2bfbdd1a855e0bade1298999bddcbfbcd66b42b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240204, "uuid": "c3dae734-1dbc-4311-aff3-1712e396c668", "value": "T153F3BFA3B70F6491C47246F40BCB779D262321124E6B9BE76C6F723A5A335DE58023E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240204, "uuid": "f0fa67e8-6e32-4286-9711-a349b9aff947", "value": "3072:afQrxdiA46U1V4o7yN32rJ2quBqmzyjg/CBp3CwmJq:aKdVro+N3iJaomOyCBp3qJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764240204, "uuid": "6b7a3acd-f1ee-45d3-9236-94ee6eefc075", "value": 165508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764240204, "uuid": "420e54ea-4ac7-4620-9c76-99e94fee049f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240204, "uuid": "a8639550-4638-4b3d-8c21-9456978efb4d", "value": "executor.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648d8e17-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223665, "uuid": "6333c389-c775-4adc-9677-32ff92db003d", "comment": "Malware payload (Mirai)", "value": "1d2c04f077df6ba1f36c708d00a3f787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223665, "uuid": "9e43eeef-2393-4354-bdb5-873137bc828b", "comment": "Malware payload (Mirai)", "value": "8fbfdfbf8ab0417ed60b32ddd8d30e1ec6567afcbab362c8eb2ce03e8222fd6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223665, "uuid": "304a5841-18f9-4415-b2df-dc368d177b17", "comment": "Malware payload (Mirai)", "value": "8f6e06d5ec29adbb7534231c18962c644aa7064e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223665, "uuid": "babddd2f-432a-4c85-89eb-dbe0b9c100e9", "comment": "Malware payload (Mirai)", "value": "e890a69bf010f4fcc451bbfef0edf1daa2534e34d0362470cbb709f75cb8c6769acf86ff6fbb244c269c221456801e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223665, "uuid": "3df4aafb-af24-4b71-bb8b-34fa9ea027d7", "value": "T109533B99F4028E3DF88FE9B984160E05B93123D112931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223665, "uuid": "16b362f4-5789-4ae4-ab1d-2c3d99a85d50", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozjE7Pj:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223665, "uuid": "086262cb-aa8a-40f6-956e-0a7714b85061", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223665, "uuid": "c845f3a2-aef4-4b03-b87b-0c85c48ae69c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223665, "uuid": "048e2e78-1086-4fa2-97cb-c26f6aa80e8e", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936618e4-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234481, "uuid": "480164ba-2eb6-4c3d-97d2-80043af6966b", "comment": "Malware payload", "value": "ccb944bb0d59aff58b4137af566bdf87", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234481, "uuid": "66d8b7d9-0187-4be5-bf57-830dea5c8662", "comment": "Malware payload", "value": "90676ad3a1a23d832f9d532f688d4b2d2dd366d5fd0fdab7b6f85fec764a542e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234481, "uuid": "105076a5-6db5-41cc-b712-3e0e4f06c7c7", "comment": "Malware payload", "value": "8b3d06adaec17f4823f1bbd61db8d2447af602bd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234481, "uuid": "cb215b9c-3ba8-493d-a706-3fda95488654", "comment": "Malware payload", "value": "8bf43f1cc2e5c3feff5f20c6767c2637e376e4944a8506c48794979e9b27316ef256a61418dd4bdd5d442fe12dc3b30d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234481, "uuid": "b2ab8da2-0020-475b-89ef-c88514a7ae67", "value": "T1E9B6A664E6A14E7EDF2759FC908E94EE668FCEE342C9012727F176C589302A4480FD6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234481, "uuid": "2931b4fa-8aee-4f88-935b-1bc083857c41", "value": "98304:WgqUfmyXGDPE2AvxIOddN1yrWdGIwBEBZrnfrQVCbz2iEwlo/Kr8n7:WgJoPE2+xI+v14WAxmHYQHq97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234481, "uuid": "4b926733-b476-41ca-8fcc-1aad578069ee", "value": 11283692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234481, "uuid": "5135743a-6e5b-4665-b6ba-7ce1fee6bc96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234481, "uuid": "7c81a48f-6b7a-46a2-863f-28fca11382aa", "value": "vamino.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dc9eed-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236869, "uuid": "aea0972e-2032-4ed2-96d7-7d89cdac98bf", "comment": "Malware payload (Mirai)", "value": "8a9242e6f3a7bcd0654106ec03274f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236869, "uuid": "3e86fc4e-c70c-4ea1-bb5d-e4a38e2a6f33", "comment": "Malware payload (Mirai)", "value": "91314409f98a8c03bc86ab0aefb2d2d09c769d2623218a6b5414f6b4bed4212e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236869, "uuid": "c17abb95-4c7d-4131-b107-749a012f5fd7", "comment": "Malware payload (Mirai)", "value": "88acdaa979e47481472e68fc39bb84c744c6e246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236869, "uuid": "7d06dfa3-50a0-40e1-9b82-dd53fe727b86", "comment": "Malware payload (Mirai)", "value": "bb3090175bee9c923f28d97e1ecf6f8b5ad9f90eedfc1c184f99a89c952dd21114ded7c5f9f117c01503ec5c247ae1cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236869, "uuid": "c22baa9c-b90d-495c-a6a9-4a67ade255b7", "value": "T18C630231756669B067B01C3B7CFE8291FC9FC174C16A9AB252235C7D314AB4344BBA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236869, "uuid": "36c0c4d0-cd2c-465d-9161-688641a4fb5e", "value": "1536:6YWnPpMi9HTxtbf/+BVxLMXtrNgyqZPXgHrsYLJ6qxXXDvNdI9AEqRV1:6YWBMUTvbe1MXtrmyqZo/LJ6qxxdI9A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236869, "uuid": "58ee8c14-0d27-4fa2-8f41-12c06ca0a4e5", "value": 73248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236869, "uuid": "b42562ce-bd15-4444-b17e-b19e46256e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236869, "uuid": "90feac57-51ca-49ee-a409-0bb88ce7b0c3", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afce798e-cb79-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764238394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238394, "uuid": "b3039a76-9cce-4509-8264-85a05ac437ba", "comment": "Malware payload (Mirai)", "value": "982fd2e0abb688a7dada515fa3ed8243", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238394, "uuid": "ebc0e0cd-a725-4d29-973e-ce70865e23d5", "comment": "Malware payload (Mirai)", "value": "91f1ef333e0672e786bd01aa96ea81af1746633cad05230501922d33f202bc9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238394, "uuid": "d435a1c5-5f95-4d38-a5d9-29f877170dc7", "comment": "Malware payload (Mirai)", "value": "5fa797afcab94f48c01e8a2face2dec56ff0bad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238394, "uuid": "87038514-8426-49fa-972c-233a8c616684", "comment": "Malware payload (Mirai)", "value": "3afbf4a9c3a07df62455fe51f6ef41e7cd267bd68b558b10fcda9b673aaebbf11777cc77fb15e57a84a0da477495eb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238394, "uuid": "1ceed4f3-7bc5-4b88-83b5-60c95166ae76", "value": "T18D0429CBF800DDBEF80AE6364C531906B130B7B254925B377257796BAD3A0E50827F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238394, "uuid": "aef0afa6-3a04-4af7-97c2-15983b7f6780", "value": "3072:RCcmPYwVQcpLvVha3b+3/ezt7rd3seQsuEBL3aVNjbi5LBHFwyfiSrV9ql:1mPTVLB2zt7x3b/L3xLBiyfzh9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764238394, "uuid": "80016c74-94b8-4b1f-8888-717986cb3442", "value": 188224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764238394, "uuid": "16e908f6-9dba-47ce-b73b-33279eae42f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238394, "uuid": "063ada7b-064d-497c-8d62-16ba280945cf", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc666d9-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241746, "uuid": "0b91bd15-443c-432d-890d-a53192f3a782", "comment": "Malware payload (Mirai)", "value": "103d738651fc7fed6fbecb771af8de72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241746, "uuid": "930d0c49-46cb-4673-9cbe-4500a641c87a", "comment": "Malware payload (Mirai)", "value": "92df02db90d873cc50f7dd9726670f130628b2de157cb6af2cf049e8ec11488d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241746, "uuid": "95a09275-359f-4b22-8d19-c3f69e67c6b3", "comment": "Malware payload (Mirai)", "value": "1b1bd068a52a8343cb50e8d352c447a61fab146f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241746, "uuid": "bdba998d-bc88-4adb-883d-1ad578b4d780", "comment": "Malware payload (Mirai)", "value": "b29a1a1f7381379e9efbc4561d2510357af251d7b45100354095f747bc12e5650e3e41a22de7703891bc2a700c53eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241746, "uuid": "ee8b900b-67c6-4492-95b2-629de1891ed3", "value": "T10BE2F0116A16847DEB308471E4F6858677791FBCB9FEB0A650A2034D9CC394293E2ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241746, "uuid": "613827ed-47d3-473b-b569-392e10fb93e8", "value": "768:wEKkUgXAnURCr6HmDFStmYtMpM9q3UELdL:IkEn7uHEemfVLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241746, "uuid": "cb0a623e-d680-41f2-bbc3-4f3eb4eed170", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241746, "uuid": "4b7210b1-6f3d-4a20-b0f1-87c00bfb1511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241746, "uuid": "e7f62255-d081-47d2-9def-5122bacaa3c4", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cd1141-cb25-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764202134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202134, "uuid": "05424446-6079-4329-9ae5-b812e7dea6e3", "comment": "Malware payload (Mirai)", "value": "24501ae170f65eefe50d1661baf326d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202134, "uuid": "52a02790-7267-400d-b3ba-803b1346541a", "comment": "Malware payload (Mirai)", "value": "93758fd869e2a4529e2db4768eb1c9bb94b972e6ee9656b1fe80e23c53ff6e84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202134, "uuid": "591ec3b9-3c2c-4fbe-8d65-46efb0db5143", "comment": "Malware payload (Mirai)", "value": "a7111d56a1054df2bcbc3a44428df87031707986", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202134, "uuid": "4b94e637-7aca-41b6-83d0-f27c7141f851", "comment": "Malware payload (Mirai)", "value": "30ff6ec7135937145975f7b5f90add1a512029751bea3ba2e49beb66ec63f1532ea243f81fa0470cc035e9b1cc876bf6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202134, "uuid": "c214d9ad-4876-48e6-b277-6ab6fc2386ab", "value": "T10D01266ED1E89A500AF5C1C6F2B88108C4915083A1F56BD2F38E49336F29DCE7C9320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202134, "uuid": "ff9f25fc-a9cd-4e9e-bd94-15ca688a4330", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+mkC05HkC0BK/PFyGZhG+E6:FH8j/wWi2jzRT2To/PFyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764202134, "uuid": "aad688cc-bceb-4dc2-bd84-1952f9a91302", "value": 718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764202134, "uuid": "b4f9cb14-d538-429f-9229-b71a1a521729", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202134, "uuid": "6eb43073-a0ee-4988-a21e-5bfdc5300541", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b05c879-cb4b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764218549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218549, "uuid": "607a4629-65df-4a96-8078-a09c9b9a386d", "comment": "Malware payload (Mirai)", "value": "a5d8377e8d867e71a7ea5c6589ae88ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218549, "uuid": "c23338d6-0d21-45df-90b3-6c02083cdb86", "comment": "Malware payload (Mirai)", "value": "937e181035e5fc5fd64ae6fa4e22acc681f70d512e23deb77b262f40e180769a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218549, "uuid": "274e17d4-1f38-4a43-a482-d3e4f6a1ea22", "comment": "Malware payload (Mirai)", "value": "84bb1c7343608b3c79efbad4a79842af526c39d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764218549, "uuid": "ec2b796e-b182-4ab1-a41a-63c44bb387f6", "comment": "Malware payload (Mirai)", "value": "28b7e1e90ed495f50f7b7d62274fcd371215dbd90e48504da3fb60de6db3daabf6bdf9bf5500bc23f0b4bf88661181d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218549, "uuid": "1cb3a796-b317-4802-8f2f-3b097b12bd0b", "value": "T1F0531986BC91DA17C6D462BBFA1E41CD332623A8D2DF7203DD116F157B8A82F0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218549, "uuid": "886760f4-2fd3-4997-8940-396f4fb13d38", "value": "1536:mU/E9Up6Ldm2vZatfib/GdRcSUY9P+Cxtug7Rv:mU/ECRiix9vxtugN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764218549, "uuid": "fbe9fe32-807b-41a4-9f59-028b93cc6450", "value": 62332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764218549, "uuid": "e900485e-523d-43d1-a96d-79ef2154fd1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764218549, "uuid": "df16216a-2da8-4e9d-8373-6313a13512db", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f36c01-cb91-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764248637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248637, "uuid": "455b32f6-d387-404e-9d59-170f7b40c5fa", "comment": "Malware payload (Formbook)", "value": "16dd1c1e6afc87d0f7e7cee89876b77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248637, "uuid": "bd4678ef-b76c-4113-8a46-0c6e561af9a2", "comment": "Malware payload (Formbook)", "value": "93d8f58337eb1309d7fadafe6707dde3a7d20d65870d05a689b3c2f264e61193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248637, "uuid": "bd11f128-1f82-4baf-90cd-e10b9bb48074", "comment": "Malware payload (Formbook)", "value": "a9cbc2c92acc50f5d7535d8646dd8a2cf939cbd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248637, "uuid": "88ac3411-117a-4ae4-88c3-414f7ba0369a", "comment": "Malware payload (Formbook)", "value": "045d14192a0e605decb853d9b747c07dd261c4c07e33a101634f9450cfcb25acec855b41665649cbd2091768c875b37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248637, "uuid": "32cbade5-626f-4054-bcb5-a34ac19a77fd", "value": "T106E412942B69CB33E87A2BF62975D23143B62D5EB072C7468EDAECDB3121B144D10793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248637, "uuid": "713eeeb7-e6ba-43d9-a5ba-de386267709a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248637, "uuid": "b43abef6-6c1c-4514-a8cf-41cee343e35e", "value": "12288:bLUR7YlGxovyt17G4k7jMHNQtjaAVgBJyrXcN5ZStM8lLzPe4vkMkhigXSCkip:k1YluHvkUQtjaAuBzdhKvGcGb/vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764248637, "uuid": "1da10605-804e-4015-8100-b160f272cc6c", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764248637, "uuid": "fe8ea1fb-8a25-45f3-85eb-fad91d27beed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248637, "uuid": "daf1b1be-6ecb-4388-8a73-96dbf9254d42", "value": "SecuriteInfo.com.Trojan.Inject6.17597.17574.4705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27b3261-cb78-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764237996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237996, "uuid": "3e1a1d38-a4fe-4e05-ae4b-180f1db1afc6", "comment": "Malware payload (Mirai)", "value": "7c928892d450c0af6f6dcf95d28593c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237996, "uuid": "64dbfb1d-be8d-40ec-ac1a-ecc5e308acfc", "comment": "Malware payload (Mirai)", "value": "9494266fa912fb612c847185bbc492ddefe6371daa5ce0d0393bafdca6cab1dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237996, "uuid": "2e09fd38-fde5-4ee4-9c53-6c7ed52bc3e6", "comment": "Malware payload (Mirai)", "value": "e6e7da81d859c6324ddea634e645175e9789196c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237996, "uuid": "5b5e6e69-f067-4ec5-82a2-881258a4febb", "comment": "Malware payload (Mirai)", "value": "2b28a9a8649f1cc706b243a42f1e0f3fc9bc0868a377c703fcc3b3b1ca1f10f066a4237cd7e61854a4baf3a79a4d3178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237996, "uuid": "299314c9-48e3-49d8-b1e5-587f07e61a43", "value": "T17D935C02B31C0A43D1736DB03F3F27C5D7DAAA9112B4B684245FBB49D1B6A325286E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237996, "uuid": "78e31768-2e8b-4e42-8914-6055314c7942", "value": "1536:v+WxFLsaBcru9mat80eIhxy5DR0psa3I+O2yPn/LoXgRgemgmt:DFIBFa0Ihxy568+Fyb/mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237996, "uuid": "623d9ea9-4473-489c-bc58-999ea73ea873", "value": 92468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237996, "uuid": "2734e03f-10a0-4c15-9a29-935c3c948967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237996, "uuid": "1f6f3ad3-241e-46ef-9c9e-d6bf0c916e1e", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f899c76-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234475, "uuid": "e2eba8c1-6e29-48ff-9462-751bb9e0e4ed", "comment": "Malware payload", "value": "b4c3983a720400214202cb02894c9a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234475, "uuid": "b4d0ead8-60b9-4448-aa22-118cabe8447f", "comment": "Malware payload", "value": "94fce15fea718b9f26548557f9a625e2ecc32949ee08f7075d63b9780d65246f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234475, "uuid": "b89e9d32-efe2-42e0-9853-fe6c208ee9a8", "comment": "Malware payload", "value": "0ed3654043ff05717cfd64de2e48276b1d5c8b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234475, "uuid": "58d7ba54-0e63-48fd-98f2-2bde95eb48ff", "comment": "Malware payload", "value": "775e852717a70fdf6c446ad743e4326b01bad572157ccddb86d34a3965ffaf36e3b92a5a1a6c8abdc80cbcd621fafe56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234475, "uuid": "16d4e049-1139-4fc7-b673-97458e4773b0", "value": "T15AA429116BE85254E176C23C2397A727F27B3C499269B5BBC88CCB0F235470A729E717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234475, "uuid": "3ff88095-5db9-49dc-940f-7eb2d5fcfaca", "value": "4349837abc4a634673eb276c4e225e93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234475, "uuid": "e4168cac-ce40-48f8-80c1-0d7e62375cb1", "value": "12288:YKoZRReMKVYoGOAUuG2n0R6Wne7Xllalte:YZyqnmXnexGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234475, "uuid": "4cc97d49-4a26-44c1-a0f1-9baba966703d", "value": 464592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234475, "uuid": "2db04e7a-ce92-47d4-8ddc-766045da9b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234475, "uuid": "d18cc644-356a-4dc3-b525-3f09f57aeb6e", "value": "setupV3.58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2846e517-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236879, "uuid": "5df8e77e-7738-46f7-9690-540c99dc7fba", "comment": "Malware payload (Mirai)", "value": "203a55ed4a66b8fdbbdd840c8d432339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236879, "uuid": "c9f23154-5e38-4335-b207-83d31a512ddd", "comment": "Malware payload (Mirai)", "value": "95983a3d1b34fdfeb7324de8a5bc22b1adc1481a0534c6d1672c48cab7f824eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236879, "uuid": "8aae224b-55eb-47c9-8b7f-8da6768e95f9", "comment": "Malware payload (Mirai)", "value": "3c810aad95d585ac57f24392b0265b03e73d86e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236879, "uuid": "aa7f01aa-36fc-416f-ba55-be39c4c08d2e", "comment": "Malware payload (Mirai)", "value": "05505efc994829fe4218cf6b4fd6182c12c6ff0a7d8ea06c8503784d59da0e23e5be8adb3fd0caea3b5e2deee1600107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236879, "uuid": "69868f80-1587-495f-9883-daef4aaa75d6", "value": "T10E23F14240A9C2A4E523A5F3380BF6D8ED797A67411E5E3B2C9F732B0C5DDA06618724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236879, "uuid": "480b3a0a-1e39-4f84-b3a5-13339178c5b1", "value": "768:NtB548w628WWpbLcWgmTigHkxre0NYLLbN4qTEuxzMgfu74plzbiAslx05m:vBw62YcWWxre0NYfbN4qzXLzbiAsAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236879, "uuid": "07e0644c-486d-48db-b018-337b690b1bfb", "value": 47932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236879, "uuid": "79c5cf36-0598-425d-be68-2186bb77c784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236879, "uuid": "d350a9d6-048f-4d35-be25-765b154eb3c4", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a3764e-cbcf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764275421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764275421, "uuid": "81dd18e2-9f49-4630-9ab0-6444972ccb53", "comment": "Malware payload", "value": "9bdfcf8f49c459ddf47e67b3d4ab64ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764275421, "uuid": "b68a281d-7f5a-4ce0-8eb8-88d023228855", "comment": "Malware payload", "value": "96d782b2567f2f9147b05a14b6ea630623f52f057eae6a643ea5b0a503d92f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764275421, "uuid": "5d026439-66b7-435d-8ebc-cbbcf890fcc4", "comment": "Malware payload", "value": "551b105e625986f97d217f43bf98fb18bbf79a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764275421, "uuid": "1fcce4bd-8c0e-4497-9bda-ae3922c30e82", "comment": "Malware payload", "value": "3d627d3fbc6768a6d25bcfd40c3d8dc5f17164ad977237f0e27af9e4bb5dd19e22cba40f66007f98f8107f39e4899185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764275421, "uuid": "9c85e403-fa63-4780-849c-d06303256fbf", "value": "T11714AF03B181C475E4F324B689F55A6C892DBA105711A9DF73C81ABE8F325E0BA31DD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764275421, "uuid": "dd0ecf93-e602-485a-a13e-a9518a9e0307", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764275421, "uuid": "b4857d59-9990-44a4-975b-221119a6f0f7", "value": "3072:bLgtmCmy7qvo1OSDlbpwRSd3IGI7awTaRHn/MwjJxFT8+eAYebiUtG:Ytzmg1jDkm8TaRH0wjbFuSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764275421, "uuid": "89a82ec1-76a8-4d44-970a-64c934bbb4da", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764275421, "uuid": "bb66d744-42fa-4f1d-8f0e-1bfd840ae9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764275421, "uuid": "c69aacff-8471-4552-a509-72088bdf60e7", "value": "291ty7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48afcbe8-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272581, "uuid": "29e3ba15-fcea-46b6-b49d-333c3d3d343c", "comment": "Malware payload", "value": "86925f7a40d854847d54f7c1689975bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272581, "uuid": "62e5679e-2a25-4f99-9d4f-55bcc46f191b", "comment": "Malware payload", "value": "98153ac06f5570ee6b94ed63c0eecda41b54e6e36a3a9f33ab466e5b2d421a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272581, "uuid": "192473a7-567d-451f-a8dd-d3beb172e624", "comment": "Malware payload", "value": "74cd4b95605cf1208b9da65ec36d32d9c4df164b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272581, "uuid": "e9557f2d-b9ef-4294-8bbf-97e5d3d3bd6e", "comment": "Malware payload", "value": "3748cc8d311e370fd8a906cd8c08dde1c3024d291369006b89f87a9e03717c18acf75ebcd761ce54adde3f551775e304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272581, "uuid": "18dc3bdd-32a1-4da7-a6f6-97a8ff848008", "value": "T160D623952A9881E4C0B6CA38C5F54163F2773C416FB5EEDF19696A1E3D3B6E04E38321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272581, "uuid": "764bce27-d5c9-4cf2-8d9d-061153359345", "value": "86b68f0acc7701b549ae2015f28af696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272581, "uuid": "6d1bebb3-e0dc-4b27-a384-4c6806212822", "value": "393216:dWsVkN/0VHpVoANEruZBqz8zL0uNKhmkaIKsf:dWNOHpVhNkE0z8zAgmjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272581, "uuid": "4fb1beb3-b159-4c94-a167-3d080e4c9530", "value": 13097928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272581, "uuid": "0c4a1688-0f4a-4b7f-8973-6cbcb40e99bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272581, "uuid": "9fbbdbb1-d78a-4b2e-aa58-7bd41359b754", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "548a3590-cbbd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764267447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267447, "uuid": "de9e25e9-2531-4488-81e3-830b9afd282e", "comment": "Malware payload", "value": "bbda92ef7267ef2a2a4320749389c35c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267447, "uuid": "57a10f72-1907-47e4-921e-baa61094b2f7", "comment": "Malware payload", "value": "99ad6f8bab362c41c7b118842255ffd2f6ab95e046230f6c1a0e4e4d6d82d076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267447, "uuid": "27e16277-68cb-4ae7-a87a-65b9ee4dacbb", "comment": "Malware payload", "value": "91cd37798e7aaca02155fb73fd140eca64f1edff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267447, "uuid": "9ab5d475-f471-45bb-9980-dc72ade745ab", "comment": "Malware payload", "value": "336810a6454e8a5a174d1f6b9e90fb41101d227967fdb8e13ec052a2fc6588bf586f834e37a9e14fc62bf6c013850b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267447, "uuid": "2009cc16-fce7-477b-8d21-5432f9622ab5", "value": "T1C4F5332E58F56ACD14D1F42EBB4323D5F470C81E8EB6282D50AFF46589B3A6943807E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267447, "uuid": "6ec37715-f08c-4a26-a4d8-bedfaf4a30ab", "value": "98304:bXHbaVYJo5n8uZ0e1ErADECHBp1rWYnZOR:bXHbboz2rAICEq0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267447, "uuid": "2746238e-c9ca-4abf-8de0-0673f2725917", "value": 3347776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267447, "uuid": "b4661e26-b1eb-4d88-aed9-5f1927001c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267447, "uuid": "033f9c51-60e2-4b9e-a297-009382307128", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f98e95-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272624, "uuid": "7456cc29-5f76-4b87-92c6-8d8f2509f1a8", "comment": "Malware payload", "value": "42a479fce79c7eb0db9873ab207677ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272624, "uuid": "cbcdc630-49ff-44ca-a927-3411f61dc062", "comment": "Malware payload", "value": "9a73a9db5f6f7bc72b7ae57510d441374314df98a7cc7ede3dd476304dc9d9d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272624, "uuid": "8be6bc35-fea8-45f8-91b0-e9123d127eef", "comment": "Malware payload", "value": "202f606ff65d2d04eaca028265119be9f960682c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272624, "uuid": "eec97438-ac77-43ed-9c68-8037ddef3c0e", "comment": "Malware payload", "value": "4e46389390462efde9cdc46eabf3539a5704f44e1260acb456ffb059b74b0297f11a0b303be3a5d02a5ab1697a74b7b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272624, "uuid": "09ff5088-c1a5-4100-9e8f-fe2438d7338f", "value": "T1590733F0B3942BC0EA3B7DFD930154C59700F5DB7E2461397A2EF4CD7A2A265183668A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272624, "uuid": "ad052cf7-0586-4b11-8b97-03c153c7242d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272624, "uuid": "e53c9776-ab73-4749-a584-bf331594fd10", "value": "393216:toefxQm6gfqvU63VpE7Bj4Q8QGpBZ2ENlDtJtj7ElpaNjpRGTK1Ydm:tTq4fqvT7YQB0sDtQlpatpRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272624, "uuid": "1401e0d9-ea31-4c8d-a196-9783403cbf1e", "value": 17865216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272624, "uuid": "e6bfad4e-976c-4290-bb2a-d724ec79cff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272624, "uuid": "ff37116d-cc2d-487f-a36a-957dcf48441d", "value": "Installer_v3144_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf9ec45-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234442, "uuid": "c3d511b5-861b-4a1a-ae4f-8f161108c0d6", "comment": "Malware payload", "value": "1bc15acd341f09d3b07d83e497eb6df3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234442, "uuid": "bbf3ef2e-1eb9-4759-b79f-ed9848628025", "comment": "Malware payload", "value": "9b84104fa889a7279eb07bcf5952b5054d8502f7fba2f09bf2f8211bec84ff90", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234442, "uuid": "c65e3a20-9144-4b17-bafb-409678f4a38d", "comment": "Malware payload", "value": "61f038ac6961cdd97cbd69116b9abd05db7963a4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234442, "uuid": "0b72ba89-df26-4d29-be75-5e50ad5b9bb0", "comment": "Malware payload", "value": "64dc3b4c82b711779078c49ad4c9eff51716f5eabbc93149a4d59a8e4b95e3b42313c4f7612fe51e9a2f6562d5325bfa", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234442, "uuid": "c2d9cc41-27a2-4c9e-995f-aad0cd096e98", "value": "T13B1623CBE779853BE8B749324A9F823127754D484252A70726C8B73C2E737994F89BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234442, "uuid": "96ac5d1f-6dfd-4abc-822a-8b0cb009fc23", "value": "98304:shPffitVqHgCvpld2evfHReph2IlNW8IzwVB/BifHNu+4ES+iF:QCtVqHgYld2y/E2QnCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234442, "uuid": "235d6e83-9fad-48f1-9a2d-ff9e925d5032", "value": 4287553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234442, "uuid": "a3f408d8-d011-445a-bdf7-f75ffeb8cc9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234442, "uuid": "3a15e6e4-3556-419e-a7c6-0debcdedd9f7", "value": "H5B5F9793_1124174815.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c78d53-cba6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257428, "uuid": "c0b75335-f4f5-4417-a379-205661186455", "comment": "Malware payload (Mirai)", "value": "5faa159f89d62893897c6cdab4cd4a46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257428, "uuid": "ba2e03d7-4af7-4b0e-b2c7-47b7a51925c0", "comment": "Malware payload (Mirai)", "value": "9c98bba695f8e13c2e90aa718c7b7491dc923371b71791864b1630416c67a46a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257428, "uuid": "656d2908-fa2a-4045-a269-3d23973f9f68", "comment": "Malware payload (Mirai)", "value": "1a111248202bf762598c8d198f22db64ec32315a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257428, "uuid": "931312d9-dd14-49a6-96cd-ee54eb19b1fc", "comment": "Malware payload (Mirai)", "value": "dd098660db7d8e1676887645bfd27a2d6bad475188dea5de2f60c38bcea9b5162c213b2c69c4a00c9dde9856ea4640ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257428, "uuid": "b50ceeca-8522-4613-ae93-978a4270cc0b", "value": "T171144A46EA414B13C0D7137AB6AF424A333297A493DB73069D286FB43BC379E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257428, "uuid": "11b44743-583b-4ca7-8b7c-ac618182028d", "value": "6144:9MygR/fQdiY2xN4aTBMvlZe5cgCHMh4m3r5M/9pTKF:9MBR/fQA1xN4aTBMvlZe5XaxMu/vTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257428, "uuid": "90f6b953-7266-4b1e-89a2-d124dcdfd912", "value": 201506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257428, "uuid": "a917ff85-071d-49b1-9d65-cdd9c9420a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257428, "uuid": "4e33788e-e9bc-4eb8-b2bb-14e599497a8a", "value": "SecuriteInfo.com.Linux.Siggen.9999.12451.16239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0b24f5-cb4d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764219571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764219571, "uuid": "7aab45ce-809c-4dcc-9f95-e7702abb8b2c", "comment": "Malware payload (Mirai)", "value": "291866581cda16ab902c3bd2061a62a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764219571, "uuid": "b328ebb5-0361-44b7-9a6a-25b2ae4642f8", "comment": "Malware payload (Mirai)", "value": "9d2114d6b3020c832e3bc454b5bec276eaab1f17b4939f34459c54716311a602", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764219571, "uuid": "20fdb91d-fa22-46bb-b9e1-0a24fc8fbf7a", "comment": "Malware payload (Mirai)", "value": "fb5037aaece7059342f731f8a8eac7f585181ea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764219571, "uuid": "566c4225-d991-420f-95a6-2c1e51a4dae5", "comment": "Malware payload (Mirai)", "value": "2200278e1f52460a3e5fff33b31dd605872ed4c1c629c81b418bafacf5db5db7d6cddc0335e7b00fbc737e776682c72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764219571, "uuid": "b6eceeef-29c4-4bfd-962b-8dd3fb686eb2", "value": "T12C732813B981C9FCC48AC170476FB23AE923F17D022DB2EB7BD4EB126949D685E1D149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764219571, "uuid": "871f4a5e-b945-4bb7-8222-0dff68eb5428", "value": "1536:/zzPDV4pghDnyvesfc9aMyXtKYnvG/TrYfGbECSR3003Yhu4BzVZBNk:TV4puDyvNf2zitK2WOGb2R3d3Yhu2Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764219571, "uuid": "f8b19c60-2d83-40d5-b2d8-90ab56e44806", "value": 79424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764219571, "uuid": "dcadfd51-186e-4173-b574-9f6bbcadb8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764219571, "uuid": "69997fd6-2341-494d-836f-aa92d6304f3a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff92248-cbbe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764267869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267869, "uuid": "f82b2d6a-a77e-47f4-8708-67609780d3f8", "comment": "Malware payload (Mirai)", "value": "b73199d4dcd8fcdb8a310a2cb1efe739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267869, "uuid": "18f09edb-ec52-459a-b837-501f6914ec3b", "comment": "Malware payload (Mirai)", "value": "9eb0df432b5d759cc4ced9d8cc8fb9b109bc77b97085ab7d9f144a2dd3a6fddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267869, "uuid": "12babbf3-5b6f-43de-8206-6bd6b4f3ce9d", "comment": "Malware payload (Mirai)", "value": "646f4f8bea645dbb0cdad9bf40d437abc346b00a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267869, "uuid": "e2e651d2-a805-4c23-a225-0cf72cd4502b", "comment": "Malware payload (Mirai)", "value": "69d84e712d04fab06f5c237dbd040afaf11b3b07f10065fe82d68832710bc3310e03fbfdb9fba51d2aa34683f34bb281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267869, "uuid": "913692ee-7d7f-483d-9e98-4050447b8361", "value": "T1480633B1F11869797329D63E754F4082DB256A3605CF9AF01CCCB2A28F7D69B331252E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267869, "uuid": "c83329a6-fc37-4cb7-b2a9-cef05d2ccd3e", "value": "98304:ir3l/Wy9HOHJROSeqohngN1ca3j2A1Bl4M5aRcE:i7lP9HaOSepngPc0//EcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267869, "uuid": "033eb45e-b498-4861-aacc-9c4c0b2d5035", "value": 3682556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267869, "uuid": "7ef89b52-05a7-44bd-8b50-79ae611f98f7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267869, "uuid": "b3fa0518-1aa1-4d00-9ec5-54665c769270", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07c55ab-cb26-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764202855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202855, "uuid": "71a48c0e-ab85-40f2-bb65-7bd476a6fa54", "comment": "Malware payload (Mirai)", "value": "d18f1669c87a28ef56495a620bd6bcfb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202855, "uuid": "bb1d0da3-6c53-4ee3-a29f-6c8664d87174", "comment": "Malware payload (Mirai)", "value": "9f20c60560560d263d3487e6a18c99ba1a7740dcc81130133a5e14829e4c00a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202855, "uuid": "36b18a55-dd0f-465f-892c-3e6bb7b0d4a3", "comment": "Malware payload (Mirai)", "value": "2f36c75f5137123764a9018368110ba24273e5f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202855, "uuid": "fa529135-06ec-4163-ab15-d3d5184d3f4c", "comment": "Malware payload (Mirai)", "value": "06b778e8b645f907fd323bbdc226b00d2e83fb2cca91e649afcba6014869ebc626a95c09bdc6294e34c4805a54f261ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202855, "uuid": "2befead5-dc24-4506-94cb-0a4675f82216", "value": "T1E9434C96A404DD3CFD4FEABF88264E01F625B31156930F27A3A9FDE36C720944D5B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202855, "uuid": "b67ce180-55ef-4772-8480-3a72b00720a6", "value": "1536:zqyLZQSpvZcWYgTgUg3vKmtc6gSp1F2wrn7a8MJyPt:zqyLZ/cWYgTgUg3vDtn3pxr7o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764202855, "uuid": "92bf3f71-5d4b-47a9-83e0-f784001ce511", "value": 60632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764202855, "uuid": "f245fabf-0918-4435-b90c-f26ed26b589a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202855, "uuid": "cb4803ab-250a-4b16-83a9-b8365d1cd8e9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caea3553-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272800, "uuid": "72fc56d4-92f6-448d-95b8-0c41f2275d40", "comment": "Malware payload", "value": "b6e0c33268e6573df5ee4338bb8c0a25", "object_relation": "md5", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8458", "colour": "#545ECC", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272800, "uuid": "d886d053-a091-4b77-9df9-43fd609a3f47", "comment": "Malware payload", "value": "9fc704522d9d0950e73223c7f13645a37d247259fb2f12ddd77683575c6b12c5", "object_relation": "sha256", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8458", "colour": "#545ECC", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272800, "uuid": "469b6578-e636-4583-b776-00c7995a0589", "comment": "Malware payload", "value": "fd4b788c49a31c6d9f81f8517ec3781fc0afb804", "object_relation": "sha1", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8458", "colour": "#545ECC", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272800, "uuid": "d0a5d2f0-85a1-449f-a020-36f58f8107be", "comment": "Malware payload", "value": "c8327df0e77e03075f8353ba944291654634b009a85bdb0eef8c9335ad28e004588be021da5585f71b3a248b84c8bcaa", "object_relation": "sha3-384", "Tag": [ { "name": "45-149-154-97", "colour": "#E9A6B7", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8458", "colour": "#545ECC", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272800, "uuid": "74170351-2400-426a-876e-80f5a981f8bf", "value": "T198E633C92A08753C6C4DC4A415580E3AD1DB21DE4B2F469FEAB26B3D50C18FD3B5A93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272800, "uuid": "bb81686a-2d20-4fb4-8b61-19768623d196", "value": "393216:wY0tiN+UarYHSpyhtxZEqyxk3q2y1+Tf314TU4UvmAY:6tvNUSUTIxKTf3OTUvvmAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272800, "uuid": "20275b27-5b96-4336-80be-4bd9cbb9a9da", "value": 14863683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272800, "uuid": "914c01c2-81ae-4da2-8f57-e0774c86177e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272800, "uuid": "74e2872a-b19b-4c8b-aa29-feb5bdee3db7", "value": "download autodesk fusion 360 full crack.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9122fd03-cbca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764273132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273132, "uuid": "27ba3a3b-af6c-484c-947e-91eba7bce2c7", "comment": "Malware payload", "value": "2feb789d155e7abc063e032f277671ad", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273132, "uuid": "4f012f6a-5f97-4928-a8fe-405bbafa6625", "comment": "Malware payload", "value": "a00203b2fb1d7753a0dad0d305c12ae4d374d201a11cbc2688e3aff77143aeb3", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273132, "uuid": "db774e3b-458d-4dd2-8221-3ca66e240063", "comment": "Malware payload", "value": "618e2e2475b60990c7496512b4ef43279ffa2fa2", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273132, "uuid": "49f19b87-d82b-4e7a-a2dd-1b4edeaaa2fa", "comment": "Malware payload", "value": "5f5c3de31f5c19dc5a760c761659d66608d1738eda85a3091097eb8af60c83ae885e2e41784804f420c8d413baf078bf", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273132, "uuid": "3c1b35e2-a49e-44c6-bfa3-6334420462da", "value": "T168D6339C79E411FED9F35139FAE155A5E9B9B43A0331CBEB82F04265AE131C05E3A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273132, "uuid": "a0d4e6da-a42b-419f-9e64-65103f2786b9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273132, "uuid": "533141f7-2e53-4a3e-bbcd-b7935f3ea18c", "value": "393216:P7oqoF8eb+GgGZbpsFLXMCHWUjocuI3/PjuUw1:P7oTi1GZbpeLXMb8dH/rA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273132, "uuid": "4c1de2dd-609f-4d24-8d0e-30d1291d0ad3", "value": 12625417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273132, "uuid": "26b38211-35cb-4e08-86df-574c7a31bb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273132, "uuid": "59912580-96a4-49b4-b701-14af4981ea23", "value": "\ud835\udc1a\ud835\udc51\ud835\udc5c\ud835\udc1be_\ud835\udc5d\ud835\udc28r\ud835\udc2d\ud835\udc1a\ud835\udc1b\ud835\udc25e_\ud835\udc63\ud835\udfd0\ud835\udfd0\ud835\udfd73_s\ud835\udc62\ud835\udc25_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459cbe07-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236928, "uuid": "8db16eea-d5a1-4f11-893e-9bc2af5797f9", "comment": "Malware payload (Mirai)", "value": "22469ab3f2bbbfdbadf40a056f3ec1a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236928, "uuid": "ad696967-e62d-4749-be97-5a5f9873456d", "comment": "Malware payload (Mirai)", "value": "a198f3b2300e8313b64398ee9ca9fdb26c0831a310157b54297c55506be88f57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236928, "uuid": "1fc6f332-7c04-44fd-a2cc-e294c407e2a0", "comment": "Malware payload (Mirai)", "value": "bfa3dc52ddf4571c1c461e180479a4f154235d55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236928, "uuid": "f02f0d11-4176-4f03-aa1c-1b9115e13423", "comment": "Malware payload (Mirai)", "value": "5324d16450b62bd52e6844d952ede12bca13685d7f19a5d536c5f192bdc198ac4ebc63a657e372c58dd25eb8e725e807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236928, "uuid": "395ee3a4-eb3d-479f-a09e-cbfd2cfa16db", "value": "T1CCE3E709BB610EF7D85BCD3B06F9170228CD595622F97B3AB530D418B64B25F2AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236928, "uuid": "e937964c-9de4-492c-839a-d641ae717ae4", "value": "3072:JjpvwdERKjZyMk9GBeRYUZraCX4Dq9rG:JjFwdERKjZyMRBUYUZeCX4OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236928, "uuid": "2541b666-c644-4150-a415-f63c14351dba", "value": 148796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236928, "uuid": "a338c03c-da8c-4f2b-84ab-d95093bc4c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236928, "uuid": "fc20d5eb-d5ad-4f55-b4d6-563f8cadaa21", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633bef70-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223663, "uuid": "386e3652-2039-493e-aa36-81a3c8dd8320", "comment": "Malware payload (Mirai)", "value": "56da128f088cc5beb4136cd5e808137b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223663, "uuid": "a964d022-b622-4ebb-a8d1-b6610d10a6cb", "comment": "Malware payload (Mirai)", "value": "a318bcc7d42c58c42453936a62f558765d2e5c89ef6f01e7b9ae03014a0e7791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223663, "uuid": "6ed15f69-d88d-4d78-b6ef-94246f6b5042", "comment": "Malware payload (Mirai)", "value": "984c73aa6bdb5020137c934a1f8c4c5207352948", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223663, "uuid": "63ceed04-e278-4a6e-8483-429f87e72fe0", "comment": "Malware payload (Mirai)", "value": "e4134bcd1cdbccf3ab9fb5f225b8b956c90db24f97f2808f949fac4e0a313bb26d0ec67ff3550d736fda891b765b75ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223663, "uuid": "c3c0b05d-4127-4e39-823f-b98ce5304a66", "value": "T14CD2D07C7B0145D7CAAEA1B44EE50B262DA0CFA2E1436C07B598D9D7BB0986C3CA5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223663, "uuid": "1946a9dd-a357-4e47-a1eb-2e55fb756a0e", "value": "768:z4ylAtv6pqLJM0RXaxGyUbXtheU/S/9+JgGlzDpbuR1Jz:cMBqTRXa+Zhr/DVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223663, "uuid": "1a121d43-57ce-4e4e-86c0-de8096b74573", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223663, "uuid": "7df3ccdc-acb4-4bf5-bb8a-0d20d41deeba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223663, "uuid": "7424f973-30ea-40ad-8ef9-1a548ce2967b", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a42e8d-cb49-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764217592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217592, "uuid": "d6803158-419e-4ae5-9350-eeaef13423ce", "comment": "Malware payload", "value": "5160b203aa332249dc87795cee0ae153", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217592, "uuid": "bc876da6-f3c5-4a59-a67f-fb71ee1f89bb", "comment": "Malware payload", "value": "a34d1339117262a188d8f06319b4b6bd83b152dceb386a952fe4e0ad93e6a2c6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217592, "uuid": "90b63a32-c8c4-4c73-8cd3-e265932dfa72", "comment": "Malware payload", "value": "2657959c163559150ad63bbddea16520e13c4948", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764217592, "uuid": "6c4644cd-4fc1-4ba2-b9f7-bdd655ea239c", "comment": "Malware payload", "value": "f74fed4e58521933b359d930e86aff996b9dca3db9349d29fbec0870f5a3f5d932c7d92ecbaf9a582bc0dec6236b51ab", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217592, "uuid": "909c8fa5-f459-4af5-83f1-b66d1397c6e7", "value": "T1727364484ADF80F8A72774A48EDF8C05F3E98513161DDF95BA4DAAD03F6142C62F89E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217592, "uuid": "72b96f80-8cd7-49ee-97a9-c5404b576202", "value": "768:aHq+blqNJ3v6tc/mqHRD/waVHymQp7sDIOoPrrJK7C0LW87WtkbOSnEHSJRy30zN:LShjF0PbVj527jsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764217592, "uuid": "8ce83c29-033d-4838-ba9e-7a3388a38251", "value": 77782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764217592, "uuid": "6c86effd-76fc-4f29-b037-84becb12c59f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764217592, "uuid": "be81a8a9-315a-4364-bbd2-2e7300b3b9b4", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3725a0-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764237130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237130, "uuid": "9c5bff44-41e2-4f9c-ac6a-461cdd6f12ea", "comment": "Malware payload (Mirai)", "value": "158208cd29925ea7621911444307b710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237130, "uuid": "658fe15f-73e3-42ab-a8e8-8b9a446d169c", "comment": "Malware payload (Mirai)", "value": "a7275bf4817d6891df025dbd78c096d616ffe9ae9d8798c6ed7975ecd3ed8c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237130, "uuid": "190df976-6d25-4a58-bc01-1396d7c97586", "comment": "Malware payload (Mirai)", "value": "c16f804c0db6dc3ef8c4a36b4ebfefc4f797d078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237130, "uuid": "9a16d052-accb-436c-9ef8-83cdfdecdfcb", "comment": "Malware payload (Mirai)", "value": "b11d0b799f6caf1ab6d2fb24b54db4a920e5fbe28e2e801c80e0d4ecfc29847961abd4bfec326451390e95ceada880ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237130, "uuid": "e2f471ef-799b-4d2d-81f1-f03213bdfbc8", "value": "T11963020795C07B0B89327C35A1EB424F0E5EC3B6F6D635D60A1CAE68B54604DD3F5653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237130, "uuid": "86065408-039e-411b-a0d6-540184f0c7e6", "value": "768:qzPX6+CIh7E2lm6XiRAzGYFeQp9g60NqnzgYx8V0gYVUqLbcFgTUtEwa84dkIzPd:0PXwI26yR4bNn0pNza1LgqgeZdkVH0LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237130, "uuid": "a6bf9601-34c1-4431-930a-5a44eeb8469e", "value": 68668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237130, "uuid": "f8d8943e-e085-4f61-a49e-232a97970eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237130, "uuid": "d960a0e2-6d96-420d-bfbc-fab5e9b85645", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12143e0-cbb6-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1764264623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264623, "uuid": "daceb218-2a2e-47f6-b607-ed163c2d8564", "comment": "Malware payload (SalatStealer)", "value": "efd707e43bb79abecdc6fec2d6e9e817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264623, "uuid": "35f9cc1a-199c-40b5-86eb-9ffca54b923b", "comment": "Malware payload (SalatStealer)", "value": "a73629ed87a237dd15d6e4fd9fd3dbe9ecc48665a5104ecce36f1644e5ed8c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264623, "uuid": "eb2d2521-1ae5-4533-afe4-b62a19186cb6", "comment": "Malware payload (SalatStealer)", "value": "0cfa7587b810b2a8b7b09d2006be82e20915a104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264623, "uuid": "5dce6f60-bcc5-44e9-823f-db448a7feb95", "comment": "Malware payload (SalatStealer)", "value": "370e2f6f17f3254c574bba972ad2cc6e572c7685826a3ccb2e94d07345cc88878d2e239d08a32cd8e03225999358b684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264623, "uuid": "776d942f-5fa4-45eb-8f11-225d64a8f0c9", "value": "T15CC65A41FA8B54F6EA031832415BB23F23305D049B28DBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264623, "uuid": "ae3e40f5-97a5-4170-975d-3ca6e28223c5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264623, "uuid": "b7bfac14-9ae1-4cc8-b1fa-c5824d8609d0", "value": "49152:xLKwVg4+yViWdzWDeW0ZURmBkFAqtvpIqJKqR/eDtY6PcNkzoncCYfiR2D1VxAIC:BlVh+sz3r6nKwq1PhG9v/p3BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764264623, "uuid": "65f4b89c-0dc1-4e9c-95b5-668fdce69ac8", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764264623, "uuid": "2ea8f1a2-9992-4626-8ac4-46190ebee1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264623, "uuid": "d8e333bd-72c4-4485-8466-5ffc80b9c151", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de45884-cb7e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764240485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240485, "uuid": "840ec92e-f14e-4f52-88ae-94813ec7523b", "comment": "Malware payload (Mirai)", "value": "b6c14c2821bea02b0603ec8b8a8c5d63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240485, "uuid": "22c77bbe-0535-490a-ae9c-ff425f0311cb", "comment": "Malware payload (Mirai)", "value": "a783398eb2fe604497930c6f4f5b7ce7de73ba9e68616f1282a064ed8d863571", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240485, "uuid": "37abdf66-41ce-4783-97a7-d8368b024ef7", "comment": "Malware payload (Mirai)", "value": "914663fabc476a45eadbc13eeaa4231dbabb09bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240485, "uuid": "fe793e3c-0d8c-4116-b0b1-3ffe76831ccc", "comment": "Malware payload (Mirai)", "value": "42d82a25e2d1986c345c5fc5d1c267de463a06fa8362eece9e7ac8b689610c0de7e7594c4b66db8bd4e485536b6efdec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240485, "uuid": "25ccef37-4334-4ea7-9c54-1629af369910", "value": "T1E7C1399920014B33DE5CDE52EA5A8C4F728761809A9AFF09F9FE55A6C54DE0C3201FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240485, "uuid": "b676aabc-9a19-47ba-a35c-5abefc44a0ca", "value": "24:Iv6r7U6rb6rSH6rJJ6rR8U6rcw6r4Tvr6rVm6rMCZ6rV828NIuHkU6rb8K6wCU6b:rx87IRUc54TE5TG8sqPOzZL2vdYGsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764240485, "uuid": "55f8351e-fc91-4457-9979-d3b105b4793c", "value": 5634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764240485, "uuid": "ba6619f5-5b27-469d-8f11-2e2a322c65e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240485, "uuid": "e93df76a-75e1-4f33-93b6-f5d8da56143e", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24450fdb-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236872, "uuid": "83baae99-b7c2-42e8-971d-b861fa994223", "comment": "Malware payload (Mirai)", "value": "5650e94c19a6313c8a308cbe6c218c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236872, "uuid": "31181805-045a-49bb-8b5b-735f05998346", "comment": "Malware payload (Mirai)", "value": "a8535d3f759f25d0e1b4cc2600c4618330ae5ccb5fbdedd751621d2e5ead66eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236872, "uuid": "364a5ced-9d03-42bf-a9b6-80056f63d799", "comment": "Malware payload (Mirai)", "value": "12e99e45d3b96891c16abbb16b035aa740e1dd63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236872, "uuid": "709ecf62-21ad-48f8-8b02-63e4998f6e31", "comment": "Malware payload (Mirai)", "value": "9d361851f44ba9cef428c9df79f3022d7051846eac53f679a10eda6a4ad0c32449613b9d68ff245b2b4af4113deb2e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236872, "uuid": "0934bd6f-e82c-4c15-bf17-f62db8a2299f", "value": "T19C23F131A4F2ED41C43E967605BE394E99AEB27DF12A4CF5C354E02F487CE3930A458A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236872, "uuid": "a3c699eb-2b8d-44a7-91a9-a92013711f6a", "value": "768:kIinmP2YwITjZDXL0LlHwWNE7INafF1a5UzFs26OEQVoAGbjkneOMDk2tB/2NgsB:kcjLpLgPU+Ea5UKROEeyjkneOMIOBOZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236872, "uuid": "5f846080-1e0a-49b7-ad4a-e2438f384336", "value": 47304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236872, "uuid": "24f41964-8f4e-44c5-8689-e50d35437c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236872, "uuid": "d1f1bc94-122d-41aa-865a-b8edecab024c", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2069070-cb87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764244519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244519, "uuid": "03cd9e53-347d-46e7-b2b3-d812327f76f7", "comment": "Malware payload (Mirai)", "value": "1d4a54fc4dd25a477cd15e36b04e04e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244519, "uuid": "220adb19-4075-4eb2-b9d4-bdbe242246af", "comment": "Malware payload (Mirai)", "value": "a8adf65ea705ac71a530e817f7aecffc8ed06c110e442b5a4e290d7c531110c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244519, "uuid": "25edade4-88f9-4834-bd39-21771d7fee76", "comment": "Malware payload (Mirai)", "value": "c3157e70cf60bdc7a83b1530b7aad19ea6a73912", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244519, "uuid": "1b580fb1-14ea-48de-aae6-e0b76fb3f7e7", "comment": "Malware payload (Mirai)", "value": "d80a5f8bbbb9a026cfb243447f1c1daf0077208519b24201e8d8dfd29bbbe325db7a5f5f1f9bc44c529799eaa4c319d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244519, "uuid": "8678ac9d-bb8f-4fb1-af5d-379d8aa029a8", "value": "T106D2E16A115E9DA5CBB24A36DD7B47473BF201F4C1D474232114797066E3F6C3AB8886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244519, "uuid": "1c08f80f-b82a-451a-aac2-c4004f3420da", "value": "768:RjYt08fLtLTA599MNLt0StS71XM+s3UozwC:ZYt08fLtI92L2kS71XMjzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764244519, "uuid": "ddcc9ef6-0e76-4087-b809-9d5c8f414348", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764244519, "uuid": "a2fd1f31-f533-4d23-a203-040fd7bde27f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244519, "uuid": "e318ad3e-7ca3-4b01-a08f-1d3284fac82c", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef0bf6-cbe9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764286404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286404, "uuid": "40a91e5b-1000-4bf7-aa43-c967befe8d51", "comment": "Malware payload", "value": "dfaa0b83a2e4bf6ae106ea9cda790705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286404, "uuid": "eca65e17-f57d-4ec8-9e83-a3ac21262009", "comment": "Malware payload", "value": "a8b815bfd11ea38e279ff4a7bbfcc279a935b5af7ed5b605f1996d4003cfe560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286404, "uuid": "3aee331a-7267-4000-a570-b3e3d4afb027", "comment": "Malware payload", "value": "ccbcf3b5bfbf1ea633e1eae94b1d86c0194090ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764286404, "uuid": "7dd9424f-84c3-43c0-ac71-9ab713e7aa62", "comment": "Malware payload", "value": "421822e14d94e11d3a2e2c9569b00aaffd169e76588a929dc942c99da29e295d2ba23afdbb3f2ec605bad6750d701391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286404, "uuid": "41246a9d-4b82-43d9-845a-d8f2f7cf6945", "value": "T19A530886BC818617C6D462BBFA5E42CD332663A8D1DF7203DD116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286404, "uuid": "9377dfc2-5340-445d-8a1c-da6c1c7a7708", "value": "1536:pMbzNu4M9BBljm+HsPwtu4juCTHtug7R:pMbzwjm+M34XHtug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764286404, "uuid": "bdbb7b7d-9927-47e9-b5ac-67b61ca15f58", "value": 61324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764286404, "uuid": "6d9370b9-0004-49df-ae3a-e61389cafbbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764286404, "uuid": "fa4b0327-7e59-4a00-aa41-81d7ca90f400", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a26ad0c-cb95-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764250169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250169, "uuid": "3910350f-23c8-45ac-97a4-5639448f94f8", "comment": "Malware payload (AgentTesla)", "value": "2c99f30093cc41eae56cd7ddde553277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250169, "uuid": "d87d434c-6a07-4871-a0a4-4e11df9fa7b9", "comment": "Malware payload (AgentTesla)", "value": "a9f89e028597161338565015752b2745e3e9c28558ca03ef05bd797faf3dc54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250169, "uuid": "bb0e6494-87c6-4557-a4d3-a404c97a605a", "comment": "Malware payload (AgentTesla)", "value": "8f1a66b6260d0b2ffab7f29fa108ce00ff144b4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250169, "uuid": "63b9c24e-209e-47ee-9d68-e2df0aa257c3", "comment": "Malware payload (AgentTesla)", "value": "aa054744ebebfcc65e9e61f5dcfb4ccd793a89711e66b90978d3c3fc6baae3e1e5af1a833c121170c4573a983ef6fed0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250169, "uuid": "37ecd5d2-ea90-41cc-8e29-00fffe10154b", "value": "T17A76BE1993A401B5D42BDB38CA65C333CAB0BD925635D20F099DF6461F73AA28F2F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250169, "uuid": "fc8d7e7a-8901-473d-9be4-da2fad60c28d", "value": "bf7449ae0b053c3629fa1a1b4b3b77cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250169, "uuid": "8400fcc0-331a-4425-aee1-20b9b88d7b10", "value": "98304:HPub5nFygcDsTkK+vPNeeViEiPdJU704H444tO:HPublF9cDsT2vVeeViEme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250169, "uuid": "bfbc1a2c-155d-4a44-ab03-247bcb663a80", "value": 7465472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250169, "uuid": "74a2d29e-ca1b-403b-bd67-5e2640ccfcd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250169, "uuid": "df6fd49a-3db3-4b31-865e-777853ab83ce", "value": "Datasheet\u202ef\u180ed\u180ep\u180e..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725d4f0e-cb95-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764250317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250317, "uuid": "98dbb881-69cc-4f16-9167-1ccc3936cf90", "comment": "Malware payload (AgentTesla)", "value": "d14d5c7f76fb50a5472541ed21a2690a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250317, "uuid": "fd60bfd5-0c36-4bb0-9341-66c9cbcf1820", "comment": "Malware payload (AgentTesla)", "value": "aadccd5f545dde5c574705dad4989fc6df0659a65d96846f8b61f98dc47eeee0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250317, "uuid": "9c4e6981-8d91-4a84-888d-cbe8b98a9c0b", "comment": "Malware payload (AgentTesla)", "value": "c7e938fa85938ed1f0d617be60dd99a3682e2bb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250317, "uuid": "67162e8f-656c-4bd5-84b6-9b123d107cc4", "comment": "Malware payload (AgentTesla)", "value": "c9305b9e0429970f6d274669b38b2c6528c626cc9519efa8c94dea4167e3a047aaf2585a2728c0a2245bec4376ab341e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250317, "uuid": "6445a6d5-ee3d-472a-838e-566427a95188", "value": "T13376BE1993A401B5D42BDB38CA65C333CAB0BD925635D20F099DF6461F73AA28F2F725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250317, "uuid": "25365347-b951-450c-bec8-c89da33d800f", "value": "98304:EPub5nFygcDsTkK+vPNeeViEiPdJU704H444t:EPublF9cDsT2vVeeViEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250317, "uuid": "c406e991-05e7-4e86-9257-0fb9dbac899f", "value": 7528448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250317, "uuid": "957e9dae-8777-4bd9-8182-fc4ac57cec26", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250317, "uuid": "bde191a5-fcca-498b-b2ca-3b8f99dda68e", "value": "Datasheet\u202ef\u180ed\u180ep\u180e..iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ecf4d9-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236873, "uuid": "fcccb809-69c6-4550-9157-9afc0510e0c0", "comment": "Malware payload (Mirai)", "value": "0971e1a238a64a8a3faefcb8f01e156c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236873, "uuid": "5c1c7919-e0ed-4b76-9f59-ab2cfd4c1972", "comment": "Malware payload (Mirai)", "value": "ab19eb422ff1848dc460657921a8db9bb113fd5328de25289c7b79c982dd92a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236873, "uuid": "c3affff8-2987-404b-ac36-2a3cfe0c755c", "comment": "Malware payload (Mirai)", "value": "e772bc4959cb5333de4514aec8b10f29eefa5cee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236873, "uuid": "63342b89-8f87-4d71-a896-f040886ee0c5", "comment": "Malware payload (Mirai)", "value": "1e8aaee41f2ec6f13e784da4cbf9f7805cd22c8fc8a3afe0adca68d263a8c2d2266a19a8ac584ff5388c45255373f4e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236873, "uuid": "d87b5241-88cf-4158-a8ba-cc9505822ca6", "value": "T1DFB37D21B4381E27C4E1947B22F74766F1F657D920A8CA1F7E720E8EFF256502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236873, "uuid": "ac0fc763-5de8-4da2-b65b-028ded3a97fa", "value": "1536:ZHIO8eULmvhQRTn7bn98OTgebNc9hf6aC9g+ZtMYN+XFs6HtaD3Ym5rYM5J5tAJq:lIEroMHf6BzN+Wow7YO8Rbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236873, "uuid": "c6958de5-1b0e-4f1f-9183-ce7bc50912e9", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236873, "uuid": "fb1df8e9-c18a-41d4-a58e-fb5f626d72f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236873, "uuid": "b2ad9f5a-5e32-4299-8b99-c656d945c0d2", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ddc160-cbb9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764265812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764265812, "uuid": "1756d284-c4f0-4022-afda-2d861b1ea36d", "comment": "Malware payload", "value": "3ed2610d8af3960c2d9d399ab6eb08a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mail-taikei-rmc-co-biz", "colour": "#664347", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764265812, "uuid": "d17f0fa2-16df-4ab1-9115-b3b39be4fc2c", "comment": "Malware payload", "value": "abe94e6d54350af016763d1b25d448929e6422293a96db3bad57c2211df1e162", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mail-taikei-rmc-co-biz", "colour": "#664347", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764265812, "uuid": "96d9d378-8d21-4ecd-b73b-2ec4314191af", "comment": "Malware payload", "value": "2bd52ee690656c2a4cdd00b94ebb60bfad81c1e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mail-taikei-rmc-co-biz", "colour": "#664347", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764265812, "uuid": "671b16ca-84b4-4b67-9637-800924d45476", "comment": "Malware payload", "value": "1e5f03ac4d71b6af76e9afb907c178f0441a486a0bd71f0102af9634c16119767fea75e5e3e1db4a3fd8543caf2faa31", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mail-taikei-rmc-co-biz", "colour": "#664347", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764265812, "uuid": "54372a2c-d264-456e-b3b2-13fd6ca8cc49", "value": "T15327E944F08497982C276D2677B4F0E243D2B25B7E56DA13E01E86F2BFB71C27E1254A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764265812, "uuid": "72f55363-216f-45a6-b5f7-c64f53d9e8d7", "value": "393216:47Iz68uzDirJkXSURqZZ2k/7S5qYAkKst6sX3k0p7TYA+hodwCApeZ6INwos/Hw0:4kQniVkCURqZZf/7S5qYAkKst6sX00p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764265812, "uuid": "23cd53b3-cf2f-41f4-be59-436d63385f01", "value": 20880081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764265812, "uuid": "00a48d62-b8cf-4ae6-bc2c-67dc562d956a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764265812, "uuid": "13337622-8621-4dc9-9b19-bd71d06b540a", "value": "RFQ-GUE-25-MH-120-SDQ788BM.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ae4e84-cb97-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1764250999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250999, "uuid": "0b511806-55a1-46f2-926e-9edbc1ea43a9", "comment": "Malware payload (Tofsee)", "value": "773647e840480738ae8b751f32df05b6", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250999, "uuid": "0570ebb4-1b71-4f29-8a13-0ef8a9cc8f23", "comment": "Malware payload (Tofsee)", "value": "ac91e59453a37795cd8257acccd227d21f68f21a0019fc7765e0a3daa3caf4e0", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250999, "uuid": "41c9755d-7397-43c0-9021-921aa792e5f1", "comment": "Malware payload (Tofsee)", "value": "c8579f878580f2e0bca855b45aa371abf871b9a2", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250999, "uuid": "ea6c6892-7c55-45a4-86db-b9c7b74ef03e", "comment": "Malware payload (Tofsee)", "value": "adf53927b4a965b9ca9319e0fac9a2bc35a5417a0f276f8db5edbd8aac35e7149e016e1c5af1f08646eb4cba8faed1c6", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EUNIQ.file", "colour": "#B55256", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250999, "uuid": "b1834323-69a4-451b-b601-0ffcff9ab570", "value": "T152F5F133B389673EE06E0A375AF2D2105C3B6661651B8C47A7E44C4CCF6A2601E7F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250999, "uuid": "eda3a751-98fe-4501-907d-7eb022821971", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250999, "uuid": "f1f35207-5f11-460a-9e76-5d2c6c16bb59", "value": "49152:jN61T1muh7Iodz4gOXrB229JqGhfktMYnkbb4mZyPOT4Az4aNH0/1Qcgn8UGiNDc:jN66KIFc2zCrn4br0PitNsm8R+Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250999, "uuid": "b929c84b-83c4-46ef-b65d-cae7fc4deb11", "value": 3463697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250999, "uuid": "d78c1cf7-aa61-42a9-ade2-e21db84ea002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250999, "uuid": "0ce0aba4-c53f-4ebb-becf-bf57c4337814", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ba8f1b-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228521, "uuid": "c2b7e793-b4ea-48ff-8a42-12e0ba3ccd3b", "comment": "Malware payload (Mirai)", "value": "377ae6019ec2aeecc9e959294427f072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228521, "uuid": "7225e07c-7d57-4d4c-8913-ea375d87b822", "comment": "Malware payload (Mirai)", "value": "ad12f66a93a0d6f31e96bc9d8ae3c0d69dbed71a8e4274d071b1a7da43eef9fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228521, "uuid": "760971bd-2bff-4482-8627-b1702bc515c5", "comment": "Malware payload (Mirai)", "value": "11bf9d28d32e90c3bdb45c4562c0cbd97ab0df6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228521, "uuid": "f4e08fa1-2f74-4697-bb63-4fbc16e8492c", "comment": "Malware payload (Mirai)", "value": "3ef4edb56365d534991fc167c12653717aed7f7c71d88d0df0b3bca771e9dd1428c9655561a22f4817e9c6f1775295cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228521, "uuid": "1ac93e96-4574-4fce-8c64-c93733d38efd", "value": "T1B6530905F940872FC6D267FBF75E439D373A1A54A79B33116A382EB43BC5BA81939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228521, "uuid": "a03e469f-43f0-4209-a39c-979b4db9f309", "value": "1536:Jg2Ff8T/lg4YXm1ZSRMyNeJKe1PWpeZCj35:VFku4Y21ZSRMyIKedWWCr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228521, "uuid": "40b526c2-906d-4d70-a14b-0b7852d5cd23", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228521, "uuid": "8d54665a-89ac-4ccb-b8f2-0a36544aaccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228521, "uuid": "5aea0063-ef06-45c2-8001-bd403e56dc7f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efa0405-cba8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764258553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258553, "uuid": "adb9d286-3673-4a92-9edf-e278b38a42c1", "comment": "Malware payload (Mirai)", "value": "8e05f3a247e2d93c55c8a7ad5a5ecad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258553, "uuid": "50ccceb4-e795-4a71-98a9-d0ec19019809", "comment": "Malware payload (Mirai)", "value": "b234ee8ae37016a77c19c29752063de460ef7e279f9f008bb76b3928e0173623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258553, "uuid": "3868e1a7-2cfd-4648-9a95-527124d89286", "comment": "Malware payload (Mirai)", "value": "5aa9673dbcb3e4f824c14624ca2d25af4255d2ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258553, "uuid": "8e325c77-1cbe-4ecf-8016-7d68d290a8a6", "comment": "Malware payload (Mirai)", "value": "dc47b27435c36fbcdd6b64b71983701a62f1a2e6221c53b240895456ea5ed4e0f40e518cb9467b883b6c0b328dc1012b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258553, "uuid": "aae4540f-fb66-4952-aad6-5c23d2ce809a", "value": "T149B35BD9F643D0FAE81605302176FB376D72E9BE2228D983D3B89E727C12A41D416B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258553, "uuid": "ed0ead5c-2fd8-4302-acf8-f8c1853d4127", "value": "1536:O1z5kayPMrO/5e2xKKO1lObIO2FDy7w5qR6U0NhbsnxA3S6BS4nY:KkMrG5e2xKKkIr7Aq0Uots2BSCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764258553, "uuid": "88b21478-e427-4fce-8ae5-70ee0917a7fb", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764258553, "uuid": "bb70a86f-1484-4ef7-a853-eb59753fa185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258553, "uuid": "53a9a878-a447-43f9-8dd0-1ffacba56c82", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f460daa-cb45-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764215845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215845, "uuid": "db341ca4-442e-4a5b-99db-898c3e306f69", "comment": "Malware payload", "value": "0490b896a8cbb6e698238baf5ec88842", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215845, "uuid": "44cf030a-ae61-41bd-8f47-09be6af7ca55", "comment": "Malware payload", "value": "b265c9e731d4b7e8615d0285cdc001ffdbd696c6fd0a33453816ec5b23f5cba3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215845, "uuid": "db2abf0a-4ef8-4c84-bc36-5b35ae703a99", "comment": "Malware payload", "value": "37a7c04dd5745cdfece63f0eb1cd3146f43f161e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215845, "uuid": "f5d9b35d-cbe9-4107-b348-50a4168670a9", "comment": "Malware payload", "value": "c48159fb13df7f9842af18ac1c3051f11ff64bd4182dcc25a00d04721a5e034283a14fc435bebcfafb4ffd34db2de1dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215845, "uuid": "ecaae6eb-43c0-439c-a13c-848d61171cb8", "value": "T1DB26F12957139031E454BB3C4CA6E527E6FD7DEC2877B050A862DFDB6019F840AD32BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215845, "uuid": "82669890-cd89-4e63-a593-d0f4a233f92e", "value": "e9304fead878501706fa12a458d2aaae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215845, "uuid": "8c45d314-182b-4935-b860-fcabda2b3e9d", "value": "98304:+5i8aXdCqsU6ATjFJoqiisAU2QDYmi5LC:kat8BCb+GQgNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764215845, "uuid": "d8f63261-a04c-4551-9d59-3e18db0a4b11", "value": 4578139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764215845, "uuid": "96bfd8c6-a848-40c6-83d2-366ccb6eff79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215845, "uuid": "a01a80bd-712b-4869-bd4c-898107f3851e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bdab44-cba3-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764256178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256178, "uuid": "add9a1a9-fddf-4df9-893e-944902025ffe", "comment": "Malware payload (PhantomStealer)", "value": "08a39349f6e602d84653dd1fe8bd69ce", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256178, "uuid": "f6abffe8-396c-4900-9038-a9370615bdf6", "comment": "Malware payload (PhantomStealer)", "value": "b2c581fa48c4eeeebe8927fc29f2c85e01a233964a7709b02c0a313574a2a7b5", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256178, "uuid": "9ae11567-1839-4b04-8d4b-a114eb961c6d", "comment": "Malware payload (PhantomStealer)", "value": "ce946224a0ad76e90fddc2dbc7988b0ff146de23", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764256178, "uuid": "f635221d-f8be-40aa-878a-be7d39d683d2", "comment": "Malware payload (PhantomStealer)", "value": "b77b4670efc8889fe9818ad84c3e0f8549b605f442268791b3d0f37e1caa0e3e0bd0486f36abd17020d9c6cb1853b19c", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256178, "uuid": "e69858e2-787f-4955-82c6-e845a38b8c10", "value": "T10B75E00273C1C062FFAB91334F66F6515BBC69660123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256178, "uuid": "47c43a9f-eee9-43b7-a8e3-af6d0712180c", "value": "49152:p7ltjLheZbcLkpatg0YgT+3/gQejHZMS:VngbcLkrn0jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764256178, "uuid": "e94651c4-9a7d-45bb-8c49-f9eda19e33a2", "value": 1648163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764256178, "uuid": "e6822827-311c-4dc4-a0d2-7a66e0235e13", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764256178, "uuid": "9272868a-e604-4f95-8ae7-ef733ffff23e", "value": "ENQ-2025-SQ-00041-R01 RE T98.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12c3c81-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257375, "uuid": "2fc39070-359b-411b-a0f9-c887ac828bb6", "comment": "Malware payload (Mirai)", "value": "d3599f81b7bf6c46ee89aa83566f2d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257375, "uuid": "f3b0d78d-a784-4d79-902e-7fb5a8defdf9", "comment": "Malware payload (Mirai)", "value": "b3007308977d8858f8c244beb3c4275f08b2f1d5d912da57522ad009c5a57146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257375, "uuid": "abc47540-26a7-4f99-bf63-0eebf31e0dd2", "comment": "Malware payload (Mirai)", "value": "f08d43750c2586f8d91c3c5137103cd58e81e98c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257375, "uuid": "d773e590-c8a1-4652-b91e-a46841f2b6b5", "comment": "Malware payload (Mirai)", "value": "faee681245f530169a8ad956c8c771ed5120f2b7adcca5e3c58f3ecc4b72821c0cc75539970d35e500a066e1bcec4c31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257375, "uuid": "cde539a6-a7cc-4f7b-b5be-7a1987ffecd9", "value": "T1F563F232655628B05B705C37BCFD8352FC6F8174C165E6F2B213987C314AB9345BBA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257375, "uuid": "14799a0d-edd7-47ff-8816-cba91368796a", "value": "1536:iYWnPpMi9HTxtbf/+BVxLMXtrNgyqZPpEqmGPNxILJ6qxXXDvNdI9AEqRV0:iYWBMUTvbe1MXtrmyqZRUGgLJ6qxxdIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257375, "uuid": "f5f19b86-42d9-4b53-98fb-0affe7a49bdd", "value": 73256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257375, "uuid": "be47ff8d-8ce8-42fa-a99b-387c0817868f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257375, "uuid": "378e7a1d-2374-499b-9e0b-a148de9ce766", "value": "SecuriteInfo.com.Linux.Siggen.9999.12451.16239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d84c37-cb8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764246860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246860, "uuid": "be7337e5-711a-48f5-82e1-e43363a38b1d", "comment": "Malware payload (Mirai)", "value": "b9902ddf963a326fabbb38f645fd36f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246860, "uuid": "43ace0ab-26d8-4367-950d-6f53a8db7e5b", "comment": "Malware payload (Mirai)", "value": "b416bf3cb2b219777bdbc432e7182d6edae29db7bba41b0c22e644ef93bb1046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246860, "uuid": "324c16ca-44f8-4a16-8983-78b931fa225a", "comment": "Malware payload (Mirai)", "value": "54bb34a8e9494bce32467f6c7e2e7b2822263bab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246860, "uuid": "19d4d02b-ad7e-4787-8935-3d7932fe4c0b", "comment": "Malware payload (Mirai)", "value": "4b4b56e2e656d4bedcc5cc175e7081fcfb2a341f0656d0570ac4dee26bd3b8651f0b2999be00313ff4e0f4261e343b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246860, "uuid": "2689097a-70df-46af-bb54-3e2f8851ec87", "value": "T1D9C2E15285FBCA17C863437E2928157351681C55E70DEE3D172AEADC538C4E32BBAC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246860, "uuid": "efb9a467-caee-4547-b49d-67db1f034a17", "value": "384:MRGE9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHN:+5+Kcrb9VDJef5Q2PdHuzb8HoEPbeO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764246860, "uuid": "2b4ec278-0424-464b-b8e3-06d697b4cd19", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764246860, "uuid": "557f3dcd-f759-4f21-8aff-ea1bc5bbac07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246860, "uuid": "f47fe2c7-72c8-4ce9-a472-f2aa023c621c", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8b2a57-cba9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764259005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259005, "uuid": "0206b2a1-9c75-4a78-a705-fedba90f3c35", "comment": "Malware payload (Mirai)", "value": "66ba4b0d918acea354517da2597231ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259005, "uuid": "a60ef4b1-c7ad-4dcd-94a4-4d0b89088534", "comment": "Malware payload (Mirai)", "value": "b46684c8ae0e46f779831c651cedfda0406acd45247e2347eef63ce62c0f2425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259005, "uuid": "c8e29781-ed4a-48e9-991b-291a5bcbdb55", "comment": "Malware payload (Mirai)", "value": "ae8f09672adeb7221fae88e02aa0f891b2f261f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259005, "uuid": "a7b61bb0-1fa5-4061-bcc2-00c20a11a5c2", "comment": "Malware payload (Mirai)", "value": "c15a6e0d662385e9af48b732688d2148e9edf3a77c8bcbd07a34b57c21c282e37ff694842c5a2221bbfc2c772d533280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259005, "uuid": "3de8cf47-d6ca-4886-b074-108ea85d6d4e", "value": "T133C3AD8BB34B1820C46146F40BC38FCD6E9372568E07C9EB6D4E697B29796CF19167C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259005, "uuid": "ce440772-1ea2-45f4-8693-b63fe0a0602f", "value": "3072:P8QmNPQDEZYAQ+sMh5rq7HDfRxhdgXnAq:UhNZN5Ib/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764259005, "uuid": "1b376fa5-6436-40c9-9a91-e669fa8672c6", "value": 124240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764259005, "uuid": "d9efa426-ba84-4d45-83b5-62382a4e7546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259005, "uuid": "d31289b7-b7b0-44d0-9bfc-5d83a48cb14c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bf7bdf-cbc5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764270830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764270830, "uuid": "0dbccee3-dae4-4e43-876b-07f23d854b31", "comment": "Malware payload", "value": "ef6e7e9488b901d0578990edae9f9f02", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764270830, "uuid": "98718aac-f247-4f91-b93c-a7f85c49a16e", "comment": "Malware payload", "value": "b55068d60321e1174fed89ba5182eb8c1f64203baed5cc725e4961833f59a119", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764270830, "uuid": "75c9a8d6-dbe4-4796-a576-ad8eaf24a451", "comment": "Malware payload", "value": "155c87b4508dc44aa613f90741858d756408557c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764270830, "uuid": "d8f60cd9-e525-40ca-a22a-a962b3051106", "comment": "Malware payload", "value": "4ceceb32bbe33e518c32a176d95142122667f07981c279b9a2b1f285f782570a2e6e4c2b4039b9f44755e41376907c56", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764270830, "uuid": "a724cd47-43a6-4500-9b97-c88a8635f2a0", "value": "T133D533A22AFC4197D03773744EF349679A7138B26B7B4BBF128481789B4338125B5B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764270830, "uuid": "5addf8ba-0fdd-4fed-9712-0da84ef6a7f6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764270830, "uuid": "e037eafb-45b6-4d11-9686-f0146073e217", "value": "49152:KbBaHkGFdKc63FJ8+ccgdJEfuuCSYR6iHsZ8uOpdmRzH2+YM93e:KbYEUH6Y+Ngdeuu5i6iHsPQsRzW+xxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764270830, "uuid": "12aaa839-e201-4e24-af75-6e1b76176070", "value": 2773432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764270830, "uuid": "81233f36-7c29-420e-9a91-c1536273b523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764270830, "uuid": "abfa43b3-554d-4077-85ff-0f3e3431e6b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab9f32a-cbd4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764277336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764277336, "uuid": "c55caa2a-ae53-4b4d-8e94-26ff3c71be8f", "comment": "Malware payload", "value": "5dd3d8ab517307ba78902ea39f88dfab", "object_relation": "md5", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764277336, "uuid": "eeeeed15-f393-451c-b685-e962196d5650", "comment": "Malware payload", "value": "b584b74f0cf25a6a60f5af6e951bf4fd0e12b63709850457775235ef55a01342", "object_relation": "sha256", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764277336, "uuid": "655bf275-7358-4967-8a13-f534a73f8de4", "comment": "Malware payload", "value": "c146bd5e292741262e756d9bd8d42e700315d198", "object_relation": "sha1", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764277336, "uuid": "8efcce9c-fde3-4a17-a363-bc741b846ab8", "comment": "Malware payload", "value": "04ac6b5b1410e6815264983759c7231f51a782cb84e2d4d3fa3d881a9b890d4b094ec6c6fcbd6f56ae36b8370f650251", "object_relation": "sha3-384", "Tag": [ { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764277336, "uuid": "626bff2d-0443-4898-bc7f-a969a1425ebd", "value": "T1DD14D00B67A631F8F2768278C8508A59E776B47502619F5F07F003AA1F176D18E3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764277336, "uuid": "549df8c0-4079-4597-bd75-f4aea1118c59", "value": "f35919722d8dcde279077a8460e70b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764277336, "uuid": "f49bc2f6-c850-4d12-affe-d29a568f1846", "value": "3072:XaD7X/FESbmI3UGxxoJC6OxAEVHM2aCGxslf4VbyDjoCMOviSNjZaj7V:mX/FFbDUM6ChlM2aCGWlCinZY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764277336, "uuid": "a0220138-13a3-41e3-9fa2-f6525c217a44", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764277336, "uuid": "88830082-ca95-46c3-a85a-0d840e31d226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764277336, "uuid": "33f1a794-01d4-4cb1-b1c5-0b54626e765e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49900fd-cb59-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764224739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764224739, "uuid": "6bf0cbe5-5fb4-470a-b8b1-796f8f3b1389", "comment": "Malware payload", "value": "b91697cdc37444a6fe05fb4fb39dc07e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764224739, "uuid": "c7eb348a-d536-4671-be44-257c5eba0cec", "comment": "Malware payload", "value": "b591ba89df977e1df340db28d2db7ad447b7647a0cf20e61fa48b67298e44eb5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764224739, "uuid": "28329f84-d4fb-4284-b549-8f303b98e74f", "comment": "Malware payload", "value": "274cc9f1bbf857e9d1c25d888f95478ad7c8012a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764224739, "uuid": "58789238-7f26-40d0-8ae0-fa724db01e7b", "comment": "Malware payload", "value": "7e6a52c1c8fc44193ff3c0ad6168499b4e62acf19adf997c3f2a0c6188bf2dc7712a48c2eba3f4018c4b286820278919", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764224739, "uuid": "3d338257-c548-4163-bd19-5c26c82fe76c", "value": "T1077363880DCF51EC96277CD8CADFAC59E7D58913622CC6E5BECDACA07F1142891E84E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764224739, "uuid": "a42978b2-4fc5-42d3-90cb-f4f60e715f4d", "value": "768:P9U2n7mDMQxwfRHkuBQJ3zOeNfdv60mqgIrrxbjMNycwTGbEDSXfx+pr+Hc888YI:lUbf5v60mqgIrrGHfsL3wWsNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764224739, "uuid": "d1cefc52-85dd-4edf-b603-e4330ffb73c4", "value": 77393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764224739, "uuid": "691f6253-5210-4b84-a027-bd6cab7f0f2b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764224739, "uuid": "145ae89e-b1b6-426d-b10d-df27aaeb2657", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1b578e-cba7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764258096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258096, "uuid": "234cd18f-25cf-4801-9dda-fed9f56fcd71", "comment": "Malware payload", "value": "b22d8cd0000f589d6ab037df6f36869c", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258096, "uuid": "64eea7bf-2b54-4107-b97d-7988c2e6906f", "comment": "Malware payload", "value": "b62809eb59d3f4df912527330b48141ab935841e1a6d0aadc3296ce5d5d4f8a0", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258096, "uuid": "d1f4d0bf-8225-4d11-9db7-98deb0747ee6", "comment": "Malware payload", "value": "49520f348a20080a4d79347ca408c047fdc93049", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764258096, "uuid": "dac37b99-917b-4902-be4c-d40fb23f1c76", "comment": "Malware payload", "value": "89e7d46d301c1b520eb16dc928b63d182e9eedbd9a4a97c4cc4209846ba01f7636692d54edc165992795ec99fdd25ba3", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258096, "uuid": "831fbfd9-d113-4291-b62e-6fd0640482b4", "value": "T16F752390FAB1DB67F43951FC2892505B215BAE206600C8577AC6330E6B73B7D2EF1B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258096, "uuid": "5ce94ca4-fe05-4693-8071-bc39012ddcb1", "value": "49152:jrrdJ2h7zfiBOXJXzuCYCR5a1JyMhRQbS+H/w3y9L:jXdJO7zf/1u9CO0bF/wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764258096, "uuid": "b8c3d610-7d07-4794-9461-71853bf7c38d", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764258096, "uuid": "0e56bdda-d63b-4f0f-8211-39f5700c047c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764258096, "uuid": "b6f01bab-ca58-422c-9648-06a995406cfc", "value": "Kopia p\u0142atno\u015bci.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b79489d-cb55-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764222818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222818, "uuid": "53f3a692-1581-4cc3-b536-e2d0f13850f7", "comment": "Malware payload (Mirai)", "value": "1a9459ad397c48e63eaf98753b0b8fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222818, "uuid": "1310fcfd-a4d3-4655-a6e6-1251926efea9", "comment": "Malware payload (Mirai)", "value": "b6873744cfb1b2bc92f49ca61975afb7b8c491ccf41111ded5bc63575bba59d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222818, "uuid": "d493cddc-d8f7-48b0-990c-da31c4fd8cd4", "comment": "Malware payload (Mirai)", "value": "7dc0c2ebd92d81ef8cc04c00b10950cb3ffeef24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764222818, "uuid": "b0b17cb8-84ad-476a-8296-b46fe789f15e", "comment": "Malware payload (Mirai)", "value": "7669d7a4b294beaaf400b5dd7a36a246cd38bef127c6b1be18103b1474082f65eedd180b501741b5f6bdc34d963adb73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222818, "uuid": "d40a9e54-23ad-4901-ba48-d5190462e622", "value": "T13D530296EFCD2B9780AFB13E495E1D0C6504DBE25A750C2E6DF07A183C227B07968BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222818, "uuid": "f802a238-343b-409b-9389-49fa6e4a241c", "value": "1536:6Z4UcDIME62kKTF3HQXLaULa6Y3R1xMWUlQNMk5Ytq5f9lq:W4BDBCFXWzY32Wk3kia94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764222818, "uuid": "0551b30d-8b50-45e4-9828-a0dfd69d8d88", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764222818, "uuid": "86cf2b2b-7ca0-43fe-b5c8-fce647856fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764222818, "uuid": "58b8d159-4e18-4284-b795-79dac1d951d3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81763ec2-cb91-11f0-a129-42010a9c0007", "comment": "Malware payload (Ngioweb)", "timestamp": 1764248625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248625, "uuid": "3da32348-362a-4548-859c-a55fabdbb581", "comment": "Malware payload (Ngioweb)", "value": "8f6c9d8d81d9cfb8a724d4e85955791a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248625, "uuid": "65e91e92-6cb7-4a4e-a6e1-b35f024cf92c", "comment": "Malware payload (Ngioweb)", "value": "b93d30cb476594eaafadcece066f86d8a8f28216b35ad7f955c0371b41bd6cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248625, "uuid": "dbd7fd22-66f2-494f-8c03-78d583b71c8a", "comment": "Malware payload (Ngioweb)", "value": "7c169147505abc69d830f50b7a56d1a997678afd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248625, "uuid": "3632ee68-909a-4c82-a29a-c7cbf3f7205c", "comment": "Malware payload (Ngioweb)", "value": "438f1bf4386565ad5733e14528bcf95aec7615931d53f9ee0347d7ab534091533d5f4f20c75dd9e22973715e0a94f230", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248625, "uuid": "0afe9aaf-7e5d-4e17-9a53-a2f35d7038a4", "value": "T18F73F755F890DB22C6D1297AFA5E428C33630B78D6D93202CE146F3537FB95A4F3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248625, "uuid": "a7910a11-28ac-41e6-a971-ae8728e32403", "value": "1536:FR+LJnpqSXSaOgb58y9abf2pv5c86NdxE7yasWywkU+F7nidWNcA54Ir:FR+LJnfggqC1qduuqk/cWHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764248625, "uuid": "98e6575d-2dc9-4471-b570-e0a08448aee3", "value": 75272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764248625, "uuid": "5542c8fd-a584-47b6-8ea9-4eb61c028d22", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248625, "uuid": "e1aa390d-d797-4c23-895c-05e8f3fe48f8", "value": "vyatta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff10354-cb7d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764240032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240032, "uuid": "f1f76737-f05b-484a-b24c-55f71aa4aad1", "comment": "Malware payload (Mirai)", "value": "8f29ed795d6eebcc3c4d55e3dea1a0a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240032, "uuid": "170b1912-54a5-4768-a94f-8c4eebfb6a25", "comment": "Malware payload (Mirai)", "value": "b9ffa90c19a9fceb8b265a5a8446a973bb1f8ac7caa4bb48aff667649fab7775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240032, "uuid": "da7c2516-179c-4fe5-a986-d42b8a677591", "comment": "Malware payload (Mirai)", "value": "016446eb500e000c39e208b8d3338d651a3580e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764240032, "uuid": "cbfc38b3-321e-4025-b877-38f643f1c155", "comment": "Malware payload (Mirai)", "value": "4e54a0dfa00e56658f3dca8ff53e442d54f5eb733a648c9ee76d5372a45fd9b29027409e6bb64ed19a3e60d46e848f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240032, "uuid": "bde5397b-2f0e-4ea9-a54b-acd8bf8253e9", "value": "T1BFE37B22C964AE98C624C575F021FB791B539E5685875FBA1AABCB708043DCCFE053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240032, "uuid": "5bf8f81d-1574-4705-81df-35da7f4d309e", "value": "3072:oElbBIznee0PIGtK73ZYwQcmiJDcmWlsPCJa3aR:oExHrSZYwQzzl9Ja3aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764240032, "uuid": "107f9c37-809e-42d3-8414-5bcbf5dbab21", "value": 151168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764240032, "uuid": "d8473446-f351-4b23-a40c-bf781e364d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764240032, "uuid": "b67607ed-54d4-4f34-8905-b4d7cce56784", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3d385b-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234468, "uuid": "76a6fd6c-0ce9-4cea-ad3c-b473251dd8a9", "comment": "Malware payload", "value": "26c5d1a89e05095a49df09c4d7af3077", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234468, "uuid": "7a21fa02-93db-4d81-93a7-eef809625e94", "comment": "Malware payload", "value": "bb0e5087d71b55eb9779dc9752075b40f36bf7b866d5e88f2eddd92d30586316", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234468, "uuid": "6b1940b3-1486-4685-8298-00055e14b83d", "comment": "Malware payload", "value": "5fe65952ffa6d490ecc90ba94ffb8e1b6e02974e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234468, "uuid": "b1464706-f7d9-4fb2-927d-4c93076a5c34", "comment": "Malware payload", "value": "8dfa742a81207544a53454a915c1982e5df67b41c59d1de7e7af83157724771006a118f65ce92506fce8ecb7353dd6c8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234468, "uuid": "cdf0664c-162d-403b-9c25-4f5f80826ccf", "value": "T14157335FF7A85A2EC83301320D9A0235669B8E02F753970B6958362979B7DD84F07BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234468, "uuid": "1e8743fe-a20d-4574-8cfc-4ab58b622e3b", "value": "786432:gGQg8ZihdWZc/3RDoSWDacM3jiEio1HW5NspO:fl6SOacMziEH125B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234468, "uuid": "628c1a9e-cacc-4973-8f1f-a09b46b404df", "value": 27641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234468, "uuid": "47c8d799-f7b9-4aee-9b17-4a0fa0daf25b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234468, "uuid": "918709ce-9d77-4960-b251-ff2f7c7c76da", "value": "girlg1547-20251127-v245-1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c204360-cbba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764266252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266252, "uuid": "1c1f7e32-bfd0-4a16-90d4-afe5331467fb", "comment": "Malware payload", "value": "9c54d5d8d3e7958bffc791eeee899821", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266252, "uuid": "fe865cc5-69b5-4a38-a51f-b0866685b888", "comment": "Malware payload", "value": "bb154353e5a28259c854d3cc5f7034e5a74e0c05ed449fdfe11db9756254819a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266252, "uuid": "3fb76f5c-cae2-4b99-99aa-5f5ca78dcee7", "comment": "Malware payload", "value": "75de4c0ea7e54ef8279b857899c1fa79169cba37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266252, "uuid": "b96d9f00-6997-4aab-acb2-3067fa1532a4", "comment": "Malware payload", "value": "8bfa29413022ca0e4177119bba22f35f9112b7056912d3e262f82922a3e40b8ead8c8761761d0bca22fc301c22ce53fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266252, "uuid": "4da760cd-fef8-43cc-aa2b-8ff05e1008d5", "value": "T1C1014EACD1EC9F5008F5C686B1F84249C491808751F467D5F34E09166F28EDD7C9320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266252, "uuid": "6f83b7fa-470b-4289-baee-43b6d7ad94f2", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+rDjInkV9G01lkV9G0F70/GrZhG+E6:FH8j/wWi2jz3XIkV9/1SV9/R0/GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266252, "uuid": "60479efd-4c15-49e2-a415-963671232b96", "value": 722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266252, "uuid": "5bf34cbc-60f6-43e1-8dfb-ec33e5f0381f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266252, "uuid": "6a215286-2d44-469a-8e0b-bc45cfb67623", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39748a0e-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236907, "uuid": "46659c42-c419-4e20-a34d-6245580f42b6", "comment": "Malware payload (Mirai)", "value": "89efde1e3dff3da64f6ab9c509b9d112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236907, "uuid": "e2419efd-d100-4c96-9ebe-b10e7f25d17d", "comment": "Malware payload (Mirai)", "value": "bba016c21e2f6983724af374975f5912f495c011fa6ccac405248578e0c16b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236907, "uuid": "6d68c1b9-60d1-46f1-b373-85de686c21b5", "comment": "Malware payload (Mirai)", "value": "083e947727b4e90a2cacd577c23387d770642bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236907, "uuid": "4e988b30-196e-4e48-af10-1c0294c83ec6", "comment": "Malware payload (Mirai)", "value": "cffc5f2017a913c1fd64b520cefbb41bc8347d2ab6918f850004df94f4fc356b6f95c390898187846778e8ccce11cf40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236907, "uuid": "969a395b-a0cb-4725-9edb-e5a98dd10b66", "value": "T140B3494273180F57C19749B02E3F17F687BEE5E121E0BA89650EDB5A8275E37244AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236907, "uuid": "d763370a-80db-4357-8212-1588a4241fc8", "value": "1536:gHXylSpMEscMYse9k1hi8pRbKLvYnAXVKDY9r+JuUqtBxHV/tE:8Xygpusk14+blW9+uVTtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236907, "uuid": "7d2af6f6-c39b-45cd-96b2-c45f62cb2557", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236907, "uuid": "f67e9b68-ed00-4b31-b0ff-2487c07b7ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236907, "uuid": "dc2cf3a7-a77c-4a9e-9895-ab6fd7a8268c", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f9ed38-cbca-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764273308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273308, "uuid": "87a0d89d-cd73-47e0-b230-40d932156072", "comment": "Malware payload (Adware.Techsnab)", "value": "b8e360d82fc81f965b86068fd1b3b6b0", "object_relation": "md5", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273308, "uuid": "ab13e3e0-3e11-444b-8ec6-f75443a3200c", "comment": "Malware payload (Adware.Techsnab)", "value": "bc1fa015aa74867106d492f22954e32890cfca1b8f2d01439d013a19b3e7c118", "object_relation": "sha256", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273308, "uuid": "075d1f41-2f27-4691-a01e-f968bd774110", "comment": "Malware payload (Adware.Techsnab)", "value": "5094322dd9ab36256863c856fa9ca305a5ce29c7", "object_relation": "sha1", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273308, "uuid": "e4c6ea57-aa0a-4cb3-8958-694b43e228dd", "comment": "Malware payload (Adware.Techsnab)", "value": "2be076e88b34f7b582bc2c25e6ece35c13c64327c9c33e52742cf228cbbf53065bb7642794dfc5a10a22002f64533f55", "object_relation": "sha3-384", "Tag": [ { "name": "178-17-58-96", "colour": "#266FCB", "exportable": true, "hide_tag": false }, { "name": "46-62-239-122", "colour": "#D3C09F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273308, "uuid": "c5dcb604-39b0-48c0-8f4e-ab18768c3ded", "value": "T10DE42926ED875CA387D3DA63D1E3D20CBE6894EC800B5EC0B5B9C6865870D6D0B89F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273308, "uuid": "77ac7f6e-ba8a-425f-9402-1bcee6685282", "value": "6144:NfUfaMTYnKuxsuTCkp081R6njWeGlN36Sx/1i1zj/Y8ayUG3l7SP0aiAa3AoA72h:FUf3cHxj0gRNHYSx/QfB3oP0aiZw57K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273308, "uuid": "3f35d6c1-f8b2-44fb-abdb-77b8c22dccbf", "value": 663543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273308, "uuid": "1210732a-182b-4ac7-abab-54940f0deb35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273308, "uuid": "40615050-b11b-4205-b6b2-4b43c6e062cb", "value": "app_permissions.json.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878c62a2-cbbd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764267533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267533, "uuid": "98950f32-12b5-48f7-8a22-117b41622848", "comment": "Malware payload", "value": "c7663059e1250b511f47b2446ffde7ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267533, "uuid": "6d16a053-0a0d-4ccc-85b0-d3c73301aeb5", "comment": "Malware payload", "value": "bdd28d360622075860a3beb84c9200845beb444c8b41fcdef10a131b378b6ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267533, "uuid": "be363b0b-b37f-467b-9276-8ab39d4ef885", "comment": "Malware payload", "value": "4bb935d66acf3f54f7cba91e1b94985899732e46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267533, "uuid": "0d81ee67-bac3-42a3-adfd-808b0bd7406a", "comment": "Malware payload", "value": "84b77f50c87f8043b3bb844cffe19cf636fe2c693d9c4187be02aa6995ceadf83346a34db33b2ce3683dc9048de65247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267533, "uuid": "0ca173e2-0f1a-4d11-8aeb-d68fd70db6fa", "value": "T1A173B449BB654FF7DC5FCD3B09BA5B0424DC950A22A83B397934E818F64B24F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267533, "uuid": "7982b79a-5db0-42fa-8e3e-53617e1bd2b4", "value": "1536:73X44HKuI8MfowgeW5OGJlonWCiJdMCuJ2svug7R:73IfuIbf9gHFlX0vug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267533, "uuid": "0db15b81-e400-4690-81d3-3b14b1ef0760", "value": 80476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267533, "uuid": "8e52fcf4-a9bb-46de-a7c1-2af432762f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267533, "uuid": "70bdd020-1d90-4b33-bb9b-237b9e773d3c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cbdc4f-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223661, "uuid": "4dd85268-24b8-4064-82a4-6b68e42592fb", "comment": "Malware payload (Mirai)", "value": "f52b3ec73f18ebf888d8c7d6e6c921c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223661, "uuid": "52514215-0d50-45ca-b040-1feadf0d3411", "comment": "Malware payload (Mirai)", "value": "beda42a325aa7742b12c4c19478e42092d7c42ea0373324926a259640c7d17d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223661, "uuid": "4fab802f-bcad-40fd-ba7a-2d29bd7911b2", "comment": "Malware payload (Mirai)", "value": "c8c8c8a2380c199480831ee75671ecb1f0bae51f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223661, "uuid": "35e17ea3-96b0-46b7-b3ce-e53448ee9c38", "comment": "Malware payload (Mirai)", "value": "50c850a915023690cbe894d7d28a06874a8a0684da62e670db8df19d386db0a9b142c82f12ecb70f705cb3f1c75e4a6f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223661, "uuid": "3384f32c-a99b-4991-ab43-3124d2bb6664", "value": "T1461137DD7799D803EF2D4EC8B079844AB68981D0BB760A44F27D44F658DE3093268B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223661, "uuid": "71986a77-ed4d-40db-bea1-1f9725c12c0f", "value": "12:3J3ZlQ7sVQXNIOOAQ8NK4HQ2EQCQdTDkwQ1sHQmKAQBvHQjcAQvHAUR:3J3ZUNIoKOTDkO2U6HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223661, "uuid": "7e9e3495-3404-45d7-a005-aff561608f32", "value": 1018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223661, "uuid": "17d13b40-c8fe-4f12-be4d-913cf11d830d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223661, "uuid": "55a91008-6f78-437f-9b14-ac5ceadde682", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c3f35e-cba0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764255099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255099, "uuid": "07d78669-e4ce-4371-8017-3f66b79704d3", "comment": "Malware payload", "value": "c2df23bf993e7df6f7453b59fe1524f1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255099, "uuid": "5e914f3f-8b0e-4a31-b9b3-61e33694d467", "comment": "Malware payload", "value": "bf3ea59dbb85d4b744778b752e2154ed6392e88d96846d42e45c2383bddbd7ee", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255099, "uuid": "90513c95-238f-47be-90b8-4818b4624f3f", "comment": "Malware payload", "value": "23e044b1fd22448d89769ff230db760837124e94", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764255099, "uuid": "3a4e2934-34f3-4ac8-9115-686933666ee4", "comment": "Malware payload", "value": "05c8761dcc9fcbe9d9778b680bd3118393d8ec5403d385a3e7329d8d4a84ef24e46b2ffa160ff2e63b58f3163d270a11", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255099, "uuid": "6b22128a-ef76-4433-952e-393691cd627f", "value": "T17C5507B96551D255FE3880B940F6865EB220713286712BFB0160D263EF1B6F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255099, "uuid": "62bde3e9-54a1-4d69-aa0b-95cb9671a6c9", "value": "5e3631c569a217cf469245edaaa125d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255099, "uuid": "f2c0dff4-8efd-454d-b33f-a298c5fbaa39", "value": "24576:WdiCGvBxNvYYh3TBv29aajsGNwans6JuYdGo/migY3FY0Bmdy3SEII4kPKCw48vm:WQAe3TBvnSaYdx3LQyFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764255099, "uuid": "075e4297-e91e-4322-ba12-404f060471bc", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764255099, "uuid": "5b298594-540a-4369-89c3-93a7b3227959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764255099, "uuid": "ffb6f7f9-d960-4e0a-b1fe-f099a73a9450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7212010-cbdc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764281034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281034, "uuid": "2542fe70-66bf-4087-9657-9dfeacc1f389", "comment": "Malware payload", "value": "c3e6800caf0a360d9f55db3840f62fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281034, "uuid": "526e4c5a-2593-4309-a9c5-a0a9a1bbefdd", "comment": "Malware payload", "value": "bfc39c390d9e4865af342214b7c0a39d0467a149dd20d9b8f386dfdcc66a9535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281034, "uuid": "4aea3e3f-f450-4881-88ec-90f4e6e91465", "comment": "Malware payload", "value": "a74e4a943fc4718ae4e328d8d278ff2118177d04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281034, "uuid": "0eda5b7e-ed11-456a-8e9b-072785b80f92", "comment": "Malware payload", "value": "54d095b21205c6c9e2df774b3de6c7c4f10ce12e0c24ee6c418c1dc383e16cf93993d8238039e65439625449b93f01f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281034, "uuid": "144ce0af-3b53-4a3c-9d5d-89a2352be2a2", "value": "T10F1302F4DF098776C0C4063E4E8538FD8220E3431A4F294B6F22FDAA6476EE529353A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281034, "uuid": "3f556275-299e-4e86-94d3-a104434904cb", "value": "768:+/5K9oUul1hQCqTZeD3h9A2kHsK60ZkGe1lMeVxmaPu9uqENemE2Ukx8ZYIjQTS0:k5NUumCw0hWHrXZ5IMUmcuIqENemE2Fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764281034, "uuid": "37ca3a5a-7ce5-4492-a046-9e989d47d440", "value": 45444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764281034, "uuid": "a0f13199-9891-4170-a13d-558f91b502dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281034, "uuid": "22511f3d-9640-432b-8508-4951dddaee66", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ccbabc-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223778, "uuid": "0cc0bc01-197d-423c-8c91-8c3b0f2fd110", "comment": "Malware payload (Mirai)", "value": "d0165039a52240b60d3b5c2a46a63ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223778, "uuid": "39ff2da6-ec73-46d5-aaad-a9b6c8b8c0da", "comment": "Malware payload (Mirai)", "value": "c128929f4a97f3f8815b493eceaa640a9fa22cdbf80b19f2476e3b266180a6d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223778, "uuid": "b563663c-163c-4d17-949b-7544fb89c84c", "comment": "Malware payload (Mirai)", "value": "35101ce349b5a5a83a7ecf19fda1c5aa2ecf1e45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223778, "uuid": "8c434b53-d928-4a4b-ad48-be0cccc148ff", "comment": "Malware payload (Mirai)", "value": "dbcb6bf6fe6bb346a9ef245c6b10626b1e6fd032da15e1987f27102aee2c82cc81b64a9d54670327d38302ad23b4d5c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223778, "uuid": "f8a27206-2f20-4ef5-baa8-77e61fd95c26", "value": "T125C2E1A1E1B62E85FB7A7E502B78C2C177A04E9FB777CCD2255CAF0804A72174705AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223778, "uuid": "7d83a821-1a70-4814-989e-af2d3c279fa7", "value": "768:AG959yM0HWubJsWDYcGIg54uVcqgw09S0I:OM0HRJswYcGr54u+qgw09S0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223778, "uuid": "f1ef2a73-451b-4638-94ba-24a63be9dd10", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223778, "uuid": "d020e2e2-7673-4142-be45-f34b7ac5cf63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223778, "uuid": "2fa4e613-cf95-4388-8e0b-33582ebcf89a", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5ae04e-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257426, "uuid": "0aaafa1b-8a1a-4d33-9cd8-d01ad5c7904f", "comment": "Malware payload (Mirai)", "value": "46458004f90e3945cc9b1c7b57a4ecee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257426, "uuid": "b331e577-6fd2-4cd9-98a7-c783ec507d59", "comment": "Malware payload (Mirai)", "value": "c13f5c8a973debdea447e95009980602f4703dbec4d670d9b54f0b0edab1fdcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257426, "uuid": "9673f952-ea73-4a6f-9b89-bdb78e27aabb", "comment": "Malware payload (Mirai)", "value": "5fd7402396a2ee1ce76e982a37f74a617d408998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257426, "uuid": "7eb3944c-d580-49a6-a37d-4a5d97ee8a1d", "comment": "Malware payload (Mirai)", "value": "f98b5a31648e128fca0b2bb41a1ce1507ea56075d751fd8809a4e0ecfbffd6cb80b5ebafd9c125b157909f856a6a2b77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257426, "uuid": "29f25fae-ff04-42fc-995f-70fc228bc092", "value": "T1C9E3E70EAE358F7DFB99C23447B78E25965823C627D1C581D2ADE6011E6038F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257426, "uuid": "dd92ceed-ce76-4d39-acbb-36434002ccbd", "value": "3072:jtRKxKYZt4wY6bludObqRSQ81QywJMQXb22rP/UXan1mKJ1x3C8pepHg/MjDhQis:RRKxKYZt4wY6bludObqRSQ81QywJMQXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257426, "uuid": "d80ee2f5-5f84-43e8-a725-41c0edf9f61f", "value": 144700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257426, "uuid": "87d2737a-6168-4d66-91f3-c01b1fc8f176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257426, "uuid": "f681ae8f-92cb-48d6-9910-a88861286892", "value": "SecuriteInfo.com.Linux.Siggen.9999.28447.25832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e066d156-cb93-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764249643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249643, "uuid": "b25a7a34-02d0-4ea5-80be-a91718c60764", "comment": "Malware payload (MassLogger)", "value": "aeb7d5dc262a7bdeb1d45d148664b89c", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249643, "uuid": "283f4c19-d88d-4965-b084-4fa618372ad6", "comment": "Malware payload (MassLogger)", "value": "c4701d1b7ec4e4e0b4e15e896f9fd0e05e26f329e19cfd446ceb5035b6877c4c", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249643, "uuid": "c7a4e10c-7f75-4f55-867f-61d729e7649a", "comment": "Malware payload (MassLogger)", "value": "3bf11f18f7bedf513dd692bb410d826fc032869c", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249643, "uuid": "cc257189-2100-4d49-9363-484ae7f1748f", "comment": "Malware payload (MassLogger)", "value": "355d03e7c25247cefc9337b858022a6124eaa75d52bda4b86cc23616cede7ce695ec97973d62d3cb0285c4632e72018b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249643, "uuid": "36ceed66-7f28-44e5-a860-9c2b2d9fe690", "value": "T1D055F14E5061ADD2A000FEF0F541AFA7CCDB5394122746121FE568AD6322D83FFAB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249643, "uuid": "109f6d61-60da-4d5a-8203-94c2763a445e", "value": "6144:dJJGxKZGa4Wdad3JZ/7zRcfuo/cUcsc6YeqMHBiX1intZmP7XK/nda8MnPH2eEwC:sEhM7Nre7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249643, "uuid": "496ae9a2-1ca3-4edd-82be-e1bc480a20b2", "value": 1293052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249643, "uuid": "399b89f3-8027-4606-86e7-9ff336591076", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249643, "uuid": "a68513dc-83ee-4720-af72-caf75eb911be", "value": "e-dekont.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b23f10f-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241635, "uuid": "c38e39b5-8e20-48cb-84ca-31ec1813c908", "comment": "Malware payload (Mirai)", "value": "2364d2129e93a54ced0f1cc9507c7375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241635, "uuid": "7518923f-ff40-45b5-9895-bee60bbebeb7", "comment": "Malware payload (Mirai)", "value": "c7cc5a1a3031623bceb863952c9d41811c44265f739d91f98a6d77f1da3a2adf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241635, "uuid": "a22c72bc-d46e-4a72-aaff-fee897fc09e8", "comment": "Malware payload (Mirai)", "value": "28fa03b071f10e6d879c9f7fd2a63349552c85ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241635, "uuid": "8497453a-df12-48f8-bd67-39d1a6edc9d4", "comment": "Malware payload (Mirai)", "value": "a6ff25398f087cb2c9865bbbe9f4ddbf6a2e4264cd78cfb73e22bda50a796b40671f7e3208bc166c81144e603ccee9d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241635, "uuid": "ca8bb23a-3426-4628-aa36-ae66ab320b84", "value": "T18C24B70E6F229F7DF7A887344BB39A64975923D627E1D585D1ECC2011F2029E241FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241635, "uuid": "7d129cee-3c86-4ae6-afa0-1454dbb13ffa", "value": "6144:++iQKZtFamD2+/lWg5wKBFAMdAL+y0gjXy:X3mFBFPgby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241635, "uuid": "ec053939-5ebf-4e1c-826a-0fa583a646b6", "value": 223128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241635, "uuid": "cd5127c2-baf4-4b9d-911a-39c2bb81ed8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241635, "uuid": "44ecd849-85cf-4a29-ab49-5b5f5c173325", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770f42e1-cbdb-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764280390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280390, "uuid": "1893e36f-9023-49d8-a646-bf8e119a5af3", "comment": "Malware payload (Stealc)", "value": "86968d440c1ba256dfb4e0ad7a0750f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280390, "uuid": "09d321d1-b0d4-4893-9537-7f5d25c4f49a", "comment": "Malware payload (Stealc)", "value": "c8e07a108c54666e7dc4094653eb81fea59d2c785a5f7ae862b0ad536f6b710a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280390, "uuid": "15fd7ba3-4c62-43df-82af-b22854c0cba2", "comment": "Malware payload (Stealc)", "value": "a458500bccd7da533ac88b17964ec67b209b1588", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764280390, "uuid": "5c74048f-a479-4a2c-9711-5d7d3bfdf9f4", "comment": "Malware payload (Stealc)", "value": "05c3852516dbb64b29d507ab18d2e5099bdbf621f8874c62b3a11055927d37fbf73d7387583c3286cd8db8f760c691d2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280390, "uuid": "fef089b5-cd1f-402e-89c0-d5d271baef4d", "value": "T121E47C5AE7E603F8D0ABC278CA424542E7B2B8455770979F03E14AB62F376905D3FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280390, "uuid": "c57f42ee-7990-4213-bf04-7e1304f743e9", "value": "214ea1d248da32197483df15f940a05d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280390, "uuid": "31705067-a898-4946-958a-933b3e1817ea", "value": "12288:SahVHeIz95fPy1vOB2/v85l3Uvpv3YZtF15kjHt:Syp5Hy1vK2H8DEvh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764280390, "uuid": "8fd45206-b15d-4feb-967c-15f25b595757", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764280390, "uuid": "f890beb6-0895-49db-a4aa-bbfae164585f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764280390, "uuid": "d519a8a8-5218-41b5-b755-bb103d993980", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356008ea-cb8a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764245490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245490, "uuid": "4e28ab0e-bb7f-4658-81e9-5ae539e534fe", "comment": "Malware payload", "value": "b984c9b540b0bbc0a683bf4d3cf7e080", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245490, "uuid": "e5ce8163-797e-4bf5-8999-8c08b430222f", "comment": "Malware payload", "value": "cb119676a7e742eac0d01745de321bc3876991ccbf9ae97184597210a762ca38", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245490, "uuid": "60507a3a-cd88-451e-ad5c-da80e1c56f1a", "comment": "Malware payload", "value": "130d830752e9cbdb60cbed3d792c30d6641bad0d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245490, "uuid": "6a030c36-13fd-404c-b846-099642c55fb2", "comment": "Malware payload", "value": "0b82a42907292e81bfd5a8eb6f592dc19a71a5f5aa795a571dfbbbace82678f0fb9470d5199e4421ee75c8203d389745", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245490, "uuid": "e678acaa-cbdf-4d66-997c-e724b09b0631", "value": "T1CC7366584DCBD4EC9927B8944AFF5C02F7F5C503011CD996BA9DA9E0BF0382DA2B85E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245490, "uuid": "c06bfc34-f793-4e7f-8c95-c7b4c198c52a", "value": "768:GN/YBBWLpPeh59TbT1NWJi/TrASJ5HLq0yc/sVgK7XJc3UFgTgU6Quq6L/IDnKTL:GN/7i/TrAe/6X2g/qXN3e3kL6j2Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764245490, "uuid": "3124fc35-20c0-46bc-94c7-786e7d7f66a3", "value": 77124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764245490, "uuid": "babf3e17-0c09-487a-9c31-ffbc90c2d72d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245490, "uuid": "b298daf7-81a2-475f-88cd-7000c7fd913a", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c762711-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234470, "uuid": "edb06b7f-ddee-44a5-a127-a162eca2b3db", "comment": "Malware payload", "value": "6bf8bad43e0897ea28515190f4bc6aef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234470, "uuid": "bf918a0e-3a70-4c06-b1fd-5bf60e0b0188", "comment": "Malware payload", "value": "cba0da5089c970b8da0613486ea88e90322eb4659474188a71f0c4bbd1fb1b19", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234470, "uuid": "1336802c-2ff9-44ae-b62e-348224bd1e07", "comment": "Malware payload", "value": "b25b8c659114aa247815245d56a682a904d679fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234470, "uuid": "8e9ed4fe-2d1b-497d-80bd-3398aa660c30", "comment": "Malware payload", "value": "2d6520de46f978183856def3cbd3a5f39100db384efa40accbb5298faadc582deff297005ce65eaf4f30ffcbbf3e62d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234470, "uuid": "f3743c85-47f5-4bd2-ae61-e8f2e01857e3", "value": "T17F142368A039C69AEDD4700D4B1550D9E25AF2379C59F381E2C38366FBF285D9C02A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234470, "uuid": "3feb893e-d7eb-49d8-8c4b-c425049892ba", "value": "6144:WnWGQRejly4GYl5XzT3mKRatV+5pQSIxJhaio645i:Wn7QReQ435jTWAaP+nzoaio6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234470, "uuid": "613376db-2575-4482-8ddd-b02e718f8ff4", "value": 205869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234470, "uuid": "00d98f1d-7d0a-4e4e-9b91-1bcb3d5c02fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234470, "uuid": "57a8238d-a7bf-4a19-ac40-62b3c2c1edad", "value": "mudtime.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83479e9c-cb3e-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764212979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764212979, "uuid": "8683e439-b87d-42cf-97e2-a34bb710a58f", "comment": "Malware payload (DarkTortilla)", "value": "fc2ae0b717c99fc84195eb2ad2bd24e2", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764212979, "uuid": "c6dd8158-a59d-4541-ae00-583920f1518b", "comment": "Malware payload (DarkTortilla)", "value": "cdefe4487062cf4feeee912c4842224c9f9ee066574205d31efa87aee71f2073", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764212979, "uuid": "38f0668d-67f8-4723-8524-2eeb31749034", "comment": "Malware payload (DarkTortilla)", "value": "4788ac87473bd247b4cabe68d67d2e5ba32b6936", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764212979, "uuid": "577f4c56-6c7a-4b53-baee-950107ee877f", "comment": "Malware payload (DarkTortilla)", "value": "9d692147ea00c6db0b248b73c028958962e4a8f9382ea96e4c1699551880b7f87351aa50644f0cb4f7ef931d6ac75f58", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764212979, "uuid": "27d1546f-611d-40f3-9968-7e9eb9cacdd1", "value": "T1E8B47C5833E99B44E17F97348A764A0047F2BD03CE32C79FA5562CEDAB6678055233A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764212979, "uuid": "dfc84fca-e323-4c46-ba8d-a5af1447c6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764212979, "uuid": "1894d31f-9f9f-406f-992c-75659e0b430c", "value": "6144:4gYV1lh5pIiZuorxte5gLJl512oJsDg5kGAM1c6E+1hKYTq8uqbmWAV6naLnyhfM:SV1l3zZjrx550omh69b2W8jytCU+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764212979, "uuid": "04196a44-ea89-4372-8467-a04547f81712", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764212979, "uuid": "159d5f78-fe95-4b64-aa7c-cbdab6971d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764212979, "uuid": "d79f056e-0f96-4a07-bb88-3b19d55eeb41", "value": "N\u00ba 2502268142.pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a725c877-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223777, "uuid": "d8fbab93-b241-40ca-8320-95049f2bc5e7", "comment": "Malware payload (Mirai)", "value": "2d108746248a773ccd4c97230aad5387", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223777, "uuid": "684ca361-d7e4-4e3c-9c2c-2cb4a99f4731", "comment": "Malware payload (Mirai)", "value": "d3274b6bb134326eb67d9d19b65387e67f55cb2e62b7dfdbc67f210d370884c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223777, "uuid": "2efd8277-7d65-4057-9bde-9f47d78ce326", "comment": "Malware payload (Mirai)", "value": "0d386d9a548956a37159aba1be901e1b11b7e0ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223777, "uuid": "756827c9-139c-4e5c-a684-2a95e3a6dab6", "comment": "Malware payload (Mirai)", "value": "af4b9f618a3c3ed9ab87ffb0bcd28cb5b4950c7a80c02c9b40b2cbbaa73779e736e2286f15a7cd8b601174839d929d1d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223777, "uuid": "f42a2081-2166-4154-a356-2643845894f0", "value": "T1D61100DD77559806DF294EC431798942A78E82D0BB3A0F48F6AD04E768DE709726CF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223777, "uuid": "2e2bd4a4-a959-4919-8027-67e8210220fb", "value": "12:sl+JsV+pNIOOA+yNK4H+cE+0+TTDkw+DsH+sKA+fvH+FcA+NHAUn:skNIsKyTDkuIGIxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223777, "uuid": "9509dc12-fb5f-4885-9ba4-edc1c898417b", "value": 1005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223777, "uuid": "7828f087-587b-48d1-95b9-abf5f0862ccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223777, "uuid": "e4fbf188-e2c5-4a58-9127-47a6cdf39b44", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557c9cfa-cb8c-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1764246403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246403, "uuid": "66f318c6-8c3a-47ed-8583-4309ff880c32", "comment": "Malware payload (RustyStealer)", "value": "b569a16bfa06be57b8902e291c6ac9ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HolyCat", "colour": "#3E6102", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246403, "uuid": "17fa87de-a06f-4acf-b35b-0611c532e8a9", "comment": "Malware payload (RustyStealer)", "value": "d42b4e9bd0c54df09c9c1925b7eb41f6a877963ededdd0dd463e3d16dfe6cd5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HolyCat", "colour": "#3E6102", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246403, "uuid": "a968d924-797f-4cec-aaa8-5e4518e59545", "comment": "Malware payload (RustyStealer)", "value": "5b6596b52612dfc2b81f892f14d9f2b7eea3bd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HolyCat", "colour": "#3E6102", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764246403, "uuid": "af285155-d810-4680-83b9-11cd51cea338", "comment": "Malware payload (RustyStealer)", "value": "61e43428803b0326a85a9d8645d6014c52c46016d3b0480e55f49e2e0fed8cf57f4487c8b465658e8f5524ceaeec2c2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HolyCat", "colour": "#3E6102", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246403, "uuid": "dbcb7d1d-1c3b-440d-a1f0-1a20f7ab67d0", "value": "T1D7668D03E6A419EDCA9FD638C58E9336FB353C894236EBEB0564D7352D12A829F1C714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246403, "uuid": "3c7a8956-e00b-48e0-a558-02ca27ded508", "value": "75159da4c2d1c6aa321aaa87bffc5a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246403, "uuid": "8616b50e-2946-464e-be8e-9965183ec6af", "value": "98304:OlEQxYuUFESkjTm98vjgdR6lHc7Nnva0Vn:OlEQ9jHji6lHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764246403, "uuid": "3c683e9d-d9c6-4d85-b7c8-9e0f2bff28da", "value": 6673440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764246403, "uuid": "d7d072a0-c04a-455c-9c8b-fd69eb47b16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764246403, "uuid": "75fa891b-ce82-4f92-b68c-abe704765a8f", "value": "holycat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4377b42e-cb25-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764202135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202135, "uuid": "d6815ade-d5e7-4979-bc0a-c59596edd748", "comment": "Malware payload (Mirai)", "value": "7e3ed0efe917292e086e1920baabd04f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202135, "uuid": "289671fb-2879-405f-860b-833304403605", "comment": "Malware payload (Mirai)", "value": "d508929946b9ae3d643d900983435230eedb2549b8d30690b516bd5a70ee67c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202135, "uuid": "ac7ecec4-815f-4362-81b9-1134af9fc81e", "comment": "Malware payload (Mirai)", "value": "54b1cf621326669ef26b266b38216fca8a5487b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764202135, "uuid": "3bc2a68f-0be4-4f01-a7bc-3d3355f8c190", "comment": "Malware payload (Mirai)", "value": "4e8c3f682480f1d0371cd11a08514677c83a4c013248feb8b29b2d71c368ae198cfdf1714df1abd3c6a224a5f3ec0da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202135, "uuid": "64c51b1f-43cd-413b-bed3-9c8faa8f4406", "value": "T144435CC4ED03E8F5DC4516761A77F3329632F0391069FA47D7A8EA73B847B11A50A28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202135, "uuid": "a765c4f4-c407-4303-8e70-3fc14413872d", "value": "1536:shBvns5zN9ULHsNrDvsAeTqZrhi2UlEhWx9EAzL75pkR:shBv8h9UTsNXEAeTqZc2nhOOAHlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764202135, "uuid": "ab49188c-e5d2-4e65-9e1f-f1a2fc0e0eff", "value": 55636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764202135, "uuid": "d0d2f272-4169-4ff9-b48f-c20799c6bb22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764202135, "uuid": "e7c3fbf1-5552-4946-8e98-182ce40d36d9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c9f1ef-cbe8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764285810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764285810, "uuid": "ba7bdd96-de9c-469d-b781-6a693343bd6c", "comment": "Malware payload", "value": "798af1e71e03aa4fc9fedd5d4ee3b67c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764285810, "uuid": "5ced0aad-e275-4839-875d-7df1852c5fc3", "comment": "Malware payload", "value": "d5d758133f8c4a5743c4f41b16e5074485a9f7bc3a5dc2f65305ac3d3aec2cd6", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764285810, "uuid": "0d506d34-38c6-447d-82dc-db9e1dde4591", "comment": "Malware payload", "value": "40a7ec984f3054597ff5bd32f00d884332bad5df", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764285810, "uuid": "b447d283-fc02-48c7-8eb9-1b4b4d78250a", "comment": "Malware payload", "value": "936fe0b6adc726d5780d9d9af1dd8d0408b1e87cf1c990eba6343bb6cff841041ad725e93b651dce26b8f17747643ff4", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764285810, "uuid": "a458a6b4-dad5-42c1-81b5-94def36a8f21", "value": "T11973854959CB84F8A6237479C9DF4C01F7E5C9030A6CD6D1FACEA9E02F2143A91F49E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764285810, "uuid": "2f1f69dc-427d-48d7-8dba-80161e844d32", "value": "768:LPWalAQbQ2qq8bHD4spfL0i1sJa8EIlFUwV+Iey/C/wvEdK2P98OiNPi3/GHt472:gH06/jdb98/Ni1Fk/URHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764285810, "uuid": "72ad5cd7-5dd5-46c5-8cf3-27a139010390", "value": 76173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764285810, "uuid": "484b65db-3b3d-4f11-89b5-31942b0d6bb2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764285810, "uuid": "02342015-f0be-4dde-aade-53a0ef8c0ea7", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae309be-cb9f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764254465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764254465, "uuid": "56ccf16c-5923-4472-a7b6-22a5458b760b", "comment": "Malware payload", "value": "30e3a3f80fd2975606475c81d915a83a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764254465, "uuid": "f27d8776-c518-46e3-a65a-f323fda4275d", "comment": "Malware payload", "value": "d715b4d0b2369038af30fdc7989394abb7608920c5672ffdb4fb1be64ab19b1e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764254465, "uuid": "3aa23e80-40b9-4394-918e-6ca55c8713e4", "comment": "Malware payload", "value": "307934a256d3318befa1cb25d24508e95d66452c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764254465, "uuid": "ac8f82c8-2f0a-4e69-8f2f-decd6733c6b9", "comment": "Malware payload", "value": "abc6b498237d967dbd7ddca0164a1115c724c6d3f725504fc03900733ebdb46b335b68bec07448d6be45c67d39847f80", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764254465, "uuid": "73cfb939-7c64-407f-9ddd-2ca76344b715", "value": "T187763345FD823952CE97233E798A43D99CB30CF909476224FF65720C2A763DED6862C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764254465, "uuid": "3a6e7532-0cba-4921-8f59-761670548e20", "value": "196608:5ArrEATAMZqyJWA/Mt/CLueyhCxsMPrFw8ED:arr5oyJNMt66zsxXzFw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764254465, "uuid": "921f889b-3cff-46a0-9a3a-e7df14a636ae", "value": 7233536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764254465, "uuid": "d331392b-50f3-4b15-9c16-0f6e5d78e711", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764254465, "uuid": "db4d2cf2-b188-446c-841c-4447cf786f9f", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea5f6ff-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234447, "uuid": "4e573571-de8e-4551-b7e5-7e68a75bf9e7", "comment": "Malware payload", "value": "1772eac5be0b215cb982b38b749b9e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234447, "uuid": "9ab6d682-4bdf-48ff-b462-72aecf3d1fbb", "comment": "Malware payload", "value": "d733c598df62dae156c7ea43eba97a49cb69503a56153eda9b7e899749a2903c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234447, "uuid": "cf7ef2d1-a7fd-4da1-98f0-6335b068f977", "comment": "Malware payload", "value": "edf753eda3fa9f936f036c94fb85fff732923b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234447, "uuid": "8b0d5cc1-3d60-4605-b0ee-ebe61c11bee7", "comment": "Malware payload", "value": "040530f21d7a6734f14e9ad0cb6312bf6126087f3273ae7e1a3c94bfc22f828a207ea8376252addcec275b2370a702e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234447, "uuid": "ef7581cd-e380-4af7-ac07-46f4d2c146a7", "value": "T194D4F12276E2C877C66221318EDD6BB6B1F6E7090F25488713C48B5E9B349E0D73927D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234447, "uuid": "f107af6c-976f-4d0b-ae73-e3f1d8ae6f18", "value": "eb0cbb54ca401e820f6974e6548a4451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234447, "uuid": "d37db05e-7b96-40b4-aa45-caeb4dc9e789", "value": "12288:Q6j1dEoLO166Bwd/a6DjskTeac0VKet632Q/KRJ9lcWTUYhjAbiSBRrYkga35N:QEOoLOBBwdC6DjshaCGS2QSZlc2UQx4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234447, "uuid": "c556a957-b7a4-44e4-8556-590343d7557e", "value": 646476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234447, "uuid": "84c6b137-4966-4326-9308-e7e8198d4ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234447, "uuid": "1b890e82-1977-4954-9311-5b2daf1707a4", "value": "NSI-SCRIPTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9624225-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764237149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237149, "uuid": "3ab52717-cf61-4475-9544-ffc7749b84c9", "comment": "Malware payload (Mirai)", "value": "f68447c7cc39534b1c320cd5a9587083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237149, "uuid": "5fbb6f2c-6f98-41f1-afda-389dcefac8ac", "comment": "Malware payload (Mirai)", "value": "d772d65c6b8aa2e2429e5d587a33079738b5b24123f8c4314b94aee90ad318c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237149, "uuid": "1fe9a6d8-e8c3-4de4-a6d8-24f5c23548ab", "comment": "Malware payload (Mirai)", "value": "f57f1ca5e11239b0c48a3a7379e7c646ef2f5fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764237149, "uuid": "d25221e8-c1e8-4728-8287-44a5df79fbd3", "comment": "Malware payload (Mirai)", "value": "960210a04eb3bad4d00212ad96cf779d9be2e6a2e715325588b00e98ae94d2841428656c60196477583cd4f70c22e402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237149, "uuid": "e9908282-6823-498b-ac84-8ab1d42c42b4", "value": "T1CDF33A02735C0807D1532EF02B3F6BE193EFD6A125E4F644654FAA8A91B2E72154AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237149, "uuid": "addc31ea-c499-49b1-969d-ebe73d2e1240", "value": "1536:U1OZ5+LUl8riIHoBZklC3QSPlxD76gv3+HWzZjo7s8ifpcVIkvAOhTuGpqE8hoqS:+S5LiipBeCXlxyE+CjoY8ixr5O3hyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764237149, "uuid": "15a927c8-ed3b-4b6d-825b-fbf2598a9774", "value": 170360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764237149, "uuid": "a7a443ec-21b0-47ce-abc9-f9e80d3df719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764237149, "uuid": "8d8d37d3-d02a-42e9-99a8-c546270b9351", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8045b9f2-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764234449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234449, "uuid": "3238f381-7d0f-4032-b84a-9934e6a0ed42", "comment": "Malware payload (AgentTesla)", "value": "c84e03d3408e2ac69506e96be863a7f4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234449, "uuid": "a9615a42-949d-44d6-a4e0-9d0cd26fabf8", "comment": "Malware payload (AgentTesla)", "value": "d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234449, "uuid": "e536575b-fef3-4668-941c-89cc5a0792cb", "comment": "Malware payload (AgentTesla)", "value": "5a0c5e0b942e5f059e8a9451c7de2c383624b9f5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234449, "uuid": "4447d5a6-e091-497c-8e9f-5732d3d0627e", "comment": "Malware payload (AgentTesla)", "value": "ff1fa7b8dd1018c17a48e87be0bf833a9e93c88a4368b38eab94276f4389194fe21fd913821b83dafbf6b2f6e9f78d8c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234449, "uuid": "e3c052a4-e782-4b8c-ae9e-bbb0b71b0e6a", "value": "T1FA913B5DEC066F2DE332E5F35A8929343D5202FD6DA29B57B53AE887E940544B827007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234449, "uuid": "8a97b467-f5a9-482a-80d5-bdffe999b9ec", "value": "96:iKPqeC3MR8nOpBwJjLgl3muJGmuSUkcUVFFKfu5Np0ZiDG:xyOR8Op2Pa2u1ubGFFsu5kZiDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234449, "uuid": "a11ccf25-d001-4490-b797-9af33a0798d7", "value": 4276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234449, "uuid": "1b0a7665-35e2-45fd-8fb3-d8c4336d8a2c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234449, "uuid": "05625592-a0a2-4bf6-ad4c-eb4fd3ba6fd4", "value": "Order_PSP_112625_ODP.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba87a3-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236920, "uuid": "622a1952-cb77-4ec6-bde7-9d60b9e30abc", "comment": "Malware payload (Mirai)", "value": "2f35cd061da5900053b07096a3a6929c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236920, "uuid": "87ea692a-ff06-48de-85cf-230ef2843da3", "comment": "Malware payload (Mirai)", "value": "db088377ad1ede93da796c4011696c4098a5d1865a7d50e84f838a4d14901a97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236920, "uuid": "fa4e10fe-1904-4163-bdd7-3d7605100207", "comment": "Malware payload (Mirai)", "value": "c3321d4d048a5fe914b27794066e8ac574997e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236920, "uuid": "43034158-4fe0-43ac-bad4-d382a364b2b6", "comment": "Malware payload (Mirai)", "value": "136efe9f0ce6a72667a455cb606c819a322ab5136be4dcec9ab203a956c0d556a2ae512547b2ba24e0b405d99de5a6ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236920, "uuid": "7f8e46a4-b632-4a9a-832c-4fca6d872fe3", "value": "T1AEA36CC6F643D8F9EC5605303132FB379FB2E5BA1129DA83D7A89A627C63601C406A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236920, "uuid": "d83d3f37-f97a-44b9-a5b1-f9ed2563f743", "value": "1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX13FvSr1pAm3Jn5wR54yfZLiaJf:FbhWbT+c+sxK2ml3Fvs1Z3vY5XiaJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236920, "uuid": "8b3606dc-afa2-4b15-94e4-51ed1d52ac92", "value": 100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236920, "uuid": "209ddfba-a92f-45fe-b897-46d0a9b73dd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236920, "uuid": "b3ea7192-1741-41a3-aebd-9e8dac73f8bd", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38b465b-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228522, "uuid": "702b6808-6ee9-4673-b035-6a55e4febf9b", "comment": "Malware payload (Mirai)", "value": "51636fa13a6139feed5085d03c565ead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228522, "uuid": "f409e9fc-dffe-455e-81a1-478843ae8e06", "comment": "Malware payload (Mirai)", "value": "db370a684aad0eb4d1866eded17ba314a9f1d7e3a643383bd56e89c38cd84f54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228522, "uuid": "270c2d4d-1112-4414-a1aa-f895321bfe62", "comment": "Malware payload (Mirai)", "value": "cbff411e257734b62070c005642f96987edab4a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228522, "uuid": "25a27f3a-9592-4706-8517-1fa8a10b34fa", "comment": "Malware payload (Mirai)", "value": "0072c383d455ffc23e46b0ce47d741d65fea0490f1bd11bd190611d6055eed1646c8b5fdf044abc1aa5873f2080f23d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228522, "uuid": "ce5785dc-62ad-487c-8eca-4fa66440cfc2", "value": "T11C53FA3A2B131F63C4CD017205F30336ABBAE65D38BE8B57E8A06D656F05A9434563ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228522, "uuid": "dc683a68-1982-49ad-9fa3-efae9fb284cc", "value": "768:2WQW5FoFZI88747InXFsWyWKLs9HAqAwPPO+EHt6DPKyT3Bpuxw:2RWW691dAwPzFizxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228522, "uuid": "52fc4227-5780-4041-a584-269be2311918", "value": 65537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228522, "uuid": "e82947a5-3367-4f1b-af60-398bc93a62b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228522, "uuid": "3dcd9225-52ac-4977-aad4-e5d99b841162", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646f6fe7-cb65-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764229678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229678, "uuid": "5852d3cb-9116-4b84-934d-9806ac11c915", "comment": "Malware payload", "value": "1c335be51fc637b50d41533f3bef2251", "object_relation": "md5", "Tag": [ { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229678, "uuid": "fcacba09-56ab-4348-b348-e514986a5fe3", "comment": "Malware payload", "value": "dbe909b6c6c03b4000d96de1f4b1bdd10eef8ef34876a648a00cd5ee7117bd31", "object_relation": "sha256", "Tag": [ { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229678, "uuid": "7c0cb4f4-ea05-412e-a99d-c32cf33d00f9", "comment": "Malware payload", "value": "ce414a048da1d518e5a14ad6568b748ba77353cd", "object_relation": "sha1", "Tag": [ { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229678, "uuid": "59693141-74da-4821-88ad-ac13c29d8fa1", "comment": "Malware payload", "value": "08bd330eb78aa6d9e78d9b507a8efff72f39f640288c195f2e4bce98fbe2b359db320654f353c78c6a5cfa816735a8ed", "object_relation": "sha3-384", "Tag": [ { "name": "www-mydropboxbackup-com", "colour": "#7EF3A9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229678, "uuid": "117d706d-628a-4771-8231-19fd72869659", "value": "T1F43523F6DE275D3819883E8002B31F3CE58B51765179D80E5B6AB4BDC87876831A878F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229678, "uuid": "09c051ae-9458-444d-ba8e-674fe6b7ae15", "value": "24576:tqq+0dnpWPCtZxwgRmeumDh4+Pd8tPp9Ktl1m0eQ/n:8Wd0CtFHbC+PUfSl1oQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229678, "uuid": "f14fad38-a91a-4102-8c16-15fdd6bca650", "value": 1088584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229678, "uuid": "76864670-c2e8-477c-90f8-86c8d4831adf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229678, "uuid": "d9514654-1827-4a07-b803-d7722d7fd834", "value": "OPS-VII-SIR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627a2b29-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223662, "uuid": "f57b880e-1202-4a84-9ee3-c154a2c911bd", "comment": "Malware payload (Mirai)", "value": "4e6aaa8389640a7b504bbcdd967f0168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223662, "uuid": "061dd367-9953-491e-aa71-d62378dc39b5", "comment": "Malware payload (Mirai)", "value": "dbeca5ada3abc231c4fb31bb77fdde97059c60965cb2313aee3d90aeabc6ce4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223662, "uuid": "fc1f84aa-bd05-41e1-86aa-ca731f4ca75e", "comment": "Malware payload (Mirai)", "value": "07ab4581921d6d426ecf3347e0d3ecd322a4f9c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223662, "uuid": "131c5b08-5ffd-43d8-bae0-e40ba13c2b10", "comment": "Malware payload (Mirai)", "value": "561710bb2dc1537551ac9cccf42839db7dae06608ca061c239aee6fef28e82c9a77bf4e37038ecbb0bf2492e5a758bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223662, "uuid": "07c7ec1a-96e1-4505-9180-3197e430012a", "value": "T18D732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223662, "uuid": "4bb64aa9-8e28-4dd1-8230-f6a66b760953", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WG:927jqCt8v3GI/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223662, "uuid": "41ca2ee6-85a8-418c-9b61-3fc7152e0832", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223662, "uuid": "69e5193c-cdcd-45fc-9a90-2226bc5f97f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223662, "uuid": "1473d7c1-7f1d-4b34-b279-3c81eaad3657", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6698f71-cbc9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272792, "uuid": "3bd48450-6891-42fb-929a-8bbabb9ef5fe", "comment": "Malware payload", "value": "67a30893737721f487c7c772d9aaa049", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272792, "uuid": "8dc2b00a-52a4-4a20-9efb-23aa6236d8e2", "comment": "Malware payload", "value": "dc9fe4d2bf2b3c822e8080ef5d4a616aa56089708c5281e00af5d5e881c75e50", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272792, "uuid": "c4eee68b-5e21-4f49-b8d9-5cfd4f5c92b3", "comment": "Malware payload", "value": "4390af3aea43c13c0f68e710916fe9ab059f8a9d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272792, "uuid": "0f39e951-ab7a-4b72-ad17-b209ad65043f", "comment": "Malware payload", "value": "7bc236f8fc3e9d0267b05b697eef0d88950c99d3bb997003fca560dfac87937ca02b799525a4e4954666add7935f696e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272792, "uuid": "f791d314-e9b1-4ce8-b57f-890c307898fc", "value": "T11835AF22E7805B8A7BCC498BE07C1A0F73F36B5AD5A270CC67832607746FD5E9538895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272792, "uuid": "9be767f2-f8ce-4dd0-a238-a44fde706320", "value": "12288:2HE6z/m42GTdP99mZLHcoWHJ3eQAwya2/gLU9KJKSP5ngF8V37:4eR0PLHoMoQUa2uxV37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272792, "uuid": "15a236b6-e88d-4eb1-b0a0-4e74590b1a04", "value": 1059716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272792, "uuid": "d83d95da-a8ea-4e69-b697-b630df6eddee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272792, "uuid": "b3e7e9b8-bca1-4102-b12a-93595b54917e", "value": "INVOICE-No9274.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cb5ce5-cbca-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1764273093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273093, "uuid": "16157bc3-b815-4b1b-85e0-3ad41f1e089f", "comment": "Malware payload (Adware.Techsnab)", "value": "78bbdd2ac20ba95da8442100e418cef4", "object_relation": "md5", "Tag": [ { "name": "185-39-19-139", "colour": "#299782", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273093, "uuid": "c7f6a116-412b-4046-b61f-458289e9d353", "comment": "Malware payload (Adware.Techsnab)", "value": "dcf644cac243ee8bdd51e08400b134650e4648fb1fae4af340f84b8cd10f303b", "object_relation": "sha256", "Tag": [ { "name": "185-39-19-139", "colour": "#299782", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273093, "uuid": "2a8a752a-fc09-4e6f-a79a-42bf30cb216a", "comment": "Malware payload (Adware.Techsnab)", "value": "17fca732c3a124118ef150c2a0f948fdae3b2be0", "object_relation": "sha1", "Tag": [ { "name": "185-39-19-139", "colour": "#299782", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273093, "uuid": "acce1e75-6ce1-46ae-a3df-9fe6e9e68548", "comment": "Malware payload (Adware.Techsnab)", "value": "dded20b557955e3f85ec795779167e2ae472d88c1e94405e45d7203e7b463a930830d178a1c8420752bf150ca3c04e75", "object_relation": "sha3-384", "Tag": [ { "name": "185-39-19-139", "colour": "#299782", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273093, "uuid": "deefb62c-d1b5-4177-9b26-2052728fd044", "value": "T14ED66D02250EA311FFC7DABB58982870BB44E996923E97D30F469D7A5C50CD42B3778E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273093, "uuid": "38d7826e-6a2b-4446-a08b-da0b7dcbaa8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273093, "uuid": "664ae21f-4a46-490c-8344-f8fd593e6702", "value": "49152:M034hpLOGjJPZM3nQ0sn9fLlYzsun/dVKBdV8q5L/BousYH5VrRtqKxa/vuL:P3aAaM3nQ049JYzsun/dVKH/D7qI0vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273093, "uuid": "dc79ee40-82ed-4175-b629-7600a52f9183", "value": 13458944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273093, "uuid": "7417922b-86dc-49a8-9d9a-bb8b09adffcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273093, "uuid": "3755dead-99f3-4f95-baf8-f1230cdd3863", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e5c188-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223664, "uuid": "908749c4-1e9e-45aa-8bd7-45d50b6539e6", "comment": "Malware payload (Mirai)", "value": "b84e1eaab0882ccbb0a7bfc9753644cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223664, "uuid": "9746f731-c278-4bb5-8691-8eac185edef5", "comment": "Malware payload (Mirai)", "value": "dd07be07cdf7ba84dd1833378cba9969bb4d061b9acda8fad334a9a6f120cf99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223664, "uuid": "029cb63c-acde-4b7a-a9e7-4f4691090dda", "comment": "Malware payload (Mirai)", "value": "0f120bf5444aae0e2b6f804c848b894a91cb1ae8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223664, "uuid": "0b10637f-f956-44c3-b307-0933ff7eeab0", "comment": "Malware payload (Mirai)", "value": "f9d0cc34a669c66ee9fd50d54806d42099bc1377535f3ce98f80ee11cd73f16463212cf089e5ecf2b71701e9b4f2b735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223664, "uuid": "97f7d7ad-e1ff-45f6-a482-6d7338d13b51", "value": "T178D2D0AEE5B541C5FD8D1C3E80CC3FA00E19E581631BDB9277228C8D5B36C56F1AA4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223664, "uuid": "05c78355-b5e7-4d3d-8575-fe7eda5352d6", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjHbRWGVCz0Nvc:8MYHb62x4ahQ3CfdwLj6W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223664, "uuid": "7eca58d4-4968-4793-9041-3f29085f4563", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223664, "uuid": "2d2a2cf2-ed5d-4014-a285-58aa5e3834df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223664, "uuid": "a6fe51db-acc9-4763-bbee-1669f3e2722d", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3549d49a-cbbc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764266965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266965, "uuid": "58fbbf5d-c9f9-40f1-bc5b-f9220d685194", "comment": "Malware payload", "value": "5de9fcbb59fde55fef58260518724af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266965, "uuid": "85187062-4a24-4b3b-972f-95e9961f7a06", "comment": "Malware payload", "value": "dd1fbe19c2231c6afdd466204dff44cc7e57c3285cadc8f3faf8610fed5ef5a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266965, "uuid": "577b54a2-b5d8-44ae-a9a1-f47b690d723a", "comment": "Malware payload", "value": "4a3c9e86dcd2df2fbe23ff80b9dbb1bb526de1c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764266965, "uuid": "81bbd949-6642-4a9c-a32f-134cb9613fb1", "comment": "Malware payload", "value": "1cc8c6b75a8424e3e04d0febd0531a9d4f5a84ee3f9b0def55321232a776d66c4f7b96dc903ef67bef9d112b414950e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266965, "uuid": "4b7460a6-76d0-4e61-a93b-0b87f53a7b1e", "value": "T156337B76CC6AEDD4C55856B8B8708A792B53F200D2532FF76A85C4A64047EACF64E3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266965, "uuid": "651f600c-0e92-455d-9a46-90fc370502b9", "value": "1536:5a6wt0p2p37cA9dqMAv6CKqBm2ytUKM5VHvZ+gCSOug7R:5lX2p379HqS8QyKiVx+gaug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764266965, "uuid": "1b715b77-494b-4385-8f7b-f847e80bc328", "value": 54952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764266965, "uuid": "61fffadd-5549-4785-be3e-6f85177605b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764266965, "uuid": "df1acf61-5092-40cc-9dbc-08b95e283f13", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c1401a-cbbc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764267268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267268, "uuid": "a8c3104a-c87d-450b-98ff-29197c40a0b6", "comment": "Malware payload (Mirai)", "value": "609b540316dcba436d73394bda0a0410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267268, "uuid": "47c5122d-6a07-4fea-96d1-53b80dcc9d0b", "comment": "Malware payload (Mirai)", "value": "e0b3ae0268d647b62df9b07d87e87f7d82a7e88d4584610598729fa583cfacd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267268, "uuid": "d2baa9a5-435c-40f7-93dc-c2c5296a7abe", "comment": "Malware payload (Mirai)", "value": "c7c82781a9e69732bc4bf4e23e625ca5ae8bac73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764267268, "uuid": "7b749106-1c80-4f09-af52-c0c171cafb92", "comment": "Malware payload (Mirai)", "value": "169eeeb5f2a50f69f0e57161064720d3a02360dfee92752f1453f42ee083e809ed5f5e91c2c2bacf23d7a3b3c159ec93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267268, "uuid": "37cbe098-1164-4ded-b3cb-04283cc0e815", "value": "T1C753F886BC819617C6D462BBFA5E42CD332623A8D1DF7203DD116F157B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267268, "uuid": "fe2d8559-96fb-4953-b429-7b4b6e23fdb6", "value": "1536:xwIKsUucfasSMTFzDE5Lyash9OMVtug7R:xwIKNTFHEhsHVtug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764267268, "uuid": "64be144d-3383-443d-a6f4-abab9fb3ef33", "value": 61344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764267268, "uuid": "1631ccf0-b0a1-4747-a9e8-2bcfb752b1c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764267268, "uuid": "63c40b23-8e97-40a4-9134-f49911844106", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bf33a1-cb6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764233220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764233220, "uuid": "979478f0-b0c0-434a-a111-578b80a56e08", "comment": "Malware payload (Socks5Systemz)", "value": "511955035b6fab68c51375327bd2aaea", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764233220, "uuid": "966dbd7d-268e-4571-8601-90f9521f681d", "comment": "Malware payload (Socks5Systemz)", "value": "e11128e86ea49d04d8e27e9301f40794491b406131c6f5f8809746c203bf648d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764233220, "uuid": "f2b8e4fe-8398-4bc7-a932-d893fe850ab5", "comment": "Malware payload (Socks5Systemz)", "value": "c0276fa387a8de457263ebbdee5382613723900c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764233220, "uuid": "07f46d19-4503-49cc-9e9d-68e24cc835c8", "comment": "Malware payload (Socks5Systemz)", "value": "1689f83d966a387bec697db6111f4ab77a9fd74650b13a7ff0031a8a403c95221cf0682d8c9291a469d2619d973927d4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764233220, "uuid": "abdbf0e3-e5f1-4fdc-8850-0995666aa8cc", "value": "T122163343E9C3C572C112E73386A49609743B1A8338795C097ADDABDCCF6DCD294899EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764233220, "uuid": "ea8f02a8-c25e-4ddd-bc0c-909b5f1b19d7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764233220, "uuid": "130ae42b-3a3d-44b6-be81-b5405e16bb5f", "value": "98304:MsixkCl+z/4gUqhthizFSb7+Lhd/vwLYiAoSKDzhXZHy1vM1ly:6xkCl+bALJMyP4LoMDzpZHsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764233220, "uuid": "c88113b6-f737-47ad-8911-cdfb3b4884d6", "value": 4101147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764233220, "uuid": "29f9f6c6-e394-44d2-b3ff-92b35e1013cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764233220, "uuid": "8f77b36c-769e-479c-90d5-3e1b5b550e3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b86e4-cbe6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764284963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284963, "uuid": "c63ff801-d915-48fd-b032-91cf5598b5d5", "comment": "Malware payload (Mirai)", "value": "48a037d4ce24bdfef271e9e4c2bf10ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284963, "uuid": "d0c65382-c5a1-4018-8c94-c766e433bafd", "comment": "Malware payload (Mirai)", "value": "e156f2721f43104c0d0026a65e95fee577a19e0d023524ecdb37cf07ea338b52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284963, "uuid": "ccf3b59d-172d-499a-94ca-f0adcdeec3b2", "comment": "Malware payload (Mirai)", "value": "03eee28ec0dc80868766f7b00ad44aca9e968a35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764284963, "uuid": "d5765a2e-8700-4b93-983d-49a4c8c5ba46", "comment": "Malware payload (Mirai)", "value": "c4af3de2759d2bea794e689287eab4062ee8df75983eef350f81e63dc1725e207d3494ce28bdd7f14262885fc2c81291", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284963, "uuid": "4a43d4b9-0b70-4b55-af2d-54d79cbe9e39", "value": "T11E435D42721C4A57D5964AB4293F1BE083BFAA6011E0B3C9B50FEB5A4675F336047F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284963, "uuid": "8ca804e3-9d37-4181-8cc6-1a20901d1cde", "value": "768:WMxHT4l/KFRp+IvPad3ruN6SgnbmA5P2KqzTVwnc2u5vOsGpmKe0ug7Rs:Xz4tCU36jYv5xhuJdGocug7Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764284963, "uuid": "f8cb3c11-0f24-4671-b1c8-26337fdcf681", "value": 59496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764284963, "uuid": "5d363cb5-7762-4250-ab8e-3177296d1ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764284963, "uuid": "04d66281-7720-4a1c-8691-01d209915fcf", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df769f79-cb94-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764250071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250071, "uuid": "43024a91-79e6-43c1-861f-34549ed15ac3", "comment": "Malware payload (XWorm)", "value": "96bdbe59b33ac3c44d229499a1711388", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250071, "uuid": "52b6eaaa-7e95-479d-946a-f838e279b6d4", "comment": "Malware payload (XWorm)", "value": "e15a79d8d25f62ea99a545d9ddbb3cca4691e1f3e006edfafa123a8fdd0eb682", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250071, "uuid": "72a135c5-d4c9-4100-939f-d019c19efb10", "comment": "Malware payload (XWorm)", "value": "4bd083900a78b5f0a0fee815e68b764f977c9f92", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764250071, "uuid": "b13a0484-6123-4190-8b69-cc792cdea67b", "comment": "Malware payload (XWorm)", "value": "d90c040081ed9b30830ceb4b0854074bd80758ed42036c6e10c7a74451c091a08e0df61601e95049c7528a8391823a96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250071, "uuid": "4e3e9681-fcd5-4a49-9fa1-d243232c7419", "value": "T1ACC43A60D924069A8F8B17E9FD991B72CABD8209462690F4F9DD034D62068FDD3FF325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250071, "uuid": "d929897f-b0d5-496f-9dd2-d9a9b19a22c1", "value": "6144:nYSYZYGpaSYGQ8YBYfjNYGiYGHQAYG7YGRYGhYGnYiYzYGXFYGw+YBn:YRGZTO7a8nZhd/hUt5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764250071, "uuid": "b880dd5a-3396-4d27-afe4-71421d3dd369", "value": 583786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764250071, "uuid": "6b7dde0c-efce-4daa-9274-5ada47d6209b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764250071, "uuid": "6c6b9b0c-1639-402e-b2d0-05e24b347451", "value": "fedex_tax_bill_document_receipt_payment_27_11_2025_000000000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5d0932-cb64-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1764229102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229102, "uuid": "87c24934-51cc-4bfd-8366-2e88d73e527e", "comment": "Malware payload (ValleyRAT)", "value": "cb030cb8d35043c3f28f519db2610d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229102, "uuid": "c49c8d48-104d-4998-8ae0-22926dd06b63", "comment": "Malware payload (ValleyRAT)", "value": "e45af7a978f1f1d1eb3045b4a723b991dbee82e4e907df46d9698ad149892d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229102, "uuid": "14692e53-afc6-4313-a8a1-0d7847e0457b", "comment": "Malware payload (ValleyRAT)", "value": "5f8ef1b3638b988742cc7bdc1fb48e2fc0e86cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764229102, "uuid": "9a98d315-fbf8-46c7-9ace-f2d3d028d59b", "comment": "Malware payload (ValleyRAT)", "value": "c384517f4d90af5118f8f7c20b713d4ef4c233928ff5333cf97a10ffd6b91a69bf6334a56ba7ffecd57f32b6025d9f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229102, "uuid": "89480476-b660-450d-a9b5-8f9ec8fb399e", "value": "T1A7B3D04295108473DCB61BB850772E0D6FA7EE2CB8F86607BB423955BA32382D53D46F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229102, "uuid": "949b4725-c145-40cc-a83b-ade3889bfc36", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229102, "uuid": "178e2d02-84e6-41b9-8803-7f41de04e33d", "value": "3072:psJY7SurwgsHszCeM5Mw5ihU2UwzCqBDwd438LFQTRyeGLy:pPKgceM5MhKwzzNAL8RyeGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764229102, "uuid": "5ed86e87-3c92-44ec-9b9f-750196f85327", "value": 113349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764229102, "uuid": "8d5f06e7-7cb8-4885-b050-63ed9f9b80eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764229102, "uuid": "8b216e0b-2bee-4fcd-ac15-e8603f61fe2d", "value": "SecuriteInfo.com.Win32.Evo-gen.31687846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c98252b-cb81-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764241637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241637, "uuid": "9d92a98a-eaea-41ff-a287-f1f86e8da725", "comment": "Malware payload (Mirai)", "value": "d7d1bf0a746f246dd31569a7b7ad3504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241637, "uuid": "1e84f5c0-47db-4369-a844-10afc119ca15", "comment": "Malware payload (Mirai)", "value": "e4d8a26035c3d9def8d538b79f505658a33ef0bc45ea975f13fbb43421e70a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241637, "uuid": "b96b1120-68a9-499e-908c-bcf6490e30bd", "comment": "Malware payload (Mirai)", "value": "4a69b8acc50fdf3f9a0fac0473cba8c0c82adb0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764241637, "uuid": "5d6bc8c7-24a7-4910-a0d3-629128e26855", "comment": "Malware payload (Mirai)", "value": "3e068ec053809899ac5dade8632700e24b1c1a64969c01e882fb76e9db023fa5eeb31d05cc068cd30e97c0c1fa5162ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241637, "uuid": "e90bcd9d-3a45-4c6a-88a2-b5171041fb33", "value": "T1FF043A06B8CCC4FDC896D0784BAEB136D831FC5D523C725B2784AE222E5FEA01B6D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241637, "uuid": "2d11e159-8706-41ae-b685-ea094d0908d5", "value": "3072:s/xaH2ZGRuFJG/owF40jKU/YeGANCgUmeYuwXGS2B4w61/CZZ:s/4H20cGwwKJ0Yvwh00CZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764241637, "uuid": "415b2089-58a9-49d3-b1e6-a33d539fff56", "value": 176328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764241637, "uuid": "9ea0c0c6-0fb0-46ef-940e-2cb5061635ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764241637, "uuid": "35699730-9669-47e7-9467-e5d24c9d1de0", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41deac82-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236922, "uuid": "87895bd8-8804-4f42-afaf-b31b0644e00d", "comment": "Malware payload (Mirai)", "value": "ad73c86a9b93f5ec87d8894067d28133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236922, "uuid": "b1f40020-f11d-4769-9295-c93b97645cf7", "comment": "Malware payload (Mirai)", "value": "e4eba2e970479067afaaefc9eafb8e270e8683e76786a88ae6bb081a252bff7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236922, "uuid": "b2d5a748-2242-46e8-ac3e-83a31ddef8c8", "comment": "Malware payload (Mirai)", "value": "dc4334689054a63bfb2596bb5971e406e71644a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236922, "uuid": "7c9533aa-2345-496c-ade8-35d0e1fdffa1", "comment": "Malware payload (Mirai)", "value": "ba31f08c655a423783b3b1cd76f94a4f54bac9e58481f09e0d9282aff30b5f12b420ed2af0da23835358ff60773fb8be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236922, "uuid": "bce6685f-2c90-4c44-a7e1-91c358811621", "value": "T197B34B03B9C29CFDC046C034477FB936D925F0EE2638B29B67F5AE266D0EE600B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236922, "uuid": "bb4eb747-06b7-40d1-a24a-1ec76e8e9697", "value": "3072:emvsrP1O2m3v9yg62bUQ55tGcLlumTThDygHEDEImC:emvsgv9yg62bUQboYTpHY/mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236922, "uuid": "ad7faed6-e2d6-4f8e-b3a5-b89ec7461ff4", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236922, "uuid": "5592342e-40fc-41ce-a80c-19800c905b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236922, "uuid": "8283d82c-3a01-4664-a02d-c047efa30b35", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43c48fb-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228523, "uuid": "c27a5445-f755-45b7-801d-35bd79d8ba34", "comment": "Malware payload (Mirai)", "value": "55664bed4eb23d3e805c794bac7b1785", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228523, "uuid": "d5a7af83-ea26-4f0d-b4f4-1959fb525b87", "comment": "Malware payload (Mirai)", "value": "e54f8e2e14d3344c7f7c7ccf607183d926a35aa234cbae75565dc9c95a86336d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228523, "uuid": "b9031c62-8b18-4a57-bdae-2fd6e10c019b", "comment": "Malware payload (Mirai)", "value": "234621bb5be4f58f5eed4c36e42d8f1749a4c38f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228523, "uuid": "b84b94a2-e3a0-4be2-97b7-3c365b29c7c9", "comment": "Malware payload (Mirai)", "value": "ef8a7de72936794941332eff2f352371843835c5e301917c2c5db1989ef5accce8f8afc9cafa363eb0873e11ff3e5d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228523, "uuid": "fa82ffe2-45bd-477b-b2b9-76663512ef51", "value": "T15D832A05E2109B5BC1D227BEFA8F425D33276B58A79B73125A286BB43FC17AD0D3C520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228523, "uuid": "7c0f8dd3-4cc5-404a-8056-81068c5674d7", "value": "1536:jjnq6c1wV0nIifOTIAWlUpogcPIlriidlH+UBAeHKo8Kq1QYxPlJWu71XHB:K6c1VmTIPePddlH+1eHKCoxnhXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228523, "uuid": "d3b45e71-47c9-4ba9-bc46-39ab0d41108e", "value": 81213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228523, "uuid": "7dc23b46-4571-4430-8bba-5f2acb492e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228523, "uuid": "fc792f21-1e5f-480d-a502-25d15be6c5c1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bbd6a1-cb44-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764215722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215722, "uuid": "2c0e3fcc-038d-44c2-86ba-3979ad7a132f", "comment": "Malware payload (Mirai)", "value": "508ee040550a2f58308faf20db6a1ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215722, "uuid": "82714f07-90b1-44c1-9469-b9231d334213", "comment": "Malware payload (Mirai)", "value": "e5c230e9d604558b53b1dda0700c632a6af704e4ee692732fa6c707c76ac0480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215722, "uuid": "ce3f145a-65a2-49e6-a918-1eb0d97b7d56", "comment": "Malware payload (Mirai)", "value": "e28971142c890ac51547423c38a1cc9d6c9b410b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764215722, "uuid": "8e46220c-d202-4c3e-b4de-1e373d330378", "comment": "Malware payload (Mirai)", "value": "8ab853d59fc69eed531614678b1d0ed1d6895863a6bcc0acb294673efcba4e4e8286b45ebc32b458581a32b9c09bc1ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215722, "uuid": "0e780143-bf52-40e4-a51f-487939b65c0b", "value": "T1E6936BC6FA83D0F2F85304B65037A3328732E539503AEE56D769D932EC629509A1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215722, "uuid": "979b40aa-cf63-4a86-854a-73d19132c704", "value": "1536:C2d5PkofdMS/mIv6vnuzgxJJ0CK5So03o51TG+URjirNTSmLSJ:CK5PkYdMBu62zVLko03o1T32y+kSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764215722, "uuid": "f8370db4-2cec-4694-9163-9b9dd87ae2d9", "value": 96488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764215722, "uuid": "af8e3b9b-7dfd-44b7-9b10-156d8b78fadf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764215722, "uuid": "95107a3f-4e98-4eae-8294-441f77896260", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c4966d-cbad-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764260450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764260450, "uuid": "d2457d8c-6203-4ef3-8adc-7d1eee377b39", "comment": "Malware payload (Mirai)", "value": "1084b03430de64785d8f144cd0b93c59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764260450, "uuid": "f1a4bff8-6a46-444f-98f7-951bd0260e75", "comment": "Malware payload (Mirai)", "value": "e7890dba3ac25071107dd86ead52efc021cce9d246b0fd928b03e6a5c5171d75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764260450, "uuid": "7ea2bd7c-f8d9-4b61-95f0-18e4e7672ad3", "comment": "Malware payload (Mirai)", "value": "9207e0c82606603f1fd9ede950faa5e08b3e374c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764260450, "uuid": "56fe669e-28f8-478d-9fa6-041e35243e17", "comment": "Malware payload (Mirai)", "value": "aee81ce2e977904ad27a3381021c05bc75cd1f9f9a2ff9f5f07894b0ef3a02c339ce75797dec27484fa59240adfbdda2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764260450, "uuid": "e75a120d-0c72-4282-9d3d-7b7755af0931", "value": "T1C6B31855F8C29A62C6C259BEFB1F828D372213A8E3EB7213DD145F2136C751B0E7A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764260450, "uuid": "423af1b9-cc4f-4563-81d5-f2ceccf9969e", "value": "3072:mUoDkdlx8LjQmnP0XcI/sHGgynQSr6yDvluA9FaGbBpLWBblDn5o:vYkdlxejQmnPHIXFQSNDvoFQpLWbldo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764260450, "uuid": "cd0586be-398b-4c04-8b1f-55e9467a7f19", "value": 109708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764260450, "uuid": "f82946b0-2abd-437b-8d65-3a93ae5a9902", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764260450, "uuid": "31a001a7-13ac-45db-a65a-0cb0e5be2d2b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a63aa3-cb91-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764248638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248638, "uuid": "8808d037-3320-4b22-9388-78780b3a7cc0", "comment": "Malware payload (Formbook)", "value": "c6265319bc946f1f95fcc5b71ed64ed0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248638, "uuid": "4e6e2211-b3b1-48da-a4da-9260f16dd9fb", "comment": "Malware payload (Formbook)", "value": "e7eee77f68481f6adf4a47961c73d831bae484c30efcf4afaefb4c33f155559a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248638, "uuid": "b6e809de-cc3b-4cd5-b18c-3df831b8f267", "comment": "Malware payload (Formbook)", "value": "4f7adcdd1e32275362de12f6646905d68a0cac91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764248638, "uuid": "691bde11-59d5-4a57-9173-e280c2c6babd", "comment": "Malware payload (Formbook)", "value": "4113c96ce3d61c5e60109ff5c5d79fcc246731ac10a274aa28d5d6adbbfa794dc52d610d5de5eb94533b14a0b3847305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248638, "uuid": "a8282b5c-1d90-41f5-8db5-d877a8edd0c3", "value": "T193F401182319C803D2A65F744972F3F86F785ED9E811D3038FEABECFBA7A5955904281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248638, "uuid": "c2330ea6-d6f9-4d93-b892-b1d42e0bd73f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248638, "uuid": "490fa0af-4424-47a5-b52d-42b7bd773df8", "value": "12288:qOPad9pTcsWW6+9c1RyK8yWLyNNJaCueM8S7VUuJpLzIF6sM+yGEZKv1Nfkzni0P:VPcTcsh9Wy4N4F7V7zIF3ldCWSn5vcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764248638, "uuid": "500b8c64-f09e-475a-ae0c-f97680188b50", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764248638, "uuid": "edc15d39-0984-42a0-ac0c-60cc4446a793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764248638, "uuid": "b116b328-25b8-4c88-877a-93e89c406bee", "value": "SecuriteInfo.com.Variant.Genie8DN.399.32560.25293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b01db8-cb7a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764238834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238834, "uuid": "817c0adc-a0fd-4abb-bbb4-41fbe9d7d2e8", "comment": "Malware payload (Mirai)", "value": "b4ab43fdd5f912417d94fbe9b9a5cc84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238834, "uuid": "c1ca38b2-0237-4385-ab08-784ab2b3ffce", "comment": "Malware payload (Mirai)", "value": "e9d22b72b559671e922f753a46f9faa49d8f3963a9c1f7647c085951acc2ef71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238834, "uuid": "c6e11f38-42b3-4100-afd3-80bb0e306c4e", "comment": "Malware payload (Mirai)", "value": "b08288efb922dd9518f937e8be13802ea4bcfee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764238834, "uuid": "3c3e0fae-90d3-4c9c-b636-c78a177279ec", "comment": "Malware payload (Mirai)", "value": "5ba20bc75c8624a7a1545d728ac5fcbd6ff3a7e1adc44160e1e22db2e990087bd07fc61093cc4991acea12b72824bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238834, "uuid": "1816a615-2265-4029-909c-2bee4c9a3c1c", "value": "T11CD3398CF68BC2F5D81748309076B3FFCB31B4254172C65ADF98AF35DA27582AA16358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238834, "uuid": "6c53c96e-3a35-4cd1-a134-b9c8ae54ba1e", "value": "1536:nobTFl9yrml5bck7aY0xInHbnwQKOKs4b9pTOuKW18TKLCVBXARZRWXvlMvdl:nobTFAGtc+L0WHrwpbrTZmO+VRAikdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764238834, "uuid": "80633789-905d-451a-9ae9-490401ceb558", "value": 136588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764238834, "uuid": "a146f755-bc3f-4107-a2cc-d78192ac3fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764238834, "uuid": "b0b10598-a8f8-4606-b789-34e33fec6dca", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b024b9-cb84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764242839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242839, "uuid": "5b9f85e0-f327-4a67-95a0-bc19cef5185d", "comment": "Malware payload (Mirai)", "value": "ae35499b738be1f4ee3e094f8b53fd76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242839, "uuid": "e670dc69-41cd-406a-b8b0-1ed4ac1e5fb7", "comment": "Malware payload (Mirai)", "value": "eaa47e0b74f7b9d7554e25e9ef40a35f2dc90d1198a89c8ad287456fe1a64584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242839, "uuid": "a3667210-8b07-4bc7-acd8-76975225dd6f", "comment": "Malware payload (Mirai)", "value": "6efeff5bbef8d77675d58c81e9c81696a5c65e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764242839, "uuid": "ec448e7f-3e47-4a0a-8f81-9a81960a81a2", "comment": "Malware payload (Mirai)", "value": "cd715f419980c8faef6967c0274fc4f82b4f1013dcc06c852af03cff6171463f9c370fc827e026e565201861b37f409f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242839, "uuid": "f6cb7825-776e-4572-8013-ff01d77ef6e4", "value": "T195C35BC5EA8FE0F5E81261316172B7269B72FC3A103EEB47C3A89A359C935C1D51A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242839, "uuid": "22540a2b-ae36-4d49-89d1-3058f8444e85", "value": "1536:GZq0fZAy+rpsDNLs/zVQR9D+8wkAsa/p3YOskbHmbNaJ3p8WvLxSPHcJd:GZq0uFrpMLsrGR9YRIKbHuaFp1YUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764242839, "uuid": "637d40f8-549d-44e2-8b8d-4165b2ca8b22", "value": 128300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764242839, "uuid": "2fe9166a-3922-45b9-aa29-922a7814cfc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764242839, "uuid": "6bd4b8d0-b1f8-4779-bd3d-742b58e62d53", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f4b48f-cbeb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764287133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287133, "uuid": "acb4c132-6164-4ede-948a-d40126583ec8", "comment": "Malware payload (Mirai)", "value": "3e3955c6b40faabcc9b112cdd432ab23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287133, "uuid": "1768c5b1-efae-4813-ba27-cae67e3a69e6", "comment": "Malware payload (Mirai)", "value": "ecd55834910255941f02c7e39ddbbc4f17865def281a672fdfcccedade0b31dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287133, "uuid": "078c6b60-5831-4a78-9682-4982472e807d", "comment": "Malware payload (Mirai)", "value": "aab0015c65aec92371aec530acfe4d4d9e5c607e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287133, "uuid": "a72875bf-484c-4238-bb0b-b9f5edd67523", "comment": "Malware payload (Mirai)", "value": "840b6753728fec5641806568283351c5d75e18f5564b832dfbeacb4a9800f1a5d572c2a8f1ae12c9c601dd2913d24743", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287133, "uuid": "9f331b25-27e0-4889-b0af-88d953d1e220", "value": "T1F0635C37A58080FCC8D5C2344B6FB516D633F26E1236B69D27E47E327E4AE281F2A545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287133, "uuid": "67f69e87-97fc-4e8d-8ddf-ac81ba515fbd", "value": "1536:cooPz3BUk9qc+Q2OiI5kTh95H7ZZ3E+yyKDBO4M:coomgqrQ2DAkV73HoBO4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764287133, "uuid": "c6a899aa-db76-4838-ba09-3369d9524f0b", "value": 72128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764287133, "uuid": "e7740c3f-54ba-4ef2-ab45-6fa3149ad8e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287133, "uuid": "5cf39169-0dd1-4b63-ab30-15059089e32a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1886ee6b-cbaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764261333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261333, "uuid": "15871f9d-35e6-43d1-b8da-7932d1c294eb", "comment": "Malware payload", "value": "78457a2e2431ef862621d69079da00c1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261333, "uuid": "00040498-8fcd-4e7a-b421-ce5618bb627b", "comment": "Malware payload", "value": "ed800f8333baec328873bea2ffba51f9deb1b4df5159dce466cdd2da67f6e23d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261333, "uuid": "e170a4b4-acbb-4d0e-beb1-f00e1b852c74", "comment": "Malware payload", "value": "12e379f4946c882297c1da91e586122475b3638e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764261333, "uuid": "cef06919-bb79-4f70-97a2-e68b2a26ddc1", "comment": "Malware payload", "value": "1104e6aa69c357f479fcaae2412e619009fd47fc60be7d030cd39cf472b2185330572843d6e3d6e177face7657a941bd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261333, "uuid": "9203e78e-45e8-4e65-9f95-1fafd35fd11d", "value": "T18CE533463FDBD6B3C6A62730C5045FF14FAAF62A0B1152C714C81D526CA9BE0667B3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261333, "uuid": "937fff33-74c6-498d-a6da-41483aa23c5a", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261333, "uuid": "05d40662-c8f1-439b-a8e3-058d1c7d1c4e", "value": "98304:VM58z+irjnAdiVcIziqZIwceoAkHGUZLJ:VMcZTAU7ziqVoADUZLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764261333, "uuid": "9f56365a-2037-4c27-9577-bea10eb1c4ae", "value": 3151544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764261333, "uuid": "bdbebecf-b4f7-4a76-847e-f9c731c86bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764261333, "uuid": "64f7de2f-0453-4f10-8e28-a5b95b63a741", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20aaf5f7-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236866, "uuid": "3efeb13f-371d-4bd5-9368-12e8e32c7a3f", "comment": "Malware payload (Mirai)", "value": "a649dbf85075bb66fbf35e7355b4b03d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236866, "uuid": "bc0b49cb-8c36-41fc-86bc-0103781d7df8", "comment": "Malware payload (Mirai)", "value": "edf9976340fec7c023e6b9289eb4ef13d5515b789b61c2cb71f611796994b919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236866, "uuid": "8e5764b5-2853-4a11-a239-6e76d3cf2dd9", "comment": "Malware payload (Mirai)", "value": "4a0fb6c96cfadec383424b302b30b2aa7afb6e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236866, "uuid": "d3757aef-8329-41f7-b434-fa0d0c9f4750", "comment": "Malware payload (Mirai)", "value": "591f993146c592357fe0a890f34ad754d782c60615667f0969dba6f9ab5626d973b95a111651b33ee9b83de23422c34a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236866, "uuid": "469d5c9e-f170-4207-82f7-776dacec4508", "value": "T14C23F14FC5FE41A4F45E2437087EBF5B3468DC28C35EF56E434824AA7806F981E6861B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236866, "uuid": "6a7175d8-a3af-42d9-ae63-e802c7bb1439", "value": "768:LZ+A1ENhFI6vR8IxA5w7l5LvpEQlK4dvZGKg16WTjoc9z803aGnbcuyD7UHQRjg:N+A1OR8IxbJ5Lv+aZwKg16WTjoiz80qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236866, "uuid": "3f34d821-c805-415a-af9b-e00266fa224c", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236866, "uuid": "03633d0b-2d00-46cc-97e4-dab648deca34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236866, "uuid": "5fd50603-28e6-458d-bcfc-ca0ba8662752", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1a76b5-cbcb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764273478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273478, "uuid": "06d6eac5-fc32-4960-b9b7-58c4ff6967af", "comment": "Malware payload", "value": "51ba3438f756777a67e07f9614b2e017", "object_relation": "md5", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273478, "uuid": "43cdb031-57dd-4d56-bbb6-0c6d789f951e", "comment": "Malware payload", "value": "ee098ff889b9a23db5d7ca80d9d643b81c45e7e93060d620ae5d4b83bc30e653", "object_relation": "sha256", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273478, "uuid": "df045c78-8b99-4071-879f-56255db64acf", "comment": "Malware payload", "value": "665810e24ec6c25bf8ba49b6edad9d32b224b82b", "object_relation": "sha1", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764273478, "uuid": "f4499448-c980-4174-aa2c-363e93b37b2a", "comment": "Malware payload", "value": "7f47eb4e91d506e54fb9a4dfd50305618607263a4a2e1b453d2b24967d1979726d4a5fc5b72643ea619fc80d6fbd6cda", "object_relation": "sha3-384", "Tag": [ { "name": "45-133-208-231", "colour": "#C71A5B", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273478, "uuid": "61e56825-4c24-462b-be04-687ff2ec2c5d", "value": "T1E6A66B14A9D82A07FD79EFBC959E72540F7AB2912501BB388F5109D96FD2B58C8038F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273478, "uuid": "b31f729b-49fc-482f-a002-1640635a0c94", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273478, "uuid": "ab343282-4dc4-477d-973a-e1fd87887278", "value": "98304:QuLLVFm4C1IXj1iTwhqfbQc8UBrYSqvRZt5cCsHp3gzh1LXEgTRGGsRjvIv:QuLLVg4VYwhqzQcLW779z8fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764273478, "uuid": "fc1af321-b7cd-42c3-acf8-1dc59eb6e43d", "value": 10160128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764273478, "uuid": "639d1397-b49b-4a8b-b73a-9c5aa85ec637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764273478, "uuid": "993d6b1e-05d4-4cb8-aeb2-14b7ee224b4a", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d27bee-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764236876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236876, "uuid": "a8fcfb5f-81b2-4bbe-8eff-93b770ea9741", "comment": "Malware payload", "value": "f208d4efbeef006acc839e14a987fd57", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236876, "uuid": "f6e9de35-2803-46c2-8327-1925016f7f15", "comment": "Malware payload", "value": "eecab1a985145cb4a78a203d997d8bd30d3fb082ebdd88dd2a5fd019dcbcae0c", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236876, "uuid": "5725ef4e-ac6e-4d62-a4dc-8aaff7aa2134", "comment": "Malware payload", "value": "f3c89d5b70aa5c7fc04df4f82f719981e9309442", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236876, "uuid": "fe54440d-9402-4ec0-883d-f6f5b13ff489", "comment": "Malware payload", "value": "19df6c9df0969e7977ecd4ab555863db2c0ebe0694c90dadadbe84c5fb406bdf83c7ced6e3d940f55bb3d3b10b4a6c52", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236876, "uuid": "a542bc36-e61d-4d6a-91b7-767c1dc200e7", "value": "T1F3014EACD1EC9F5008F5C686B2F84249C491808751F867D5F34E09166F28EDE7C9320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236876, "uuid": "96e030d4-17c1-47ff-911f-bea290285800", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GDjInkV9G01lkV9G0F70/GrZhG+E6:FH8j/wWi2jzyXIkV9/1SV9/R0/GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236876, "uuid": "8083c753-b2c3-4015-8a3e-d0ef38c50950", "value": 726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236876, "uuid": "4471664a-42f9-4526-8cc3-df1955924d27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236876, "uuid": "5d612710-62e0-4e3b-86ef-7431f49b465a", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f61fff-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764257115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257115, "uuid": "90cf8e66-399f-42df-8b1e-2166fa085918", "comment": "Malware payload (Socks5Systemz)", "value": "0c2dabf07b23f83b6831b79a2802ecbd", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257115, "uuid": "96380862-8b20-40aa-9402-0fae5e640eba", "comment": "Malware payload (Socks5Systemz)", "value": "f027ab542dc3fa47097d26472933cdb50c9960f00aab2e7a32443db5ae89ed2b", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257115, "uuid": "84e2e72b-e5db-4883-b680-3ce98211dca0", "comment": "Malware payload (Socks5Systemz)", "value": "4abbd91acdfa3407751c9b7c546563655390aa32", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257115, "uuid": "0ce17d3e-c97d-4286-899a-d84c8620091f", "comment": "Malware payload (Socks5Systemz)", "value": "44cc4a8a0f2d456549e55d61b9baf95888632d9491571a9bdecf3a774d1ff48624936cbf85914a5d2a4e32a792506e7f", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257115, "uuid": "9a3ff422-1037-4aad-a568-5818e217bc4b", "value": "T1A706333246504833D57BCAF5C532CB5444E3A9AE51F8234AF24FAE6E6F369135B28BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257115, "uuid": "fb5ae513-9f44-4a80-b98c-b88be06081b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257115, "uuid": "c8a95564-76b4-42c2-a3e4-5a3a23332c56", "value": "98304:MdG0zV720vC81TROQGSnK+QBZXx4VXC4wreRE97dH9xipFjF:QFVB3DUSn30MDi3H9mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257115, "uuid": "4acdf2f4-dabb-4429-83cc-5f2c83e93199", "value": 4001296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257115, "uuid": "7a1facaa-5a50-4d10-8887-23f7d7ac35d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257115, "uuid": "f66d114b-3e92-4034-868f-65fb225bc22b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afbe49d-cbd9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764279457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279457, "uuid": "c5db94b9-072f-43c4-871e-d0d19d4228be", "comment": "Malware payload", "value": "77fe248af5e34636fceee19abbbd7c3c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279457, "uuid": "bda4fb80-177f-4e54-8313-4167c8b9e07a", "comment": "Malware payload", "value": "f167d8d7461da13cda139f8ffad5664b79fb99c6fc55bb67e602b76f9330e338", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279457, "uuid": "1c897375-c9de-4516-b93c-ca9d19a95e0f", "comment": "Malware payload", "value": "9e77d97361e2edaec7c80ca506c3af3dfcfa81a5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764279457, "uuid": "8b0946fe-c87c-48dc-9e6c-39573aae3b24", "comment": "Malware payload", "value": "77205f6c2317541c1b84118227cb84ac7cace2a5e49485f569d2846430faef767d3baaa1825a919e01fb73c0573a74f6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279457, "uuid": "af225b46-5c21-4789-9106-765cd1ed0f46", "value": "T1187302981DCB64E85A2F74549ADF4C03F7E58807162CCED6BAADF5B02F11438E2E49E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279457, "uuid": "56bc78bd-4a96-466d-b6a9-30298cd45b14", "value": "768:M54cEs31whkUx3bzdG3Sgqay4Hyps+Nme9FDNkHueKHDPdl1M9Xt28VmsQmI5I5H:SypXmwVj1l1MdN5l6nmjGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764279457, "uuid": "9cb0f56d-365b-4696-ba79-479247829192", "value": 76321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764279457, "uuid": "429f3cc0-9787-4867-aa58-311cab760ce3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764279457, "uuid": "cb731945-df1c-40f7-b1e1-cd97b04f180d", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae36248-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236910, "uuid": "a96d48fe-1082-4f9d-8436-6571b72a61fc", "comment": "Malware payload (Mirai)", "value": "586264e94bb9fd1ad28cb0b61e5aaadb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236910, "uuid": "f1f915c2-bf35-4b0c-a13b-2784caf5e1ea", "comment": "Malware payload (Mirai)", "value": "f2ae7a2ca108057445f7760e07918dfd5c632e2d6a032dc8545830e355a5ad6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236910, "uuid": "a2c034c7-ede3-4bbb-9972-c3f842a44128", "comment": "Malware payload (Mirai)", "value": "fdd7f5394d71c13652d5806e55418ea3b7a84aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236910, "uuid": "b030e452-2418-44af-b3c7-936ca789a0bf", "comment": "Malware payload (Mirai)", "value": "eb853dd24ac4ed7c6f06b21ea6e5d2e93ce844b9a73abdc414c72f8d279af320889c08bef1c95fc0cc44c60f06071714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236910, "uuid": "24b45470-5e73-4e79-a576-4b05e30cac2e", "value": "T147C31986F9824A22D5D7127EF92E118E331317B8F3DE72129E245F2133C652B0EBB955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236910, "uuid": "379511fc-b03b-462a-979f-fd350836407d", "value": "3072:HDWrFoeatGA59/qP98nTma9uk4cIXEuNGtV:HDWJoztGA5pm98niat4XEZtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236910, "uuid": "fb4ef62b-36a9-465a-9f69-1e1df17f44e3", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236910, "uuid": "d9a12883-5138-4157-96be-dc73a4138ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236910, "uuid": "bbe98f5c-14e0-4a0a-97ae-9f41cf3be1b7", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2798468d-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236877, "uuid": "dd93980e-8863-460c-ac34-e7bd784aa6d1", "comment": "Malware payload (Mirai)", "value": "411b9be9f096fd277c1fb432f05ec662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236877, "uuid": "41bdc410-5eed-4ad2-a50f-03e2b562495f", "comment": "Malware payload (Mirai)", "value": "f3671912e920c0192b13ce4823deb94d0279a6811ceaa5a298ac2449ba4b114f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236877, "uuid": "6d8b0067-6e90-4f00-b203-4df952f68b50", "comment": "Malware payload (Mirai)", "value": "dddf5515b44eada6ba072a36eb5736fcd160ca0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236877, "uuid": "680228a5-64ec-4d5e-b5a8-0c42a0f0c991", "comment": "Malware payload (Mirai)", "value": "4938fd309b54cd5342fc60a12ccdc9c978584dd453fc29be94ca69acd2a0eb533a0fc917a98999f20325f8af3b4caffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236877, "uuid": "e4baaba8-c534-491b-a248-1860649f24d6", "value": "T11913F24285438B46E0CFC475B8FE390A9964FA9F9F0745F316F434718805FB72A246D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236877, "uuid": "767afb51-175f-4520-9e8c-6ef587370263", "value": "768:zpf/8KshvtflEvvMYx/jXZTTRFu84pDrBeqX0lBjfX1Wl6wcETWqOoenbcuyD7Ue:d/yFfKMs/jNTRUpDrBBX0lBBWMmOXnoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236877, "uuid": "6ec91cb6-9087-4b0f-94e9-685b73cd2459", "value": 45448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236877, "uuid": "edd8d328-4b3e-412d-9952-224e0b1d31f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236877, "uuid": "dc889de2-be51-4a87-b870-e04a8e2097ed", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4c22fa-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223708, "uuid": "eee18f55-6925-447c-b245-faae5a1eccad", "comment": "Malware payload (Mirai)", "value": "e07b4294939d63f4963ca6e2a9b0e539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223708, "uuid": "0e99a3a8-6367-481e-ad2f-0aade826f18d", "comment": "Malware payload (Mirai)", "value": "f494dd4ff8b21185f0cf910f037e3dad084b6077397c468fcbd590232e2d2a7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223708, "uuid": "d6ed0cb8-cc4d-4c1d-a5a3-4477fa31d159", "comment": "Malware payload (Mirai)", "value": "295e2038300578db26e822452d2bb0912fed5dce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223708, "uuid": "43b9751e-b777-46e9-bc0e-6d0d3122e2a4", "comment": "Malware payload (Mirai)", "value": "39e079295677c6a8942aedbfd4873e636102eaf2e207649d4ff60fb7061e2fae2dba456f8e12b8071bef393cbc525be0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223708, "uuid": "d5b1d031-fc5f-48a4-abce-19fb772496f7", "value": "T1E493D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223708, "uuid": "56879be0-8ebd-404c-918f-5f38cd073197", "value": "1536:NF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqnhK:NFjXYyCEx0KhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223708, "uuid": "82b3a5df-52d7-40f2-94c9-7152526639a9", "value": 89408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223708, "uuid": "62e68048-e074-4c1b-ae00-8f9a7d90156a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223708, "uuid": "fb0f6151-6dec-42bb-b476-83e037282980", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dce662-cbde-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764281735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281735, "uuid": "20047feb-0276-4296-9c63-b75988bf8421", "comment": "Malware payload (Stealc)", "value": "bc921463aea614fdef1896dfaab2ddbd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281735, "uuid": "0ca6871a-9ea3-4c00-9d7c-1b57f08331e7", "comment": "Malware payload (Stealc)", "value": "f54de44c8a9892dbc1048323ff4907c3c6ca3d9e917d3837404986b82fb39661", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281735, "uuid": "95af50ec-5464-46f5-b6da-f915f7328014", "comment": "Malware payload (Stealc)", "value": "3feac3f48de6c10cfc46ccb579d159d8fdcb1661", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281735, "uuid": "053b8d2b-1b7a-4040-ba7d-a170fdb7a759", "comment": "Malware payload (Stealc)", "value": "6f08f803380d5a5a009bf6c1948292c2f20ad9004054303137b6177fd60b9046b4b3643d0c339279dfd6b5db42ffed4a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "TWO.file", "colour": "#2E1DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281735, "uuid": "d9f2553f-e922-4025-a933-fce742d56e4d", "value": "T19F25122BFB03B0D8CDF944B15CA105B362226C3B47600B7BA4B4B6290DD575B7B3697A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281735, "uuid": "3740dd17-324f-4b0c-8363-b4c004383386", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281735, "uuid": "4fd7e0e5-c209-4a1b-983f-b37c00cb6498", "value": "24576:x4nmjCmnIMScVleLwv2YTozVcPJN0X+2/o8xw:x4nmjsMSKXv2YkcP4+0o8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764281735, "uuid": "76f98544-d779-4394-b743-c5adb26401bb", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764281735, "uuid": "cad6f93f-a84b-47a7-8d09-b673d14c3d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281735, "uuid": "d10fb28f-7be8-46a7-a23c-fbe2e216dcd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad9239b-cbde-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764281846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281846, "uuid": "e7946af9-037f-4613-a9cc-26145699c018", "comment": "Malware payload (Mirai)", "value": "0a92e59b68308d40ddb084e9c4d88ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281846, "uuid": "5452228e-8267-4bc8-99c2-689c9c8fc9ce", "comment": "Malware payload (Mirai)", "value": "f56d8db87522f7c1b29054a3032f8d09b0a8571e09347049a10a8f6b66f55790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281846, "uuid": "07082086-b289-4bf7-8a78-f97ad049cfaf", "comment": "Malware payload (Mirai)", "value": "bf3f9b2a85bde2ad12109667cfa8ae5b33d78910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764281846, "uuid": "634e1943-a781-4692-bec8-a7cfb2d68213", "comment": "Malware payload (Mirai)", "value": "a6e1c4f67e43e8f07f6e8c7bdc76ceb0f3ffc188339ed7d16dc321666c2c19a350ef455845dd36ea0b2723a55e3a692b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281846, "uuid": "95d8c331-b1fe-4593-8fd6-34c01f691a0c", "value": "T15A633AC59943D8F4EC060A721573F7379A72F0792016EB47E3A5EB26EC42A11E70A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281846, "uuid": "5f1b97f3-6f56-4b6b-a9de-87e830d3fa49", "value": "1536:me8xE8yhRYA+gut6qXlRBV6/gkR2jYcz+X3P3N0r4L0ECloR5STwAR15600:meMRyhRYthtD7BV6/Z28623vNxwRhHgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764281846, "uuid": "06701529-a693-423d-adbf-6c8b99642b7c", "value": 70620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764281846, "uuid": "e0a21d21-d531-49f4-aeb3-1816794619ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764281846, "uuid": "2afe9910-c4ac-4732-8369-7a316d9cdfcf", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b01ace8-cb88-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764244641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244641, "uuid": "51c89db5-a40b-46e2-8775-b30bc02b7ed2", "comment": "Malware payload (RemcosRAT)", "value": "3fbce05e044eba074b638e4731ff1c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244641, "uuid": "c13c5faa-1abd-4ffe-a3a3-3578e41d262f", "comment": "Malware payload (RemcosRAT)", "value": "f73987513db8c06902182a46cd5d43b8d1fbcc8cb167b0b3c7ad45b6f482b64c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244641, "uuid": "e0893973-b49b-4be4-9d74-60acf1b8cb8b", "comment": "Malware payload (RemcosRAT)", "value": "ec495763f11cb342b382456ddeb3ad50e438bf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764244641, "uuid": "807ade0e-882f-4f48-bbdd-0998a5a9e800", "comment": "Malware payload (RemcosRAT)", "value": "ba4023d248b1483b253643fe21e9d1037e82dd3b67a8ed6570a2bd628dd7f8b387b4e8a72e18e20bc8dd63f0f67e5442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244641, "uuid": "79d86367-ae24-42c6-ab32-2d903dada62e", "value": "T16245E01A36D68194E1BB9734AFBA4A1447F0BA17CA32C72FA14605FDCF5638951233B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244641, "uuid": "572f3ce4-4313-4f37-9dbb-738f45efb413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244641, "uuid": "cc59dd9f-25cc-4e66-9fed-d4ed137c13b6", "value": "24576:GQh2brCnRveYepqMKDmfC4KOSSn2k6NR6uI:pIqRveYkqM3fC41p2fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764244641, "uuid": "f0820d29-212b-45b0-a4e3-175b34b8b7cf", "value": 1226240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764244641, "uuid": "06fca8a3-6483-4b2f-8660-d5649a465361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764244641, "uuid": "430df2fd-04fe-479f-9bc8-1e40082ecd41", "value": "Transferencia n.\u00b0 20251127.pdf(65 KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee44890a-cbb5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764264269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264269, "uuid": "7cf4694a-9251-413c-a14f-1d05e7618f65", "comment": "Malware payload (Formbook)", "value": "ed307e10182c307e31a7c21435b96a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264269, "uuid": "3040b585-3d89-4f12-9ac2-b7c0717b74df", "comment": "Malware payload (Formbook)", "value": "f7f0d0bcd56c2b929b687aa0c15305be4f71495d0b1ce5609fed155ddb0c016c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264269, "uuid": "ace82728-4502-4788-bb39-4327921561b1", "comment": "Malware payload (Formbook)", "value": "7719d7d8da28f4cf28949fa6f1d18f751db73011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764264269, "uuid": "178e1dbf-7d31-4872-a49a-d5ee82bb754e", "comment": "Malware payload (Formbook)", "value": "786d2ebee44dc611687bca36104d421d80fbbf41e852ef96a3d141eebed902c73d26efbe7f210e8762ff89f4ba10fa13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264269, "uuid": "99cfb35a-d77d-4704-bac2-0e9282d3a0b3", "value": "T19EC41264394AC153E5A62BB210B6F37057B45ECEF123CB5687DEDCEB3609B062D483A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264269, "uuid": "a745e330-d118-4899-903d-beb34ddb9ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264269, "uuid": "101f0242-18d9-4c5d-9f43-8e14d874f211", "value": "12288:2wS2woUHLwfkORROlMqKUFVKpfboTJUXlXUHHRlYxoNYYR4JGk:k2XUHsfkORRUiUFVCYUX9UnReyNTR+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764264269, "uuid": "47bd4e71-b8ec-46e3-8fe4-85d808c1f1d7", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764264269, "uuid": "eaf59373-2f41-42cb-af90-7a3487d16b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764264269, "uuid": "fc8a18d9-a5fa-4534-a049-327979ff8885", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8673.2680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea38398-cb93-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764249694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249694, "uuid": "99408a2e-98ee-4251-b1a0-e258df2f6060", "comment": "Malware payload (RemcosRAT)", "value": "649db9baffd7ad853ab0cf1bac32cecc", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249694, "uuid": "9c7613cd-cfaa-4c61-a17f-5f26916d77fe", "comment": "Malware payload (RemcosRAT)", "value": "f81dfa43a6339dac6b1e3d1ef18ce64bec526761284e7c97c705ecca4a219ea7", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249694, "uuid": "db7e7803-086c-4e5d-96d3-8e1f6580fde0", "comment": "Malware payload (RemcosRAT)", "value": "b2c3819609fadf1dcbd5644811ae86942f55d819", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249694, "uuid": "b1134989-6a6c-47e9-9e41-cfba572352fd", "comment": "Malware payload (RemcosRAT)", "value": "384982c61830932c2248acedd83e33410ad5c94ad3fe26fa966e662bdce2b9b3e685292bf5ccb89cd03bdcddf751000b", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249694, "uuid": "99068e22-7101-44e4-b489-1249b0f922e7", "value": "T123051212F5055A77EB4A4F758F93D3E6176EBC6EAE2E424336407B0F2C322D2B542426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249694, "uuid": "3e660a0a-827a-4d44-8627-688969486e18", "value": "12288:vB+00g7NhZJyebM4AB7t2CFucKA239FULdGdea6Z5j6UlYmm:vg00g7NEebMjtDocKb39WLI+xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249694, "uuid": "0f4c5efa-f6f8-4fff-9a5f-da6f5f856aff", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249694, "uuid": "490cd37b-4f5b-436f-8e02-faf5d2f024bf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249694, "uuid": "d180bccd-853a-401f-846a-6c26cf4e112e", "value": "Order No. IE-IB-051-2687-350 RFQ# 5890.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d6b1a3-cba5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764257376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257376, "uuid": "65fa8bb0-71ed-425d-b997-d5da763e38f3", "comment": "Malware payload (Mirai)", "value": "e729db3c6b2042cebaba54ba69a89f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257376, "uuid": "bad9d819-79c6-4936-ae86-9085319435cb", "comment": "Malware payload (Mirai)", "value": "f87bfa2f733b69d7703a7e1c2795dfde0b9436418af1fc9d582ac0999a1117a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257376, "uuid": "98c48df3-d7d4-4ff9-84d9-95667bcc7ca9", "comment": "Malware payload (Mirai)", "value": "230f47b9be4ca9feaefc1b0d00729db996e93106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764257376, "uuid": "0d52a435-ffbb-413f-88be-81a35fff291a", "comment": "Malware payload (Mirai)", "value": "0dadf2cd4ca25ebcb330e49af2f6c815dcccbba7e8b6e09b64b0f59ed88fa98a8d345bd508717c738df32e183cd98669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257376, "uuid": "60669eac-03bf-4982-bdf2-57bbaca4c04d", "value": "T14A330284AF1768E3C7F834B6C770C54BEE3E4764F18B21020F694A38646E76E5A9C183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257376, "uuid": "9cae5901-3e15-4aad-9342-7e33f0a11f59", "value": "1536:FO26s+W5T7wktU+YbeZG5C1X8k+XdVSVZLi:8+5T7wkR5irMZLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764257376, "uuid": "48720555-cd30-4382-b522-2a22069216f9", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764257376, "uuid": "abb97dab-551a-44db-8be2-2a3f03274f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764257376, "uuid": "690f5185-b68e-416f-8492-71e9dc6a4846", "value": "SecuriteInfo.com.Linux.Siggen.9999.16189.20665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f31af6-cb76-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764236880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236880, "uuid": "50b3daf6-f24f-4206-ae8c-284b7b16fb56", "comment": "Malware payload (Mirai)", "value": "179371f7569c81ad3821f272d05118e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236880, "uuid": "e764b6c5-e7b1-42a3-be43-f441cc98f9ae", "comment": "Malware payload (Mirai)", "value": "f88cd33bfce579378f84b0292c6742bd6694fa106d19d75c618f2f6a0bb33d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236880, "uuid": "dbcfb492-e669-47e4-962a-c76fd89e714a", "comment": "Malware payload (Mirai)", "value": "fd81d4badbff27d31a49536275b5b9c9455145e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764236880, "uuid": "d197161a-901d-4345-80e8-d67d8251cd3b", "comment": "Malware payload (Mirai)", "value": "9ceb54dd8bf25768967cccf8348604cbb8217605f0e7b13c75c6d33e63ff4ff046f7695614f3b464abf26f15ceb00d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236880, "uuid": "ba0f02df-1fee-47c1-9b00-b0da13bf6373", "value": "T1B323F12200AFF669D678A6B9DBFB0A0C7077AFF1975A3352580012EC3381E1C5BBC955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236880, "uuid": "6245320b-fefe-4e37-9ae0-a696e7d6d240", "value": "768:ox/APzP2GoqbMPVvJKY6xecRNVCsxI4zeg4E46eJCTVhnYrXxowN0Z5IDOEgayGv:ZnoTBJKY6xeTsWWemFCCTXnYN0wVByGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764236880, "uuid": "a10e7f59-0ea4-462e-b759-07d4e972e5c1", "value": 47380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764236880, "uuid": "271c5ab1-1139-4b0a-af4e-7b40eaf71d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764236880, "uuid": "4c23dba7-b4d4-4f26-b665-aa2b22c8e585", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb73edc-cb57-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764223657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223657, "uuid": "207a6c0d-bbc3-4467-9cd9-d8f3f3d89201", "comment": "Malware payload (Mirai)", "value": "b4b795be3ba0f1630f7bc9f6dbc46be3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223657, "uuid": "dbbf7f8a-680b-4e29-b6da-1204a80381e0", "comment": "Malware payload (Mirai)", "value": "f9c6d7ebeaec939629be60b9322a98ea1937a83c8fd0c81685b26e3a465bb802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223657, "uuid": "e804a585-dc35-4761-ab11-819d2e1605a8", "comment": "Malware payload (Mirai)", "value": "142d72c3b7e424cf189a7f0bcbe6b4b542605b6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764223657, "uuid": "2b74ad85-de37-4652-abed-7b1e562dad9a", "comment": "Malware payload (Mirai)", "value": "707af342193680a4607bee795806d3a9110543b218814d32b2e104833c619bd1525e540976c4cf0a25ce1269825ea07c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223657, "uuid": "8fc9fa96-bb5b-4016-a636-402a82e46606", "value": "T12633F1B6429BAD62C17051FB1639649E64152378E3F5F00357660470EACB2F25AFEBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223657, "uuid": "5f56a6a9-21b4-49c1-bc73-4983eb5f81bd", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8JrL9VE8amFZP7R3P:Xoqs2Twh6P8JrLJ9ZP7R3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764223657, "uuid": "2e4ffb58-f518-4708-8d99-5ce6b8fe2113", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764223657, "uuid": "c2d91822-a961-4def-b954-8341edf88a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764223657, "uuid": "30dfd125-f0e0-4436-ad5c-d43bce4fa316", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c2653a-cbeb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764287305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287305, "uuid": "8a177562-d85e-491f-a565-8b3ef66dd194", "comment": "Malware payload", "value": "1a2816106bbf3744743986588b908078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287305, "uuid": "2c5d73f1-437b-4c58-aca3-0da1ce66d292", "comment": "Malware payload", "value": "fa2523ada56049e83b0e8dc5fd85f0dab1935c353ea8ec608913f97198d3626e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287305, "uuid": "9670077a-a7d2-4e96-bf6b-233469c69a10", "comment": "Malware payload", "value": "139e4d9d06f952610ca5a5bfba8b061fd36aba12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764287305, "uuid": "2e33aab5-1838-4b97-b209-0c7314e6710d", "comment": "Malware payload", "value": "00f059bd9d454ec39615eb1fa1ac5342ce69fd1b8d712a2fd42b4e6945d8402d326e097a136334e100760b85adbbadc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287305, "uuid": "0d93eb85-026d-4c82-bfab-9c85a2f18aaa", "value": "T166531886BC819A17C6D462BBFA5E41CD332623A8D1DF7203DD216F157B8A82F0E67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287305, "uuid": "d85214bb-4367-4748-9e54-ba4fb18f9bc6", "value": "1536:eg7roU2CpjnvYERGSVvH/0GMPcjCftug7R:eg7r1RGSVBM9ftug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764287305, "uuid": "29271add-f267-4d2d-86f4-209c8e2a89d8", "value": 61276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764287305, "uuid": "e8ea51a7-1281-42af-ad75-c48321a00bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764287305, "uuid": "a5cd76cb-58b3-4810-ab9c-3947f90b0b11", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df51f15a-cb89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764245346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245346, "uuid": "6a6d88ea-1a65-453f-b807-d4fccbd96d16", "comment": "Malware payload (Mirai)", "value": "3712b36d1f404e106ed6e1e55424a43e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245346, "uuid": "43d17919-e34b-4658-95a7-560b803e832d", "comment": "Malware payload (Mirai)", "value": "fb5f1f75df7b54ba34dca815a08ecfa9068b42e8ef7b96526a0ee83fdb3bce2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245346, "uuid": "934a130d-3a25-4808-9a5d-5bcea475c088", "comment": "Malware payload (Mirai)", "value": "0acf5c2f1ce7744e8b9ae945dead226fefb78c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764245346, "uuid": "463029e1-a92f-45a7-ac82-670a8361e9d6", "comment": "Malware payload (Mirai)", "value": "3e569b2af557d33d0afa9999e9ef2abd963d234fad5527b54e32bfef280ccbc2a83a8d83b5b4602f1b5c87cd23c3d64d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245346, "uuid": "54bfe239-761e-44c0-a542-a8f074e15fab", "value": "T1E98302B37D30DC80E7D8A4B9772B4201799368B46066204F0EDA2A77E98A851EFD7543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245346, "uuid": "6115116a-f696-4a23-9de1-3a9bf2b3d71b", "value": "1536:DDvfSOLU1toVEiOSV0hJ2Z+EETRvHLdTEjKUicD4+5mLobx5IaqlwOx1EnTWw:XSMUroVEDSSEihtEOUickEmLbBWOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764245346, "uuid": "4aba65b8-953e-47f7-ab9e-15d6a9f0caf4", "value": 83024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764245346, "uuid": "112258e3-c743-4b10-91c6-57a36514e7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764245346, "uuid": "030b64da-3f1c-43f2-9f5d-ebab4820b9a1", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97536e44-cb92-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764249091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249091, "uuid": "608fc094-b097-42b0-a981-5f39cb824043", "comment": "Malware payload", "value": "226076f6c23f3f0b16b51abc295c1155", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249091, "uuid": "47336b5b-3a57-4620-9956-c2f8791ce695", "comment": "Malware payload", "value": "fc3864479578e4e27a06b13c2c7645ffb2c02305e6f9395be430ada29ac41495", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249091, "uuid": "51561ff4-3edb-4bf8-a9db-0bda87761649", "comment": "Malware payload", "value": "2d46a47c506116ae9038cf9514fc86202d321ee5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764249091, "uuid": "f49fae9a-0e9d-4ac5-823d-09e63dc0b1a0", "comment": "Malware payload", "value": "8a5793aa0e8804dc9920c6f8556bf32edf6de4cccc69f3e04c4aeec2a4bc7c6e5e9accc571172cc0b86da66724325348", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249091, "uuid": "b513e977-2a90-4a01-a740-6c531cf820ce", "value": "T1CB21BE6A965581B1715448E05DAE31D6E897C23F0C98EC86B88C5EC42F0B21EB5F73A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249091, "uuid": "4ba0fd51-04ba-414d-9725-74d3014b4289", "value": "24:8rvP8OdOQoxaRwtbFsNC/RdOQoxaRwtbFp4iM5BdkfxaRw3z3vM4M5AfQmxWQJR:MvkXQOsNC/+QOp4i+63bvV+Lm1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764249091, "uuid": "59adcaf8-3713-4191-834b-0972e6ee5868", "value": 1349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764249091, "uuid": "420d1eba-a7e0-44bb-9c17-459372d72096", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764249091, "uuid": "aac9bd77-5cf1-401b-9368-0c9d81f88a42", "value": "document.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce66f042-cbc8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764272376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272376, "uuid": "50d75a12-484a-42bf-80ab-b327b0affa64", "comment": "Malware payload", "value": "0d94266fcb64c9d9d2e5533382df5034", "object_relation": "md5", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272376, "uuid": "ef1bad79-5bcb-446e-8a15-3350d5f6f7a9", "comment": "Malware payload", "value": "fc3bbfb34055d8ec2eaa275a28baf9e64cb48cf0cbdcf542eccd8b4fdf403b3d", "object_relation": "sha256", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272376, "uuid": "45f37b1f-aa3e-4436-b390-0a40f78fb3f5", "comment": "Malware payload", "value": "915640f35c304e4954474214e5b698c4b88da481", "object_relation": "sha1", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764272376, "uuid": "ec87773b-e0d6-41a2-8c82-a6e3dbf90214", "comment": "Malware payload", "value": "b1712c635f680bedb96e2f2ae0bfde04553e112b83cc59b083bc5c25cc86ce4b287cdf75fff50777f253726fdf20b09d", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-241-90", "colour": "#9AF61E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272376, "uuid": "7bc1275d-d7b5-40ab-aa51-4da511659a82", "value": "T17A863310EABE369DF51EED7D74640D2C3BC14CC82421A6B3BA1A2D9455FBACE168037D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272376, "uuid": "4b58b67f-4f0e-490d-8af3-0b628bdab5c6", "value": "196608:ZxNENt9qGVbWUTTrXf4iMRQ/cXfad6mLZTQSc8zAbm2paKrPlfbkvCwb:ZxaNt958Wrcq/cX8xVVzr2ImACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764272376, "uuid": "12a95f78-dce4-468a-8b9b-24cc9e810731", "value": 8384351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764272376, "uuid": "79d0c7c5-1f81-4c13-926b-4a490106833a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764272376, "uuid": "06eef6f2-50b6-41ce-aa4b-a056fe546487", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06e0576-cb62-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764228517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228517, "uuid": "c6a5e3b8-ac77-4d21-bbf0-e91f80aa7a56", "comment": "Malware payload (Mirai)", "value": "67880db26d0306cd5aed3e1df35e6960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228517, "uuid": "8fa866ab-5782-4dc9-8410-e17fb3771f64", "comment": "Malware payload (Mirai)", "value": "fc47087f151f3f5fa3d456ca128f5a82e3496adc15fec7e30692a88c4513794d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228517, "uuid": "63ab8182-2b49-401b-ad3d-ae4d24e30461", "comment": "Malware payload (Mirai)", "value": "b1a3a0954ebc3ec3f99af6420a9558f477c16613", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764228517, "uuid": "5a79dda8-e293-43bb-a3b4-64595f7d9bbc", "comment": "Malware payload (Mirai)", "value": "0ce41d1d49e63f903e6612799a42f6d43dcb0781b67ee3078fe3c7f383f79a19154f5af16b75ba9f85371e821c055fee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228517, "uuid": "73c122f9-ad56-41f5-a55a-c27f58e66058", "value": "T189530905F950872FC6D267FBF75E039D373A1A54A79B33116A382EB43BC5BA81939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228517, "uuid": "3e92c240-ddb4-4440-8ae4-eb3477dfbcce", "value": "1536:jg2Ff8T/lg4YXm1ZSRMyNeJKe8PWpeZ7j35:LFku4Y21ZSRMyIKeKWW7r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764228517, "uuid": "cea8c8f5-7d88-4321-9c26-c291e8b786ec", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764228517, "uuid": "b17de1ed-8a2e-46c4-96a0-3d62422e5949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764228517, "uuid": "05667e64-291e-40d7-a3bf-f8d1ce1aeb20", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c3a96e-cbaa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764259264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259264, "uuid": "148c9714-53ec-40ef-a4d1-008f1d2a1363", "comment": "Malware payload (Mirai)", "value": "d6b5f00ad7d9679a21dd691da8248e02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259264, "uuid": "74b8b385-3033-404a-8702-af7d31bec61b", "comment": "Malware payload (Mirai)", "value": "fcc3f65a704c72c6b416488894f45a9a0fd13c4f80cf3292d09d7714ec10c0ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259264, "uuid": "afae7afa-043e-41ec-b059-a92f8438628e", "comment": "Malware payload (Mirai)", "value": "6b13def493b447140763924075cf14883747bbc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764259264, "uuid": "8221437c-d722-4044-b9df-5964ef39c598", "comment": "Malware payload (Mirai)", "value": "f0c9b0cedccda9b61b150c59f524fcabf9f7bff9a0a0d5985af1b6f10678f6f4660f19fbb53825ec7bafddde68ed340e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259264, "uuid": "ee1db07c-22a7-49b6-a68a-f8e485a133ae", "value": "T100C3E799B8819B22C5D156BEFE1F52DD33231BB8E3DE3203DD146B2476CA91A0E7B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259264, "uuid": "58fa60b5-7b74-44a0-8b12-07084dabac6a", "value": "3072:WjOG8ZNtFUK5gGLaz+RrOuCEqHnomrINR4lXCjNXir461n/1Pn5v:Wj4tKK5gGLazArOu3qHM3aQNyr4+1hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764259264, "uuid": "c7927682-da7f-45c9-9f8f-3c0d81cf3bd7", "value": 121948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764259264, "uuid": "0265c76a-ee81-4309-9c9a-218f184aee0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764259264, "uuid": "ee022364-ee3d-41de-809b-682a067a16fd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91952642-cb70-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764234478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234478, "uuid": "2d657046-bb29-49c0-860f-8bd44cc772af", "comment": "Malware payload", "value": "4218c136c152705a0413e8949fb3a7a3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234478, "uuid": "6622cdf6-aec5-4d9d-8389-6eacbef7d5dd", "comment": "Malware payload", "value": "ff0e3311f5d8e829b189adcd520037ce6174caee347452ded3d5fcdf48a3b4f2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234478, "uuid": "62ab41a3-1450-492b-8344-4ce590a5f2b6", "comment": "Malware payload", "value": "fe40a875478558a7fe5d5e86bcd2f7bd0fe41e4d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764234478, "uuid": "91004502-046e-461f-bf7b-209e639df488", "comment": "Malware payload", "value": "acec22d5802344ab7719e1734ea88d28d2005c2c17430c600a4d3691e4f5513ed8731f2c059d8a6a53cc959c1ec4577c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234478, "uuid": "48de0667-fc41-4ea1-ab7e-7c771d2aae2e", "value": "T17FD612D7FB3C882FD9B709738D6A513137664E5A8283A71B1A44763CAD3324A4F49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234478, "uuid": "f4a8c54a-56b0-4990-a4f5-98a0edd3382d", "value": "393216:xuhABqWf++arid8kyR8xFJ+fjiyN4c2Gb1kjWVHQUTV14:4hABqWWiKkyR8xFJ+Li0+GbqjWJQeH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764234478, "uuid": "c4468519-401a-48ed-af20-2a17bb1dcbdd", "value": 12699434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764234478, "uuid": "38224eff-41b0-499f-9505-fdaff9f9a0d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764234478, "uuid": "5c528319-6f0c-49e9-abe5-cd93b8fa56c6", "value": "taozi_stable_11.5.6_202511171028.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }