{ "Event": { "published": true, "date": "2025-12-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-05", "timestamp": 1764979382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0f5f71d9-5a13-45b7-a646-5da0d7313ae9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364c9610-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958886, "uuid": "53a991a8-1f01-4dd9-ac55-51c19812561c", "comment": "Malware payload (Mirai)", "value": "62e81c205ad768d767a5dfdfdeb10e02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958886, "uuid": "cede70e9-14cc-404e-91bc-1465b14ef128", "comment": "Malware payload (Mirai)", "value": "0193888cf6cf565d3cf8acc4bc4f89ae7ccbc6a11b97ac0b726e141901c6a315", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958886, "uuid": "1ef2d514-6e55-4fc9-bc86-e84616826804", "comment": "Malware payload (Mirai)", "value": "2659666f84aa4e8c8a579f2d2a9974c554ce15e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958886, "uuid": "ce1047d7-a8ce-4f2b-87dc-6896404b3659", "comment": "Malware payload (Mirai)", "value": "89c40a9d92e6542fb0067a4bac7892f6283ec2270385325421fdd3a544c13aebab4df501bb988447d15144630c713292", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958886, "uuid": "70161157-ef38-453d-90ae-aba97977a12a", "value": "T17D11307E420ABAD4854CD83BB383C10CB0AA4FDE18BB8BD06E45193D30B41DE7132E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958886, "uuid": "4626dde8-b62b-419a-bffc-c3dff7fa54e5", "value": "24:+FgYaFl5tYaF6YaFTYaFAHYaFnYaFcYaF9YaFxYaFKYaFAnY7:+9af8anauaZauataYaMaja17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958886, "uuid": "ad322927-06d6-488b-a630-eb30973a2e53", "value": 1020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958886, "uuid": "b064a259-bbeb-4f65-a1b0-3d9791c5fd15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958886, "uuid": "e96efaba-ee75-4145-9c24-92e4fa9bff73", "value": "calix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a738c8-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958422, "uuid": "3942c28f-534a-4957-b5de-ff3ed35f7ebd", "comment": "Malware payload (Mirai)", "value": "9a5fb9fe3ee7dc2b304362bd0137a3dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958422, "uuid": "a1557876-8a39-4c07-bdd2-933b95ebb647", "comment": "Malware payload (Mirai)", "value": "01f0ef34e992536e7730c086b1b6fa884188969a6f6b62cff1e7204020603147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958422, "uuid": "4c95953b-85c4-49b5-87d5-8f51086306cd", "comment": "Malware payload (Mirai)", "value": "762e1ff8fcfca0c9a4a9447094eb524cf1e53e80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958422, "uuid": "3a056a32-7e47-4c8b-b4de-c41c9c148ff4", "comment": "Malware payload (Mirai)", "value": "fce6764826ed6e988dea43809cb2fce94eadde8f89a535e9435f7104b31b8d7bb891cd4592b8a1831d143163444e61c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958422, "uuid": "d729dc5a-ff5a-4b6c-970c-99125f61e875", "value": "T154136EC9D743D6B6EC550AB418B7977263B6E53A1094FB47DB9AE431EC02607B30A38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958422, "uuid": "2aa76e55-83e3-4f3b-90e9-6f5fa211b7ef", "value": "768:DE++3lRoYTly+TCAXPP+xCETlOY3L4E8CRRbRRhU:DtMdly+TxXPPWJ4Y7z1RRbRRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958422, "uuid": "bb5051ce-0835-4892-969e-3f489c3de169", "value": 42656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958422, "uuid": "5f3acc7d-c726-44d2-876a-a76c49c13999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958422, "uuid": "151a0f9e-1a04-4de5-876f-9387d0965517", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a34387e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959027, "uuid": "f8e3b30d-aa5a-40f3-a5d9-28521eeb474c", "comment": "Malware payload (Mirai)", "value": "e876514ad107421c68d371f9b398374a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959027, "uuid": "c128b095-fd02-4080-92f8-f10b642db932", "comment": "Malware payload (Mirai)", "value": "01f57736fd1e6dc10ea917ad5fce56201479cd4bffc814000427c4f367440957", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959027, "uuid": "7bb869cc-1f08-44d9-9eb6-f431ff9856a9", "comment": "Malware payload (Mirai)", "value": "243ac9624b70f2f59c3738a1ca3a481d68575289", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959027, "uuid": "556460a3-29b4-4969-b49a-16f503c55428", "comment": "Malware payload (Mirai)", "value": "81f1763355e306d9ad24fcdce63606abef547c2d44e7039e2a4a52b6d4bddd8d339d1fe5e9c61c747a5d0c33716fdb64", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959027, "uuid": "36a17064-85d4-44db-a86c-e12faaa04fb8", "value": "T119F0FBB9001BAF06C11CDE2AB539747BB032D79E445B8B847DC4A0FEA04C5617132D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959027, "uuid": "08678c92-edb4-4e3c-9593-cf1c284571b0", "value": "12:shA3xnphMXuYnphEBnphlaLBm2nphSNITRYnphfTWnN:eA5MeSEZlaLBmQSNIlSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959027, "uuid": "5db314da-6b47-4960-8ad3-7b2302f0753e", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959027, "uuid": "7223f413-a6d8-4b47-a47f-c8f96dbc9f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959027, "uuid": "76406f1d-4d69-4091-9824-1afa2e23546a", "value": "zxc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ceb58a-d198-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764911179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911179, "uuid": "906f7eb2-7e02-46ae-93e0-245f616af175", "comment": "Malware payload (Mirai)", "value": "06fa38f6198167f1d05081a997278807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911179, "uuid": "010798f8-8ffc-4d8d-a5a0-13a224fde581", "comment": "Malware payload (Mirai)", "value": "021c3f3c7a28c261d88b0ba318873e2587cbca5f54cbb0346f2a1a22cdb2aa3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911179, "uuid": "e35b822a-bffa-4eb9-a15e-8c7f1a58e2d4", "comment": "Malware payload (Mirai)", "value": "42dca7a48340d526087cd8969df8f4499aeb9112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911179, "uuid": "21060e1a-373d-45bd-8a0d-2e59d274da5f", "comment": "Malware payload (Mirai)", "value": "84b4bc53a7d598fe88b959a2ac3400bc413530e6fe2d58813fbdb961a482554803a3a9a045944df6b47487d2f16b0eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911179, "uuid": "c0e5286a-9ad5-4f67-a9e0-56774cadb931", "value": "T1FB63E886B8918B15C5D412BEFA2E118D332317B8E3EF7213DE215F15778A86B0E77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911179, "uuid": "1c508f98-7696-4eb6-87f1-854898e4b8f0", "value": "1536:ktn/ytjxsUAkrLSptSYdBqIiS8y5tWWyrO463aXOMki8UcY5xetu:ZeUNSptpdAS5tWWVUcY5xetu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764911179, "uuid": "1b17a100-c7a4-4bf4-b7e3-566eec32a1f2", "value": 71180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764911179, "uuid": "1fc5d5f7-518a-42c1-9d5b-b7238dc0c875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911179, "uuid": "eccf7c06-19b3-402e-a749-203d57a60ad3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8a3680-d1c0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764928347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928347, "uuid": "a33bb587-dbba-43d5-994b-2d470911c7a7", "comment": "Malware payload", "value": "a6494a39ce2dcc81123f04389caa7299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928347, "uuid": "a1eddaca-d909-46b1-a304-b7a4bbed9da4", "comment": "Malware payload", "value": "02f5cb563efd9c3c1f00acb33d9015dbf3c7cf7f14139e5063a578aefda72686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928347, "uuid": "8b0bf87d-7279-4057-9612-b7de661234e6", "comment": "Malware payload", "value": "aac548006da352a7d790249c67496fe2ff96153d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928347, "uuid": "60d541b9-8ddd-46bf-a90f-fc9f90f26c70", "comment": "Malware payload", "value": "77be3a5564a3fd34f61ed6ec7176d8141b81b35b42bee8e6f270eae8955fed96ccdac67f1b60ec407d9ade6e9bd85658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928347, "uuid": "48d80241-7840-437f-aafc-c4fdd7b21f6e", "value": "T1EEA32A47BA5784A9C08286F087AFD399AE3330544D1325F77F845B393D22AF29D1A7A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928347, "uuid": "eac7aa2e-eb67-4e17-b739-256aaa4b764e", "value": "1536:OpgFZZt/H0YCqy0vTkzYfXHjDNPWYxpIyjdtbeFPNdk/LWAY:fvH0rqdHlPWY42eFPNdkqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764928347, "uuid": "53a383d7-b194-4db6-9792-3495ce7924f6", "value": 104224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764928347, "uuid": "4aca1fe6-b536-495c-9454-d7125f7ef896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928347, "uuid": "57b47ffc-4e2f-4122-ac8b-356add7ef07e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcb2651-d198-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764911147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911147, "uuid": "0c574ba7-a6d6-4951-a23c-f8a5c27e5161", "comment": "Malware payload", "value": "2263ef9fb3e8a93dd68781d14c14a481", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911147, "uuid": "00b557d0-9979-40a0-a966-ebe298217399", "comment": "Malware payload", "value": "031322f5591b00c6d04b5705bf482e6e0ca01e65e37ac2ef1dd045ee9434f845", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911147, "uuid": "fd17359f-66d8-4a10-9d1f-15ac7490f014", "comment": "Malware payload", "value": "8ab8b489d2073d26cc7cfa1fcc8aff4853610d3f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764911147, "uuid": "fb48ffb5-929b-4706-8984-cfc9569a0e71", "comment": "Malware payload", "value": "6be66a3d7825da8fb895d6e1b24b6f015ae04875d88bee6e2740aefe193c68cd146daedadb7d6637f94caa51f4622e75", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911147, "uuid": "68d3a486-3274-4b96-8397-4ffc8b7f3bb2", "value": "T125E35B17B3A400BFD4669635C9A31A05F776B8120B318BAF0764076B2F637E19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911147, "uuid": "09d1eb8c-fb23-47e3-9d84-cea784ae94cd", "value": "dad9d5100f936dae0630265d8bbdc250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911147, "uuid": "1b0783a4-2dbe-4da9-b08d-cdc83a7a2fe7", "value": "1536:d/lNcfGlBbQIwugV3wwsJ+d5ZDr953iDSxS4U4I720cBbFqlQmsWipdP9dlKNNix:JlCulW+fsDr38IS4pI720wFdvwNInT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764911147, "uuid": "0a17b745-1f03-43f5-aa95-fb45c5300ead", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764911147, "uuid": "df9d300b-307f-4f12-869c-3265e5723d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764911147, "uuid": "0ce8565f-ab30-4b18-8bee-352169a78474", "value": "radcui.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845202d1-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959017, "uuid": "cbccaf28-24c5-4f43-93d9-ffaffb16fe74", "comment": "Malware payload", "value": "c147bfcccc841054056ab2d7f41a1708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959017, "uuid": "903806f3-3a99-4f81-8eb2-543717de6793", "comment": "Malware payload", "value": "03649d0f8bdac07babe4624eac2842fffd706ed8b3a16cb3f49ff3c06c6a3d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959017, "uuid": "51609659-bc85-44b7-9321-6f830bdf3188", "comment": "Malware payload", "value": "fe8ff7e401ec06bbc57a05eb1ac4ddf96c2560ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959017, "uuid": "cfdd0ab9-d12c-4e33-ba39-6104bf77667e", "comment": "Malware payload", "value": "97342a9ec47efaa57e0d070cfb2fdbea0568c8940be53a1bb2a0fcdda97e9077b7e1cdcc4ae11b39bea431dd92a9fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959017, "uuid": "90fcac3b-58d7-49f1-ae74-00010b1ea9e8", "value": "T1DA335C43722C0A17D5A21A70293F2BF083FEADA121E4B285A40F9F5A8575F371486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959017, "uuid": "1df21ffb-27ee-484e-b0d2-ab5af6de4f50", "value": "768:U5bpBuZFRRdcVPeltLLZnLjSLeECq40wTUE2VJl6NYSGf0RfquU:KpMFXLqeDn/mJYYSG8QuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959017, "uuid": "419a951f-a0a3-48fb-b9b2-df59de156e69", "value": 52728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959017, "uuid": "abcc1b8c-7dc0-4790-a424-b3355c2d7a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959017, "uuid": "04c71130-d557-426d-8daa-313bde2801fd", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df3781e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959033, "uuid": "22db35a5-7772-4490-a9d0-dfafdf6f2cc5", "comment": "Malware payload", "value": "c3d9249a34a7db2383d6cd99027ad96f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959033, "uuid": "b49bf100-f005-46c8-86dc-76416b5b72a2", "comment": "Malware payload", "value": "037a048dcc8aecc5ef7c49c45caebe826a32642d341f224d98ad2b1dd73b2d6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959033, "uuid": "b96f6544-0453-4142-8e4d-de6acfa70a94", "comment": "Malware payload", "value": "faeea7bf7eccba154e55d64727ea9abaafcdf8f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959033, "uuid": "2cd2fd85-9adc-4e56-b4f1-967ae9d16af4", "comment": "Malware payload", "value": "0ff1b25dc57b22463c2a34cce6050516630d3f628291b5488f6172e4eedf53d1d1863b1b472989b4540d436dec3b4824", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959033, "uuid": "17c11d5b-e355-4bd9-8631-b61ce0d3b65b", "value": "T19B1151BD023DDF3691096A1BB925703670BA07BE787B97A96ED46859344C4702122E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959033, "uuid": "030aef60-9af1-4c3a-b653-27b7af20ad57", "value": "24:66l5f6BSyGnxiN0jnnjGNKTEvSEn3/hxAnAq:nZ6BSbVjnjGNLLru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959033, "uuid": "dd18afb9-275e-4681-a953-5159a4026ba7", "value": 1044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959033, "uuid": "03c725c8-4a24-4244-b3ed-deeca64e3260", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959033, "uuid": "d651fa29-30a7-4568-b5f1-98b8272e665a", "value": "wg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a69547d-d1d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764938814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938814, "uuid": "2f017817-5495-465b-ac49-ed1b715d0655", "comment": "Malware payload (Mirai)", "value": "8490714d15dc7d5598eabb1d6f603bb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938814, "uuid": "e248916e-5ec0-4e19-876c-9aa235ae7611", "comment": "Malware payload (Mirai)", "value": "040cf04567387460ffa05c6682b79e3226d825870ae82f256633c07888208635", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938814, "uuid": "8c7bd024-1a15-4090-b7fd-5cadf65b8d46", "comment": "Malware payload (Mirai)", "value": "fc2a703c9ec0e94c77e3b21d578e530ad3a814f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938814, "uuid": "cf6ea8a1-e3e8-4227-8de0-bf17fcd0ec87", "comment": "Malware payload (Mirai)", "value": "f503004a2aa24e889c1c3eb30c6b9ed63d4a6ae4613fbfe1c2e797a61df2033e1e5bb66b54998e19847f6b0fad1d092b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938814, "uuid": "25814bc2-13b2-4599-bfcb-b68b977a3920", "value": "T15B114F7E782016D08528DE2579A6ED11B309E3D281CA3B276BFF6773E1DD9043902E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938814, "uuid": "f14868d6-53c4-45a7-98e8-ded5f48ae431", "value": "12:78ZGEZ1EZwEZpkEZXWoEZSEZ7oEZ7dEZ7mrN:eGS1SwSpkS/SSS7oS5SyrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764938814, "uuid": "60904669-1102-4ce8-a27f-10e198263ced", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764938814, "uuid": "88f74674-da8b-4635-bd45-8571aaf05deb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938814, "uuid": "56cd96b2-9eb4-4730-8508-15c7f2b71ce2", "value": "router.tenda-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2850d883-d226-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764972177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972177, "uuid": "ec37aecb-e235-43b7-a82c-3f70e3648002", "comment": "Malware payload (ConnectWise)", "value": "07521e40c0edeac4d7dc88183586c996", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972177, "uuid": "aa21d0ca-1e20-4d7a-bcdb-cf97c000a40e", "comment": "Malware payload (ConnectWise)", "value": "046a308ce6f588c842234d66c1bd770176419465a7769df9c98b0834e3fa02c7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972177, "uuid": "7bd87b45-c960-40d9-86b6-c7cb61a508ee", "comment": "Malware payload (ConnectWise)", "value": "6f85720bad5d456c7ba758925b965fc6fbc5ae16", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972177, "uuid": "41900793-68bf-48f6-9d86-76f569190521", "comment": "Malware payload (ConnectWise)", "value": "d7704b9dd9c99148ec042b38d4478810dfb4e805522327110e65f22d68333ca9dc4b7c1f60d94ed4c50d81774c23af12", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972177, "uuid": "193bfd66-0873-48e4-a364-9a598a6bf3a4", "value": "T1FE41520EDC5DDB642A8301F285689D0AC9B1C423B84A14AC7A4DCC979F315BCCB352EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972177, "uuid": "7c922eb4-0a99-41ee-92bf-5123c8696e76", "value": "48:Lv1Wb5tmGwJmXiwJ89wdkyaj8Lz8AExXqIsQ:Lw5URJmJ89wOyaYI/x6IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764972177, "uuid": "7b8e05d8-58ab-4c18-b2cf-408250c6df8c", "value": 2119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764972177, "uuid": "a9259a05-c9ba-43bf-962a-88ab4c71bc17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972177, "uuid": "6cd02783-6d8d-4344-bad1-f26bc93eab4e", "value": "social-security-statement-upd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c3313b-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909008, "uuid": "85b107af-6a64-49ec-add2-0698083e4bf5", "comment": "Malware payload (Mirai)", "value": "dfff9d7cf76d7ed2ba95f84b7e1605ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909008, "uuid": "4519b4e8-2223-483f-a8ba-78ac9ff840e0", "comment": "Malware payload (Mirai)", "value": "04755c04ffac694a8200f1f424c15a9d8824002b8d810da57bc2cc144e3b4089", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909008, "uuid": "6ac7548a-a49b-4c4a-80bd-c58519224701", "comment": "Malware payload (Mirai)", "value": "e9bed05bc2d7aa201b735156320f6322daade275", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909008, "uuid": "13a27f22-73e5-411b-9edc-a7ab4ae57725", "comment": "Malware payload (Mirai)", "value": "f0d575e1ad9ce991b484de1760e76409dd50ed0f9f04bd61bf93f4378208dbd8e02c3bf4917a5dc7bb684327184c3508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909008, "uuid": "193fbd35-6688-4705-8f3e-4baea294e705", "value": "T1FCA3DA5A7E224F6DF768C33457B74E30979433D22AE1C545F16CEB091E2424EA81FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909008, "uuid": "bc60433c-6687-437e-9426-f0eb6d3332b8", "value": "3072:T4gjxgFx+OHioNZD7h99CoFhBSaSLu9Zne7h6:T4gjxGoCZfh99CoGiM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909008, "uuid": "66d483c1-a2f4-45f9-94e5-19a959b95a5e", "value": 106088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909008, "uuid": "cc24321e-d387-42ce-bf8e-a40ed1ca7c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909008, "uuid": "874bc78f-c417-4211-95d3-dffea5db5aa7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6360754-d221-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764970241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764970241, "uuid": "ada1b61a-d54e-4cbc-a22f-fda8f52b75db", "comment": "Malware payload (ConnectWise)", "value": "45c203787e4a74f96718722866e367c3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764970241, "uuid": "c3af5002-dbc2-44ca-a1a6-427695591842", "comment": "Malware payload (ConnectWise)", "value": "04a295ee5e8c7e745b1f383e3f7cfb78a421dbacbb4b2db9d51ac342a9ffd1c4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764970241, "uuid": "bdaa0e8b-8d83-4639-809e-fa694ad7d71c", "comment": "Malware payload (ConnectWise)", "value": "5da6861e885a58ef246dfcaea07ec210b82f17bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764970241, "uuid": "44363c70-322b-4762-a5b7-fb44d65c62ee", "comment": "Malware payload (ConnectWise)", "value": "d9a9187f726e6b42a126dd7dd7fde76cef6d0204592771228b5ade8831aafbe7fef5450c0bad413609b30027bf1e3cfd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764970241, "uuid": "89252542-729b-40ff-a908-b5f2fdd21ed9", "value": "T18FA623116BF8D278F1F12A39D876A0B1A53A7D119E23D12E2324791E2C75EC0CA63777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764970241, "uuid": "8ee3e49f-15c9-432c-9337-c19313346ad4", "value": "196608:aHxcp9ym3nltDUJVSHxcp9ym3YHxcp9ym39Hxcp9ym34Hxcp9ym3:oGplpZGpmGpvGpGGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764970241, "uuid": "6c92e302-9357-44c8-8b9d-340f969955fd", "value": 9957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764970241, "uuid": "8a3bffaa-dbd8-4f44-9c07-6467134ebd7a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764970241, "uuid": "a6619fc2-f60d-4e13-9d53-7af5e03636ac", "value": "SSA-Statement-Viewer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a294f2c-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764933633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933633, "uuid": "a82c9460-7838-4885-8676-12d542ed7cac", "comment": "Malware payload (ConnectWise)", "value": "e540ac0ba5da5143251fbb3ef12f4123", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933633, "uuid": "d4836210-b06b-4443-b1be-fc38ae4c8220", "comment": "Malware payload (ConnectWise)", "value": "04d1164fa6365282a8b8c0cce534d33854d0ba6e64d34906e32501bc906863dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933633, "uuid": "e1ee6d9a-6e33-4417-b6f0-258d45c53aa2", "comment": "Malware payload (ConnectWise)", "value": "e67fd0cddff9d9da25bfc66b9042b15a235dbd5d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933633, "uuid": "8288b858-cf3f-4165-9c5a-474697c22049", "comment": "Malware payload (ConnectWise)", "value": "d45689f51e6603ec324163cc927421fbfcb5bba1f88f16caea5289e14d24987801f9d3fdf246c4e13fe1722aedf873ee", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933633, "uuid": "3407e6f7-ad4e-4a9f-905c-ba8065f0eacb", "value": "T1E0A6232523FD801AE8F75A7DED3682F45971BE64CE22C11E9328790D2A74D8096737B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933633, "uuid": "4f5862ba-e009-49a3-8aa0-e75590cc76a7", "value": "98304:owJ4t1h0cG5FGJRPxow8OEwJ4t1h0cG57wJ4t1h0cG5uwJ4t1h0cG5RwJ4t1h0cW:xWh0cGwnWh0cGiWh0cGFWh0cGIWh0cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933633, "uuid": "1a819302-d235-413c-82be-6364c6f22cae", "value": 9924608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933633, "uuid": "d564601d-ae49-4dc1-a0dd-d8c9ccce258e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933633, "uuid": "daf084cf-4f26-4d7f-80a8-cc2e9291d46f", "value": "12-04-2025.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b454a123-d1e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764942777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942777, "uuid": "a5c465e5-a25c-48b0-9dfa-5840d231d735", "comment": "Malware payload (Formbook)", "value": "82b1f625bb94646b508d433eb5600cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942777, "uuid": "a5053777-4ab7-41fd-b5b1-431aeb2daa80", "comment": "Malware payload (Formbook)", "value": "051a19599ed53c233debbd32daa4645bae40e766b387d77a44428f61ec1046a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942777, "uuid": "b813151f-b0ca-4a70-b0cc-ec208d247e9a", "comment": "Malware payload (Formbook)", "value": "2fbf236441e3bbfdfab3883d4ee9a1f2638eb02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942777, "uuid": "cc1816a0-377f-49bc-9283-eb205457e0c6", "comment": "Malware payload (Formbook)", "value": "b97b3a019b0fd40282aa10ab34de495bb8376c97e9a5d66811a9beb6461a59219dbed9e3b1f5a58a93ded56a20a89bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942777, "uuid": "bf341c7c-9702-405f-b1b6-944523f0a362", "value": "T1EA36A7A45DA06710E7D683FAB05AB9CCE92E3C2278D9CEE4B77FD49424D5C30EE05906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942777, "uuid": "c1d6e49d-7252-46d5-b58d-05c292b1233e", "value": "24576:15DnyOOCzV7Iplm0lfRf80MVFJvxQyCNILR4LArZb9eGk1EAkxDEEa9GwfB74If2:ZzV7Iplm0lC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764942777, "uuid": "b18ee4cb-f34e-4208-b1cc-41b4278b331f", "value": 5277702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764942777, "uuid": "f669311a-3aca-4631-a2ee-4beaa6bd0dd0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942777, "uuid": "a719d035-0a3f-461c-936b-f07173e20cfe", "value": "Earche.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd034522-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764933799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933799, "uuid": "729743bb-8cde-458b-b1ec-22bafd4c2670", "comment": "Malware payload (Mirai)", "value": "853f986f6718f75c7df998628d8f88c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933799, "uuid": "6428a90e-43b8-4b2c-8437-bbfc909f4426", "comment": "Malware payload (Mirai)", "value": "058a01a539a5dfe1b03a442018a6bbc1dd327185273b2ecf901cd5cf7b76135a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933799, "uuid": "4ad61e0b-3705-447c-ba16-feaa14ee3893", "comment": "Malware payload (Mirai)", "value": "039efa78acdaa398deb37a05879ec3141ac3dc82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933799, "uuid": "ca159bee-5951-4510-83b7-773bc8752e07", "comment": "Malware payload (Mirai)", "value": "8e256bba65ebc95035f6354a92951fee18db1872ffcedcb8806d16c2fcdc15b322fd9983a49dc4bf825ae77886c1df24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933799, "uuid": "d7150447-9efe-4fff-8219-6ac76c99371b", "value": "T18111034F341135A1C254CDD134BDB93D6E655B8D50D83F2990DE0E32C0A86183E5ED79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933799, "uuid": "81a348bd-3350-410f-9131-e56cabf8ba06", "value": "24:eXwjRTRswjRTR1wjRTRpBwjRTRiwjRTRrwjRTR7dwjRTRIwjRTRJwjRTz:e4DRDODpyD/DkD7GDlDq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933799, "uuid": "6b2e43de-0017-498d-925a-423bf46ac639", "value": 940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933799, "uuid": "5242019d-95fe-409b-ba5e-a5b52be45fd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933799, "uuid": "ed4c977c-e687-41c5-98f1-f9f9dac4d6fe", "value": "dvr.lilin-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898b058e-d1ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920371, "uuid": "b21bd4f4-9653-49ea-9db6-86c8a2d3ea96", "comment": "Malware payload", "value": "b76102f47f5f1f5dd280dc6d74aa01ef", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920371, "uuid": "3ade41fd-2890-4151-8721-94ac842540ee", "comment": "Malware payload", "value": "06ad3e407d5370648350e64e11278fc974197ae26fa02457c5dea645d3936bc1", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920371, "uuid": "32052dbd-c889-4d30-b4d3-82a1e2e3f489", "comment": "Malware payload", "value": "4a48d89b68686d6c1b92f024ae6d5428e7c39563", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920371, "uuid": "2d3b0d80-487c-4e01-9201-a4a464ce49df", "comment": "Malware payload", "value": "a81fdeb2d54bc87d76810860e23bd3a9e7b96d20fa8aa5a1de551b5874baa95e50fba5cd92377203dd23ced94263d879", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920371, "uuid": "a1772c0f-481e-4605-b945-c0abd481b2e7", "value": "T1DA01105F210B98FC80E0D4B0A0972F0BDBD784C32203F7F4360A42E8512B29992EBB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920371, "uuid": "41e03972-84f2-4e34-9ba1-032fed06f109", "value": "12:wbYVJ8z70mbnh1D+gz08I3bkzdXzGjLRdPPPqBQAloOVj0V/+w2p7IKWNZ:wq8z70mjz1y2zGjlZPqWmoOVul2lIjNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920371, "uuid": "306876fc-8afb-4ea8-a5b2-8470461fbe01", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920371, "uuid": "b5428f59-ab4d-49f6-98d8-93831dce30e9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920371, "uuid": "f2728467-4ad2-49c3-bb34-f2f9e6f5e44e", "value": "document (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023f25a0-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764919715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919715, "uuid": "f77b3a7e-92c9-4c0a-92e6-03f0b88b2c43", "comment": "Malware payload", "value": "3813821dcdd08ae7f9b6af77c9b54a1f", "object_relation": "md5", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919715, "uuid": "ab13e438-85fe-4940-8ef8-9423aab7d717", "comment": "Malware payload", "value": "06e68f0ac7706a4953a9fdeefe14e8a0386edab3ecb348a6768821c8305a5b1c", "object_relation": "sha256", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919715, "uuid": "a9bbd24d-9993-4ccd-9ef5-cb8f64f7e429", "comment": "Malware payload", "value": "0a177fca93d2273f957494903f4c7dd6bdc2f51b", "object_relation": "sha1", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919715, "uuid": "1808c95f-497e-4ea8-9a0a-89aa4129c0c2", "comment": "Malware payload", "value": "2cbe2aa9ad586fb486b277ebabdc5c125389f38358b0fd9b7d9043cc7b7695e15fa74a559463b8deada3eec1aefd03ef", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919715, "uuid": "25553039-3e83-4dbd-bba0-63d113b896ce", "value": "T188183365A1447AC7ED8BB63671F06726FD9E023460F1CAF2F9C651340AC34E47EA523A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919715, "uuid": "4a26e39d-68bb-45be-b589-328c10f2b1f5", "value": "1572864:SzRw3AonX6vRGUOBelAEfnMNsiwxVrX9tf41uI3JuD2NbWffhlybBUBirtt7arbE:Sdw39eRGURVfnwsi4l41uI3GnhlaWB65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764919715, "uuid": "b202edcc-31cb-4ebc-a378-ca4c8c1b988f", "value": 92434553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764919715, "uuid": "f0b28912-6756-4f14-83fc-0eb673ed0d32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919715, "uuid": "cbee8ab4-e0bb-4532-8f0b-1e0c893ab587", "value": "06e68f0ac7706a4953a9fdeefe14e8a0386edab3ecb348a6768821c8305a5b1c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c5a06e-d1fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764954728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954728, "uuid": "c8e6e1dc-ae40-45b9-bfed-cb07e42ac00e", "comment": "Malware payload (Mirai)", "value": "dfc1149d4e1e1c60fef46455f13a50ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954728, "uuid": "aaea28f8-d2e9-4951-b69d-7704c907ca65", "comment": "Malware payload (Mirai)", "value": "0705f5a342ea237551b841af4a31104dbf760698890777b36258ae307af04d7d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954728, "uuid": "cdf3e46b-a5c9-40c4-b8cb-ba462f3b4295", "comment": "Malware payload (Mirai)", "value": "f6ac631f38aff581fb7d0143832b5b24256bb7a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954728, "uuid": "cc6c28f9-c8b6-4073-a7ac-f516ff3fb089", "comment": "Malware payload (Mirai)", "value": "6f4a1fed4c1d2d1f847b944453680722e2bd85724c2c94fd5b4fdac00602622934bbaac798ea84af14495c49ff93f683", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954728, "uuid": "502b8338-a71d-42ff-a8a0-33a4bc42a102", "value": "T13011336F2420158091A8CE417EB3E90BA1D9D296D9E0FF3792EA1F7380F87087D43E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954728, "uuid": "4c32452d-81d7-4f51-8411-3a0b1b98dd0b", "value": "12:78ZGnzZTnzZUnzZpYnzZXWcnzZCnzZ7cnzZ7LnzZ7Enks:eo1L1K1pm1d1s17C1H1eD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764954728, "uuid": "c477d4a5-bec7-44f5-8383-1968593de35a", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764954728, "uuid": "733b030c-8cfc-4517-91d8-cec8496e56aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954728, "uuid": "3ed90087-b5b7-4b77-8523-345ed08348b0", "value": "dvr.tvt-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d58f1ca-d206-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958388, "uuid": "d962058a-bd8d-4355-bb33-c98c3d142a01", "comment": "Malware payload", "value": "b04f0c96fb3696f1989d70b947818551", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958388, "uuid": "2b0ba048-ded6-4f3f-80b3-79beb01b3c15", "comment": "Malware payload", "value": "07a3cd112d50a1758a535cc97221249993a84090f5144ed81d235daeeae525e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958388, "uuid": "d04cea0b-a3b5-484b-8e79-af110393bab4", "comment": "Malware payload", "value": "891384d4a86766d7c28ca921056f535a499caeec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958388, "uuid": "6f4501cd-41e7-463b-b5cb-197143e7840c", "comment": "Malware payload", "value": "4b9d7b8f6bc029a6caa665bb98e6331abad0ec0f3c1dc5aa2fdc6f6da0839fc542f94584f0b3187cf449126233855a01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958388, "uuid": "ab9c5147-1d6e-44ef-a012-4e680a4a450f", "value": "T1A5730849FC819B11D5E922BEFA2E014D336367B8E3EEB212DD111B15778A91F0E77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958388, "uuid": "560e25b5-b2f6-4d4b-aa29-71e27537754c", "value": "1536:GtnLckVyKSiB+pyOS8Izth6HFfKd/uFgkC4dlsfiWPMBwDsuo:gV9SryOqh6HFfKd/uFgvXPMAsuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958388, "uuid": "d656e2fa-732b-4489-b470-8393ff88283b", "value": 73384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958388, "uuid": "732fd651-8e52-4189-9335-af3e2970331c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958388, "uuid": "66d57efa-9be4-4d0b-9db8-97a027304489", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efad12c0-d205-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "b7a372bb-b29c-434f-b762-088d5b4c6fc4", "comment": "Malware payload", "value": "0379192f18c37c2ba107606e20d42efc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "c159a72a-810b-488c-83b5-8db9bb4b7ab8", "comment": "Malware payload", "value": "07d16a7b4766cda66028f363161111b77ff3e2efa6b5898ce533dd6144eda829", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "30407d10-5c06-44aa-934a-53430c14c02c", "comment": "Malware payload", "value": "e2905c624fbd027d0de5f7fdea65c086590bc0a9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "b7a5e7d6-86a4-4c74-a783-db33ce41dc09", "comment": "Malware payload", "value": "c48031f1dfd34c3f8e1b6ebcbecb9c3851f1af0c14c67242e17a35bc177f8b21c82b1edaef8405a6c72566f096155cc3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "948d015c-94e5-4fd4-9675-9acf6bfc2327", "value": "T197E512BB58B2A957AA504663EB0F1C0A335B19D53B14C346EA51909C7F3B1D3CEA2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "38b84255-cec4-4278-bdd1-04c2cfee9d38", "value": "49152:oOc2yD4lTPqpTsahG9o3wGOKTy/KWg3+Zu+b1y6neBVwU0coXO337WwFlS:ooyEFPCQal3X13SuQe70NeFlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958338, "uuid": "00e1ef09-cd88-4e15-ab99-de8feaeea9b4", "value": 3072067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958338, "uuid": "1bb651d5-56a1-4955-be79-956b919c9d63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "8f6b860c-f7d0-4e17-94fb-b0d8022eab68", "value": "REM 2526 B101 INV_PL_BL.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d474f67-d20b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764960643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960643, "uuid": "dddfa174-84a4-4a36-a80b-79e2c87b4cd3", "comment": "Malware payload", "value": "aeae205e53e40acf3562c9386e2f9d50", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960643, "uuid": "52486c8d-ff5d-4c8c-a798-eea7372692e3", "comment": "Malware payload", "value": "082953c9d88a970cafbc692ec0114ae081b0283ed0d71700db03c1f7e55b256d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960643, "uuid": "83828268-7fb2-413e-a5ad-ee41a0c9cff9", "comment": "Malware payload", "value": "c34f9010025ab820dd23bdcd7dd86fafb0e00db9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960643, "uuid": "cbeaa6a8-398e-45b1-ab06-11174a05f654", "comment": "Malware payload", "value": "8945ed558c9da5e1d763730b10c7a402fd68fb2609bc40c3beded840fdd6d83fd31d3d0e231bdc560293a49ffd8c12bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960643, "uuid": "7b7750b1-012c-4a53-aebd-8ff47654635c", "value": "T1FF116D6F38339E979608C700FCA7F900B514828030E3EB66A1DE1B3582E9618F922E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960643, "uuid": "3ac47669-9d9d-4e11-a9ed-35fa22f2bf6a", "value": "12:78Z1Z5ZwZ5ZPZ5ZpTZ5ZXWnZ5ZxZ5Z7nZ5Z7YZ5Z7fZ5o:e1dwdPdpTdydxd7nd0drk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960643, "uuid": "3de2e49a-8c66-4e70-82f3-cc47a38fcd9f", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960643, "uuid": "bdd9453f-5104-4486-9a7f-4b57433c4db7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960643, "uuid": "20b0bd9b-dbac-42cb-a55f-571c005d4e03", "value": "router.dlink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26b4597-d1af-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764921406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921406, "uuid": "c42ef6cc-3206-45e0-ae2a-c1040f5b3288", "comment": "Malware payload", "value": "34f3066c0288058bcfbcddbc090113c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921406, "uuid": "6c1624d9-d1dd-4213-a83d-92c39c8d5337", "comment": "Malware payload", "value": "084673cd72a0f8ecf41028d880f96d73c9b7c10d51e6ee87a1c80748194a59c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921406, "uuid": "e5d96c81-34f9-4d03-bbb0-9636e16d638f", "comment": "Malware payload", "value": "2908185f474ded3438ba4db077fdb4dc424f3483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921406, "uuid": "3cba014a-0cf3-48b9-a48d-3c29c7d56d3f", "comment": "Malware payload", "value": "eb3f6b32468e4f2ba37c6dd2b4821a79c8cc72e7cc4bb603bcd28b3c76ca545f7a9e4caa880f4a01051e5f872e838af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921406, "uuid": "07743ecd-4ec3-4b5c-984c-6d6da8cb2c2f", "value": "T1ECB62321BBF5C478C68E5132893CE6A510B9F617C72094C776D02F6E7F319E6C934A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921406, "uuid": "7c5a1f66-c024-474a-a55b-1479bc305bed", "value": "1992be5480f6c5cbb0ef0df5260975b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921406, "uuid": "6d2bfccb-0c96-40a0-8801-e3da31d5d921", "value": "196608:ZPlCT3PRzWFIvNfHYBCqqeCmy3dmb+wutEiPI153FZICQDjM0F4S+BSu5mWsGyow:JlCT3PRzWFIvNfHGCneCrGut9PsXDSwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764921406, "uuid": "2562f6b1-b994-4527-94d7-7f4cafcabdc8", "value": 10694642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764921406, "uuid": "f25a8fe1-54e6-4b3c-a3c0-cb38c9341ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921406, "uuid": "0a47b164-4d0b-402d-9811-b3d3b61aebfa", "value": "exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df19381-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933639, "uuid": "df4238ef-7976-4f7f-afd2-43d956d33800", "comment": "Malware payload", "value": "61fb8cb0ccfdafed9afd8c1489d8f776", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933639, "uuid": "3be3fa33-99b6-4848-970e-b9f62d4dc6a0", "comment": "Malware payload", "value": "0868aa9970621530e1f953caedb420cd7dd909d344ed3ff2e91dbf4972301929", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933639, "uuid": "c01fdec7-95de-480b-8dbc-d5dbdfe3cac8", "comment": "Malware payload", "value": "0c080c021b1e960017da72e330a4e706d0d67416", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933639, "uuid": "66bd8389-80e9-4e43-b327-0f6c91f13df4", "comment": "Malware payload", "value": "7258dc559065808f6db132ab46078d98cd93af696de0fc461ad64973b6daf68f073ca7f46dd824ac935cbb84f406703c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933639, "uuid": "2fcea235-f54d-40e8-8b75-f227b98c74ba", "value": "T1AC36336991043F79EF61D8232A6508EEA8F1291C4E5DF69F5AD863233F97BDF25480C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933639, "uuid": "7609adbe-bc96-48c8-923c-b08083ac4acd", "value": "98304:7CqYgECGVW1ApWwyyMpXBk8unBGvkFh9j+ELkwr5WZRoequ:VECGVxWPyCfUpZfx1equ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933639, "uuid": "61f3a239-7bc9-4dd0-b7d9-84d2d97c1c0d", "value": 5108052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933639, "uuid": "d2333660-e465-4256-a70f-5946f3a48a45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933639, "uuid": "a893a4f6-ae21-4bb9-ae43-896526f320f8", "value": "HEU_KMS_Activator_v19.6.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e254b42-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958470, "uuid": "32e89c90-2656-4683-be0a-197c58e58cd3", "comment": "Malware payload (Mirai)", "value": "2ed44923b2ceeb70fae80d779dc4b99e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958470, "uuid": "522a7840-7e34-43ab-95cf-6d5b33669cb5", "comment": "Malware payload (Mirai)", "value": "08db6057a8dd814e12530d62c955db924c4b6aa0373102012b18df8dd64ff605", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958470, "uuid": "f352a6f9-0276-43ea-af0a-982114db2b73", "comment": "Malware payload (Mirai)", "value": "c7fc8a25f287cbbf7438f51a18b6e028d2e7c7dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958470, "uuid": "8676531d-c850-4867-aee0-8c6bee7df35a", "comment": "Malware payload (Mirai)", "value": "439055337c2f33c994e12ac44e2626a83f139ce407790592c1d5fdddb1d649d2dc09067b26da3c18f31611c7a1fd1e71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958470, "uuid": "18efd869-c861-4139-a880-db197dd7fd0f", "value": "T1F1235BC49513E8F4DD1A1AB42533F7B36B72F43A0068FAD3D765EA33A84271196062DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958470, "uuid": "a6212d48-4a5d-4ec8-a698-8dc49cd36161", "value": "768:CZP/nYqsK1Fe3wxl6oORALWWbDNncOYz1gkQtI0swl2a8bEYRB8Vd6zk:CZXnYqsuFe3tF+XbDe7z1gW0swB8b1zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958470, "uuid": "16e009df-8395-4f76-8fbd-0ce9c0c9a4f2", "value": 45712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958470, "uuid": "7af3948c-e5f0-44f3-a061-eb47d8f5a3ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958470, "uuid": "eedbee57-d13f-484d-8ee7-088218ec0f10", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0de7988-d230-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764976701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976701, "uuid": "b51f33a8-0a4c-463c-a1dd-06e0bb82b01e", "comment": "Malware payload", "value": "6b6eaca13bf9ab65142a5b78ebb82f75", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ceta", "colour": "#82D004", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976701, "uuid": "1ebc615c-009b-41a7-bff8-9e3cf3f7e01d", "comment": "Malware payload", "value": "0983a4241dfa150a49256f62c20c35372d44264254859d2f1b21e6b1a22d428c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ceta", "colour": "#82D004", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976701, "uuid": "89e17339-2a86-4cee-b436-4f7417fb99bb", "comment": "Malware payload", "value": "2468541a793181c234a6ecbcb33e95c0d0aa1b3e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ceta", "colour": "#82D004", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976701, "uuid": "78a5bdb5-3fb3-42ed-9b2a-462632f3e699", "comment": "Malware payload", "value": "1e69d11f1471258f4717b80f5a68029a305a49a5884f88bb13b2e77739638336400d6fe0478744666a41146fb5677f78", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ceta", "colour": "#82D004", "exportable": true, "hide_tag": false }, { "name": "infected", "colour": "#66E3B5", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976701, "uuid": "35521bd9-d7a7-457b-9b1b-4f6943a03581", "value": "T17F35332CBFD60BED54D9246F7A8D8C0FE230D8584D876621FEA60BFA1783551A4D7483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976701, "uuid": "1f27f254-e7dc-4d37-93eb-28763c579525", "value": "24576:fKSHE2OiYIhlH7uKI+3rRzGBKYq2XuGp0LVUdITGtp6OLqHLIhCcYQz:fKgEvIf7uKI+bRGKn2WUPpdOHkYcpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764976701, "uuid": "09ff22a8-a2d7-4fa2-a36a-f1bf88141a70", "value": 1152378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764976701, "uuid": "6b3f4e85-ce39-4405-8b4f-2576685b0fe8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976701, "uuid": "9304ebf5-6960-4421-8c02-df24436196d0", "value": "93edcefd594b05639dbb78717d46be43c30d8b988d8df4c2df813cff23631881.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b800eae4-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908853, "uuid": "abd1dc02-8860-4bcd-a9d4-7c1e39d30e16", "comment": "Malware payload (Mirai)", "value": "ba01c8b711e1d1ed08934de0b8f601a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908853, "uuid": "c4601c82-515b-4083-90f0-3f1fa1d72a1e", "comment": "Malware payload (Mirai)", "value": "098907b47283587b02b9d00af16a9441697a234bdd089cec9a91bb9c6e62aa18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908853, "uuid": "7b69b563-fc36-4483-9d61-803dab7b5062", "comment": "Malware payload (Mirai)", "value": "0a9221e3c80dc1bdbece788284be5134602952e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908853, "uuid": "5b7bb114-59de-4359-90e8-81763e280963", "comment": "Malware payload (Mirai)", "value": "ba765ff302c4d5a1dc6ae530e743d49df5a565bfb3ec26db91ee4655705f72fbe90c42b0758e0d97bfa92b543f1e9366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908853, "uuid": "6830f29c-8987-47fa-ac77-9bc3bbaeb625", "value": "T142732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAC2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908853, "uuid": "6a02e665-b7ff-45ba-bb43-4baa75e05bf4", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908853, "uuid": "c2ec4ff4-07b0-4ce1-86fd-dc15e122bea5", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908853, "uuid": "e04bd7d8-bee3-4ce9-b8d2-3111f9dfb635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908853, "uuid": "37826d6a-cfdd-418b-8180-902f245ccd89", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34f6fd1-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917542, "uuid": "ba6e8cc0-9dc6-47ce-95a9-123bd7c19cd9", "comment": "Malware payload (Mirai)", "value": "3a653755848820669bd74b8e0e9134ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917542, "uuid": "ca0b0aca-e85d-40db-a8e9-8fece1160ad6", "comment": "Malware payload (Mirai)", "value": "09ca272072de49f5d6621d6f93ed2d11f02c343d194307ef98428c065045238c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917542, "uuid": "a340d0d2-54b7-4126-9174-79f759cf1f5a", "comment": "Malware payload (Mirai)", "value": "5ababd92bd66eb1516d8ace3b69246619c355f4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917542, "uuid": "624d5e1c-875b-43f0-b172-40747a4f7c46", "comment": "Malware payload (Mirai)", "value": "29974e1d1c386ba26ffafc8aea40e7590b993ca1d526b818777b9636b79097f508a5f42c86406a64d3acc933689698dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917542, "uuid": "6b9f5483-0c00-4d3e-8418-1e9ca3280772", "value": "T1FF6328827880AA26CBC0177BFA5F108E371457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917542, "uuid": "11d565df-b90b-41dd-ad6b-0595f3b3f6b5", "value": "1536:dhqCA7shuOz506mE282prPw+70w4Y8jkMhW65g8Yn:dhq2Mpjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917542, "uuid": "be343b8b-b6d3-4611-84ef-01f785b898f3", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917542, "uuid": "9cf7951a-64e9-466b-aaf3-fdc0a88b3532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917542, "uuid": "2c9a7146-8573-4264-9279-28b5c14f381e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15f29b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958946, "uuid": "16b153cc-2b68-4f30-bf35-c9b324763090", "comment": "Malware payload (Mirai)", "value": "96c6f3deb116d127485456d6d3c29e88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958946, "uuid": "2842fcac-994f-45c3-98ab-5c2142e99465", "comment": "Malware payload (Mirai)", "value": "0c085ffaa3b4a10f1edcb218d4bbfb35454f87cefc1e41b98b29acc313452508", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958946, "uuid": "9573ee5c-9b6b-4bfd-9b15-b19ea05fc05f", "comment": "Malware payload (Mirai)", "value": "83014fe4047e39f39274b9408e2c28a7b65767e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958946, "uuid": "03edad89-bdc9-4230-ba66-bc8d784d882d", "comment": "Malware payload (Mirai)", "value": "2031cf92686f750685ecbc7b311c188e01b6eceb26f64c6603723058cf2211bfc45e90c14e108f896de1721aa01a8797", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958946, "uuid": "59210e4d-d592-4444-9acf-c41f3eb792ec", "value": "T10D3163F504D1273ECC80C6167356582D60396EC66E3B5ED8D9CF68E57350EE2B122D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958946, "uuid": "9ae58fcf-00c4-4ec2-8931-7d428492f873", "value": "48:2ovtZFB7vb5cv33MULvf4z00646IIjOOcUmh6olwE:2ovtZFB7vb5cv33dLvf4z0065IISO9nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958946, "uuid": "ca2e45c3-ba4a-45d6-a689-c57e7d9cf894", "value": 1642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958946, "uuid": "7cf09b35-dcd9-43cc-9445-e2d8cc5f1aed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958946, "uuid": "af6f811b-7821-4cd8-b678-a4cafad4a875", "value": "wgets.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012e2207-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958367, "uuid": "9b53e7b3-ff2c-49cb-945d-da7047999871", "comment": "Malware payload (Mirai)", "value": "352ca2bbff534a142537fb804474e014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958367, "uuid": "89b25d48-1e5b-4253-adb0-693c06f7e3c2", "comment": "Malware payload (Mirai)", "value": "0c0e0197281653b487b1b0360f6fea8f390ad7a96a6154d60ee8424589b9beff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958367, "uuid": "339b1571-0b5a-4317-ab0b-40f44525502d", "comment": "Malware payload (Mirai)", "value": "a8dea5e082c9435c76766d6d9c6459c346274a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958367, "uuid": "37662cd1-bc82-4e71-8cc1-61863eaaa801", "comment": "Malware payload (Mirai)", "value": "5355ecd7eb08ad6e01ac3a179bee2947b0675f857f1de6588ccd0f648a21216fb2b1caf58b5112bbfd0b73251a3a8fbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958367, "uuid": "ab1a65a2-0083-413e-9a6c-9431ca2d902f", "value": "T169C39C36D0697DC4C0905634A4B1DE751BB2F1C442562EBB2FE9C8A94083EA4FA1DFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958367, "uuid": "32864010-ef97-4bad-a788-352d32d84da8", "value": "3072:6ikZtzO/juDijr9BJ9LhsMIiVxt7GOu3/c:6XZNCuDcXhPI4x43/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958367, "uuid": "180d5f69-0f5c-4171-abbb-aede8df5a60b", "value": 124428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958367, "uuid": "75bdd5af-d04c-44e4-82fd-406ec638226d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958367, "uuid": "42dc38be-77ba-4477-bc0c-634a031a985b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f43f14-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898293, "uuid": "556b741d-1133-42d7-bb03-8080186fc649", "comment": "Malware payload (Mirai)", "value": "8f06c775abe58adb08d66436c1e2238e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898293, "uuid": "a0a03150-bd52-43e1-b4a6-4270100aa96d", "comment": "Malware payload (Mirai)", "value": "0c6886926a912b41592508d37b08008221abc1a8ba4dbfa0108b0a8d7a41c450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898293, "uuid": "22d0a4bb-d034-4f10-9e6e-c55aa872294b", "comment": "Malware payload (Mirai)", "value": "85cf024de770900b90c35ca3be1d7ccb80944158", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898293, "uuid": "cdf23f55-6a21-4908-9944-476a1b196ead", "comment": "Malware payload (Mirai)", "value": "9f8924eca69be5bb1e622da30b72b697894fa39ae49d431a659158520c3fbc11a2332c18d06ba67fc3809ab82b47ffa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898293, "uuid": "c3871d92-1ae8-4761-9083-b3186cbf3603", "value": "T1CE83AE67C8146F98D0444A74E1F29D7C1733E51482272EFA59CAC5AA9883FE8F60D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898293, "uuid": "83bc5c1c-fbad-435a-8aec-a3a84b154276", "value": "1536:Na+Q1JNpAIoZOSxRpHUp9uiGp36m/N6XNg4KNzKVH7QniIdBfCNnJh:N98npAIoZOSxRGZG96W442VaiIvIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898293, "uuid": "11395854-d4ab-44cf-9e5e-4d2faafd60e9", "value": 87820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898293, "uuid": "ee0c76d4-ad8d-4ae7-a56f-46e9259c387d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898293, "uuid": "377dd3b1-dbda-4a1a-bff8-b902c1318f40", "value": "UnHAnaAW.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39252fbd-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933551, "uuid": "225418bd-4088-4b01-8571-35e1ea7a8884", "comment": "Malware payload", "value": "f8c784ca8e80fd7be0a7153c1645349e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933551, "uuid": "b931cc54-cdd4-47c9-ba8a-e61a680a5fa4", "comment": "Malware payload", "value": "0c8085cea946d655b266998fd60b1da33df73a4285328da3dabc7f0e7211411d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933551, "uuid": "79c48d29-ae76-418e-b040-d30347295e59", "comment": "Malware payload", "value": "37b561a70163e60bda2c2ebf2c8dca4a0ae7443f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933551, "uuid": "460d7a87-69b7-4c67-b971-97b179500d39", "comment": "Malware payload", "value": "133284f71f6de39c96183e9f04ff47384538e96fadb7633d848bfe1b425a5486c6dcfbd8943dd03843b4a62142f36064", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933551, "uuid": "2f2ac262-e312-491e-a08f-73dff1eab6ff", "value": "T15B761203F74E492ECDE2BA78195313716A156CEC2910928F4D02F218BEB76D96F26FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933551, "uuid": "c423f057-6e93-4b95-b168-9237a641d30f", "value": "196608:whNjnAwBTJdQdGSxGtyIpYETZFb+r4eCexh:whrBrSYdmETPCf5xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933551, "uuid": "4c8e892d-95eb-4321-b53d-e3220490eb22", "value": 7640329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933551, "uuid": "7ea1832b-0ca4-4374-9531-c36dfdd7517d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933551, "uuid": "8730ac88-013f-4b5b-8a5f-741b864cbf79", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c74b2c-d202-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764956838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956838, "uuid": "6ecc3134-911e-4f3b-8f2a-e74d6bdf9976", "comment": "Malware payload (Vidar)", "value": "96d4f1d09463375930e0ddc07855c5c1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956838, "uuid": "29204df2-b9fa-4f00-bafb-f3ad72d0f77d", "comment": "Malware payload (Vidar)", "value": "0c9301f5c5f201c935901b5e4c2b60d196011dbf6bf5ce706838b5bbee78a789", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956838, "uuid": "c482d3d4-db8a-4d72-86e9-efcde711cdbd", "comment": "Malware payload (Vidar)", "value": "8c434d5f7f416907c5211b646b036aacc3a03e9a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956838, "uuid": "3ffc6d58-d707-4cd1-b566-edcb629a6e59", "comment": "Malware payload (Vidar)", "value": "b153d27064136a745bc23612dd8b5ee91fed9dcee3ffaa8193d40677cb6cab8db20444c362874301a630d62f09229b12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956838, "uuid": "d5492d15-932f-475f-8ae8-af58e503fc8f", "value": "T1FDC423D1B3D84A70C218C5BDCA05C8B6A43F1E329E276EAF3F8418825E9DD3CB512365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956838, "uuid": "19dfeee0-bc3f-4ec5-a381-cfff4b25a50e", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956838, "uuid": "df013196-6966-4dab-9dda-9a8cd2d864f7", "value": "12288:sa8ymlVGy++Q+XTimP2N97yjPSB7r2OhXKA2JbOyf6tY3:s9ymVG9oOf9OjqBzXiJPf6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956838, "uuid": "8562bb0d-abe7-4e81-b5a2-7ee3863c58a1", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956838, "uuid": "d385d0ee-0f32-4e00-8647-9b22ecf99ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956838, "uuid": "be04a939-3478-4201-a967-db0472f0ccac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c88ee1-d181-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764901447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901447, "uuid": "06ac483e-d73c-4d67-b062-a4b4e8bf85fb", "comment": "Malware payload (Mirai)", "value": "cbec8641d419e2f286e6b7ccf65ca4ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901447, "uuid": "1e144366-1c69-4fdb-8d29-d020924eaab6", "comment": "Malware payload (Mirai)", "value": "112481469fb1a0e94a8f0a34ff70b76e874540f3913db2a1d6b9b6c3899367e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901447, "uuid": "dd8a0dd8-2be5-4e6e-96d6-ba333d97f1f4", "comment": "Malware payload (Mirai)", "value": "d207dab6db736ad05aca643f73e1064f4a93576a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901447, "uuid": "49b22d52-21bc-4106-bfe6-3581a5165bee", "comment": "Malware payload (Mirai)", "value": "b9dbde08013bbd5764a966ca91793b5584ce70044e2d6426e3f18755b66d817db8c8f2d19369a630b92404c63f8a78be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901447, "uuid": "4a7bc3e4-435b-4289-bd92-517d8050bc38", "value": "T12983F74AF9819F11D4D621B9FF9F41493353AFB8E3EA3101DD20AF60278A9DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901447, "uuid": "3548c678-470c-44e2-b9c3-41be026cb39a", "value": "1536:/9nIrRWpztPDc3I2Faz8HTf19IlGiloXisH2lNTl6Y7+H90u:4p3I2Faz8HTf19TxH2lNTl6fH90u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764901447, "uuid": "2551f55d-fafa-4ce9-a2bd-583064a62f42", "value": 84028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764901447, "uuid": "55378a66-8333-4bf4-8f7c-dd579bb8c450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901447, "uuid": "a6309923-e2a1-432c-9800-3be00d372355", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf43ef-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959028, "uuid": "db15ff2b-3a3a-4761-b4c6-2d28ba412c33", "comment": "Malware payload (Mirai)", "value": "b96bb57a35e6e3ee63238bf8fa5b22b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959028, "uuid": "9c968dd8-417c-4fff-836d-e686aea1dd04", "comment": "Malware payload (Mirai)", "value": "1251d8202445ed73d86f3a321d7badbcae5d375ee5fd5f51e1db573bc2749946", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959028, "uuid": "80e1baa7-4cc1-4691-9bab-05e7c64a6764", "comment": "Malware payload (Mirai)", "value": "2c555a7d78a457e8742a92ecc4b0040b4ebc2422", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959028, "uuid": "208e5d54-d4ad-4eb0-a2e3-df208ca1b784", "comment": "Malware payload (Mirai)", "value": "a573be66485d58fc9a7bae64ef49eb8cea226bd9123a0354e53170aa98be512d5a4f4b50c31583fb54914109775743fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959028, "uuid": "6a5ebda9-8628-4f23-a049-5ad28817536b", "value": "T19E11307C870A6DA48048E63E7685881D71E24FDE96BBCB902E48213D30E49DE7132E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959028, "uuid": "46c59613-ddad-47e1-ba0d-fefc83ef8447", "value": "24:fFUrFl5ZrFWrFHrFAzrFTrFYrFJrF1rFGrFATE:fOrfHrArprKrpr+rTrXr8rGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959028, "uuid": "238ebe03-c6b7-4ae2-95fe-992974996d90", "value": 1028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959028, "uuid": "d0092bc8-bba1-459a-8d02-32ce8411238e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959028, "uuid": "5b81bb9f-a5da-4ca2-9b29-082f0dd4b37f", "value": "wrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f17230a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958928, "uuid": "6c2c55a1-2b1e-400c-ad7b-aa0a78fa4d29", "comment": "Malware payload (Mirai)", "value": "4b0c022455043cdefbab419cb7bc4ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958928, "uuid": "78cc912a-9bb6-40f3-90a3-9d4627a77f3c", "comment": "Malware payload (Mirai)", "value": "1296c4aa31278193beb3c95c3fcc50155c9a058dae3faf3acf5a3b83631ce760", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958928, "uuid": "1c1741ff-7f2d-4e35-855c-c49d5063c3c9", "comment": "Malware payload (Mirai)", "value": "a29e55aeeaa04d557156299298248a38922b22bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958928, "uuid": "bac5ec3f-745b-467c-85e1-e8e86132acf2", "comment": "Malware payload (Mirai)", "value": "95713d9f852b1a3b5da2e101d12dd85f456dace04d3fa020dc3586ad15f1228a4f9d2d16d832af0d7d4e07830a72420f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958928, "uuid": "2c4be8dd-144a-479d-8d32-b1a72b816b6f", "value": "T1DD03226A2A219BEEF55EC63047738B30679822E126E0DA84F65CC70C1F7130E595F7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958928, "uuid": "1274d948-1738-4908-bc7b-bcfbe49a70fa", "value": "384:TrhAecDWtstJ6CGnbkr0FMlRCGWP5ffWWGqhRu8Wn457zu9uGsOiysnlEjVfIaQf:TrhVMWtK4F9GW5GFN45m9hV169EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958928, "uuid": "8105979d-b912-4e26-8698-923e8f8f3f87", "value": 38924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958928, "uuid": "ede1a132-3976-46ef-931f-3787880ac4c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958928, "uuid": "74d33a45-ba09-4cc9-8119-63c7af750137", "value": "rows", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a9333d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959014, "uuid": "4602161c-70fd-4bd5-807f-d2932e1bff67", "comment": "Malware payload (Mirai)", "value": "2d5fd92297fc0b5f8060f49b9cd6b59c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959014, "uuid": "aebffb57-3057-423a-bacd-11f461190630", "comment": "Malware payload (Mirai)", "value": "12c0e0476d7fa97dfbbefff2d5ee3c137a27852acb9520d6503e3c6867d267ac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959014, "uuid": "155204b8-658e-43c7-b592-a81f60caafd6", "comment": "Malware payload (Mirai)", "value": "0d31a1387434652642871015df297e41422ad0dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959014, "uuid": "07eb9bfc-9db0-45dd-94ee-2917c71aabc0", "comment": "Malware payload (Mirai)", "value": "af6bc1632c44f18194a40653acf99065f3abc69e7e1665aaa36e7163cd633e3b92620aed7fc6527c8e725b4dc2e431fb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959014, "uuid": "bbee6848-5dad-442d-9776-7f2355697dbb", "value": "T179D0C9A84007A9F8A029A96EB27523CAB2639B0E316B4F4ADC4060B6B0C1498F021E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959014, "uuid": "d2287b94-411f-4ad5-810a-500e77149cc5", "value": "6:LA5/jeAKTjOWVA5/ZWJeAbJTobJl8Ftox8OLJn:sh6AMCWOhoMAejz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959014, "uuid": "88782c36-0c49-411b-819f-cd2b758264bb", "value": 201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959014, "uuid": "6f4257a7-8b54-49ec-9e69-690569443812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959014, "uuid": "4aa67f1b-b080-48a7-b42c-6a09bb486014", "value": "to", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853c904d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959019, "uuid": "34f355c3-81aa-47b2-9031-b8cdd2c174df", "comment": "Malware payload", "value": "981dfa507bda735728675f539df5f575", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959019, "uuid": "e6321008-593c-478f-a69f-d7567234dcfb", "comment": "Malware payload", "value": "139c3c8797eb247d896f4db23e71110a35ce8c53fc93a9f71d200c0aff87e236", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959019, "uuid": "0f3c24e2-4e06-478f-88f4-78169b337369", "comment": "Malware payload", "value": "11112067a256820da8d522d693644c7546615a10", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959019, "uuid": "75e823a2-8a92-4418-b684-81cb5ef049c7", "comment": "Malware payload", "value": "d795b64fb5f906cdea307eb0935ea2afb08fea8e1970239cb80575151362337d32cb109af60e5816945550e086f4a867", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959019, "uuid": "9dfafcdb-0216-4ff5-8610-6b3419bb24f4", "value": "T130E04FFD002BCF1781041C09A026E833B033D3C662A2DA069EC8E43EE5A4A603136E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959019, "uuid": "8f9b8ca9-2bd3-4e2f-964f-9c63980348b4", "value": "6:LMFt5/rHzIXgPCKVMFt5/laLaNgJPCKVMFt5/pFGNIvF+6oAPCKVMFt5/nfiAK6Z:othfIXNKKthlaLaNg4KKthSNIE6otKKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959019, "uuid": "c1082255-9bb4-4a6d-a8da-770d98b2247f", "value": 327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959019, "uuid": "37808ae0-1c83-4fcf-a328-9db597833381", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959019, "uuid": "809a6632-c8a0-4664-9165-2d04945abc6a", "value": "smd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d428a30-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "f5b0a657-1017-4d5a-9f2b-043f018d3606", "comment": "Malware payload (Mirai)", "value": "1b3c5ca0f3fa093276eb7e51c04e03e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "36c733d5-7791-44e5-89b1-74ec5b918568", "comment": "Malware payload (Mirai)", "value": "13e0f9b7f31354cd72c175b361c6930f450b0fb54cf9cc4c1d7d8170078c166b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "c8d85140-90cb-4595-ac49-bb12696b18da", "comment": "Malware payload (Mirai)", "value": "aa97b71cece6cbb632de9e538eaa0ce5e94dba35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "c52f7e6f-482b-43e4-bbad-bbd44b42694c", "comment": "Malware payload (Mirai)", "value": "eaf08e9be4150c9b4ef8f16b92bd9c9bfb4caf5ba03a4d8bfe3a0a8d507984fa5fd19ce2a4b6929dd8ca99a2c84aad5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "1ca21102-0e9d-435a-87de-ca827b7b2d17", "value": "T12363E74AF9819F11D5D965BAFF0E528D335307A8E3EE72039E146B2467CB92B0F3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "08d4443d-e42c-472a-95e7-1144ff824cae", "value": "1536:pJnUl0xtqLx/fMx2lXXp3ez/zPeBzQMdlzWilaLHvN6PuybVRfx:i0xcLJfMsXZOz/zPeBhtaLPQPuyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958441, "uuid": "f713a01a-c303-40ec-97aa-34995bc438cc", "value": 69136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958441, "uuid": "f4465c98-15e1-4648-83e6-d175588ab628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "36955c18-1c95-4631-a2cd-50deb98f2e23", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6ab024-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958974, "uuid": "f965c047-d432-4aac-a259-2e005ca7335c", "comment": "Malware payload", "value": "0f0f96f0313a0b4bb3d1b7990e93c05e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958974, "uuid": "059ffe4a-6762-458e-b500-0ffe169f8248", "comment": "Malware payload", "value": "144bcccf15c969c2fbd72124ac61487cc1e1fa5eea458b4f3d7d9d7db56ef52c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958974, "uuid": "1d094f13-dcc5-422c-85b4-d72c7c91aaac", "comment": "Malware payload", "value": "52ad2223e1e85a7c184ae67e7f3ea67a5002911a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958974, "uuid": "386772a2-5f8d-474f-90b1-ee2145385418", "comment": "Malware payload", "value": "b13747fe71d56eadbcc5fac83fbfbc2edda3369f7f7a949fbc83d1d8ec95f20ec993c290cff3cfdb1c5086b82f14af4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958974, "uuid": "a33eaabe-97b7-4592-a33e-408e6704bc03", "value": "T1B033854D2E229FAEF66C873547774F31979823D636E0D684E66CE9001E7030D646FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958974, "uuid": "f0f82ec2-ef2a-4c2a-9c32-4e18a9c03486", "value": "1536:ZysPknw0FBQkEn7Zy+2bTUzTuBzTTDV516eE4aoBMO9YCuok:HV0BuZy+kHNaoBMoYCu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958974, "uuid": "5355c720-1776-4836-9d38-ea225a95d1fa", "value": 52132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958974, "uuid": "df20f6be-22cf-486a-8c7b-ac04880f19b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958974, "uuid": "22dbbaec-dcc6-4998-9bcd-eccbc6e4ad91", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc9f622-d1bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926576, "uuid": "39d57ee7-c1a2-4726-b85e-49140ff69897", "comment": "Malware payload", "value": "233358cfe62e832e88bfc772f61b098c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926576, "uuid": "011e011b-8d0e-4ad0-9433-2577cd319f8f", "comment": "Malware payload", "value": "152e4ee3119b9c43d5b74bbcbc419afff887c28e426db3aebd0798df75cf6aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926576, "uuid": "c1adaf4b-e74b-4632-8099-d8a016057a07", "comment": "Malware payload", "value": "807332e97a6295654a96a9188985b549856a1fad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926576, "uuid": "d23095e6-0bb2-4d02-b5a8-72f17e00d3e6", "comment": "Malware payload", "value": "131e4fe57837ece61d97ba1b77e27497a8ebbdd755c363b5a8ddba4ff1d403179c82be0c584ae4732d1352ae432bab8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926576, "uuid": "74d8f624-b51d-47c6-9328-5100dd6aaf78", "value": "T146831965F840DA52C6D1267AFA4E924C37231B7CD3DE32019D149F3827EB99A0F3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926576, "uuid": "7401a683-ee44-40a2-98bd-d7dcad07cc53", "value": "1536:Ua4MyBX7SpHqoLwYtUeiLBrlqZ03sOAznRV7VFHockQEXUt/IEtXvMxMRYYOd1Pl:UWyBX74qMKbO03I7fuGINNYO7Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926576, "uuid": "d0c06b34-f25f-467d-9e02-8c34e59c0dad", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926576, "uuid": "b5b27989-a48b-413e-bdb0-86fce9c6e205", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926576, "uuid": "755d6792-eda3-44d7-936d-938a2c70f173", "value": "netgps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3516e950-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764952012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952012, "uuid": "a4ac2bc5-8170-46e8-a0d4-30546b4997e6", "comment": "Malware payload (Mirai)", "value": "a24578747ab39f026ee61f88af279b86", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952012, "uuid": "36e0dad0-8809-4280-b026-4e3827d7247c", "comment": "Malware payload (Mirai)", "value": "17c4f3afbb310814650734fc0479b5e315ddb599c16e837b832ddeae79f856cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952012, "uuid": "62314857-997a-45aa-92fd-5f6e042f4631", "comment": "Malware payload (Mirai)", "value": "38c9553f71157e942c4c1c0c5b293cbc36c7d14a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952012, "uuid": "6634f1dc-2aae-47c3-9e57-116e42f68d63", "comment": "Malware payload (Mirai)", "value": "ca5f168f63ab44fe6c189bff352bc42cdc5aae77245abb1170ded5ffd62f7ebe0f72af4b10c774b6eaa0da7f0b931f37", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952012, "uuid": "320a8e2d-a91c-448f-a15b-90381635fb1b", "value": "T1E81182AF28066484A248FB043C6EA602A948C3E762C13B1EA6EE077691EB410755EE53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952012, "uuid": "a4b13b09-1464-4176-acfc-5a3f6e2043df", "value": "24:eoAkgCxAkgC+AkgCpSAkgC3AkgCUAkgC7GAkgCFAkgC6AkDwK:eoAk1xAk1+Ak1pSAk13Ak1UAk17GAk1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952012, "uuid": "ff6eccde-b4e5-45fd-89fb-92cbbce84cf2", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952012, "uuid": "64963c06-58e9-4044-b065-ac3353c441f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952012, "uuid": "37b8c6ca-0c33-4757-be55-41c07abbc5b0", "value": "router.aitemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38427d78-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958460, "uuid": "0da8bb0f-6145-4872-a7fd-7d88432cab1c", "comment": "Malware payload (Mirai)", "value": "7ba4873e7b66a8d521c978b32927a216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958460, "uuid": "bd14daef-0057-45a0-98c8-9f4ff603019f", "comment": "Malware payload (Mirai)", "value": "17d6927fe81260c1d4c389652504784198fd53e86a43bc679e67ca96c9a4f9c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958460, "uuid": "e39e0253-2acd-4a65-9c81-5f51bdcef62f", "comment": "Malware payload (Mirai)", "value": "bedde1de51973657243e102a76b93153efda1dad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958460, "uuid": "1d82b5ea-a7fc-4264-9799-88ae8d3f33ab", "comment": "Malware payload (Mirai)", "value": "f6e172ff21d3a24d8f21c623a4dbe8547276d7215fa77ae5f7af68b6f5fd698f7caa08e868af44d94731ec6a0b4bec8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958460, "uuid": "af8441f6-e3ce-46f9-bdb0-098cd9494704", "value": "T10D231841B8819623C6D01376B66E46CE3B2563E8E2DFB2179D221F503BD682F0C67F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958460, "uuid": "db19bfc4-753c-465f-8e99-2d5f378de102", "value": "768:AnTDQF7OsObRZOC1h/+SxNpXD9r7b/AirvvnBoxRff7/N+wJK78L9w:qDQF7LObHTjxds4nMff7Fz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958460, "uuid": "44b922f3-8777-441c-a07c-198d243f1562", "value": 46804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958460, "uuid": "c86951fd-f221-4173-9cc6-93630c0da066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958460, "uuid": "b74e829b-ccaa-4c87-a1fd-0ed2fa7e070f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc774d7-d1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764935011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935011, "uuid": "8a5d0fae-3346-4ef5-bd86-62f1092361d2", "comment": "Malware payload (Mirai)", "value": "c60179ecbf0e57c5aa642405e084a61e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935011, "uuid": "01b5e8ab-6007-4964-945f-c13146f73c12", "comment": "Malware payload (Mirai)", "value": "18061ed8b454556d97f48b7a736a14ea852aef1d07b573b0ffb22912539d06a6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935011, "uuid": "02f51fad-2db6-4205-8c1b-3e1db8ff12e8", "comment": "Malware payload (Mirai)", "value": "e72ca161c38670721ae7416578f2fc63e491f885", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935011, "uuid": "01696da1-3a93-4ca5-896d-6364cd10d826", "comment": "Malware payload (Mirai)", "value": "5d2986661eaeafec86ee193081246bd61a0871e1658d745b1449cebaa098a1135980ee0c5293c29222380b263d008476", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935011, "uuid": "e694758e-6d7b-4876-b846-193113fe1af1", "value": "T17111866FA922971EC588C959F412EA707209538B21CCB73E44CB4537C9DDB28F505D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935011, "uuid": "b73d646f-ac70-46aa-a8f7-68f57c0a7afc", "value": "24:enLmaSLmaJLmapFLmaELma7Lma7BLmaeLmadLm4u:enCaSCaJCapFCaECa7Ca7BCaeCadC4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935011, "uuid": "59ed0a63-242b-467a-815a-f1a9c7282c54", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935011, "uuid": "7dea17d4-65de-4ed4-ada8-ad024f027bfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935011, "uuid": "e363d95b-c178-4a47-8c1d-3348877a3931", "value": "misc.ictbroadcast.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ee61a0-d1fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764954743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954743, "uuid": "30db2a7a-c46d-482c-8bd5-7bb0aaa8b294", "comment": "Malware payload (Mirai)", "value": "4eb4aa13aa6b2f9e4253cde6d0207abc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954743, "uuid": "edac58a1-b6f3-4533-90cd-39701384ac74", "comment": "Malware payload (Mirai)", "value": "186c3eb179dda9525852c81b591d4259ccfc5c0d36eaa234af6eb4e4cbcf5b96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954743, "uuid": "3f8c5bed-51a5-4cb4-973a-68e2278ecf6b", "comment": "Malware payload (Mirai)", "value": "eca2cd5bf6dacd2f9ad24ddf64d9e926a7b06e81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954743, "uuid": "c82716b4-bd1b-49f8-a71e-71f8f22ceb22", "comment": "Malware payload (Mirai)", "value": "3d3cef2a10ed44a84f425b4ecf2cbf96d8caa6d24bcf7e58ee389259abd80a33a434ae6d40710b1b782897c810e19886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954743, "uuid": "fb552555-15ad-4ac2-ae3b-f07a7c63ef49", "value": "T17564D70E6E228F3EF778863457F78E20975D23D627E1D584E1ACD6100E6065E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954743, "uuid": "827fbad7-4139-4202-96f1-c22082dc2c94", "value": "6144:Zo43gjBFLshFwwIGiTpNZ9qpUDnpPAA8okA+F4XjvTS10QJcHIpf087HoPyFmyTp:YkYvSDHoZXSi3P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764954743, "uuid": "6cdff421-f67b-4f4b-87bd-92c3b02dcc3c", "value": 327936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764954743, "uuid": "fe7ffaf4-a3ab-46b5-b791-28c8f807958b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954743, "uuid": "2cbc0473-5759-49dd-add9-bc76a07b366a", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f688f14-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958472, "uuid": "69536fa7-2a31-4952-958f-f58b38934863", "comment": "Malware payload (Mirai)", "value": "d93a4106a5b1806de549d27d679872ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958472, "uuid": "8f3b1a2b-3810-4d9d-9910-c68e927e22cd", "comment": "Malware payload (Mirai)", "value": "1884a4d2c2f42f3a6372a4c160a282834d5fa2230eb25617e3b31bea3bd35161", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958472, "uuid": "cb26ad20-639e-4daf-a939-c51219bb92f5", "comment": "Malware payload (Mirai)", "value": "ded3e391180e68f527f8c6536ee88f0782ca1f78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958472, "uuid": "7176b11b-7392-415f-aec2-728c71ea289f", "comment": "Malware payload (Mirai)", "value": "672709afe79ef2bb513676263ea3117fc6ceb3fbdf407b7ac49c186206360824928760dcc88216786ea55fbd7eb8ab65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958472, "uuid": "927cf650-9ff9-43fb-80d2-fee905b7070d", "value": "T174F0A2CF107008B95540A91AFAA3DC36F34A65E91CC51F8C9A5F0E79A19D90A3815F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958472, "uuid": "e1961dba-c162-4d13-9185-b5b154b9a17e", "value": "12:teZD9XHWHJ96HWHpzv9pzMHWHPIjD9PIMHWH6D9LHWp:QZVWMWJzzzGWvIhWaNWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958472, "uuid": "fe96df19-4715-4768-a99f-e3724e112e85", "value": 655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958472, "uuid": "d58f216f-eadf-4dd5-8069-c420ae6af8eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958472, "uuid": "d31c5ad5-c9a5-49d8-aed5-621d292dcecc", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4074bf0f-d1c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764930556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930556, "uuid": "10920bf3-2042-4603-b474-4c10a1de08e9", "comment": "Malware payload (Mirai)", "value": "17afe8a859256c5155684b8f96869268", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930556, "uuid": "fc01f1cd-752b-4eca-8226-0aa1242549fa", "comment": "Malware payload (Mirai)", "value": "18da69c3c9ca8db64bce17437ac8b7cdd7a01fbd3e4bd1bdcd8f035d550ab16f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930556, "uuid": "e6cfde56-24f6-4bc6-a6e6-38e0b85b663a", "comment": "Malware payload (Mirai)", "value": "10bf0caeb2a83849cfdd2689cccb328806e72fe4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930556, "uuid": "ad765d77-2174-46c3-8463-1d7e6d8a9ad9", "comment": "Malware payload (Mirai)", "value": "c7ad1739492f9e4aabaca017612265fa7a526d87ed07f4ff57c2a802c14322a2b80818a49e05a1e9fc6305ef8b5d9495", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930556, "uuid": "ac7d40e8-b6ad-4974-96e0-74cbd38c3ad4", "value": "T1B1A1F7E674B593AA7DB0ED7371D6C642B14060AAF4D68D0BF2D2F0E8044EF61E494B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930556, "uuid": "e94ea938-739e-42cb-9cb1-9d7c2c44525c", "value": "48:vUhMV4kIRUq1V4ERUrHrWV4DRUNoV4NRUEpEEV4EBRUJkV4hRUq1V4ERUOZV4ARH:vbMpbPoLkzOEpzbSZXbdDYja1tDBDCRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764930556, "uuid": "fd5a4a7c-60fa-4f28-97e5-3151587d2481", "value": 4858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764930556, "uuid": "4d5d5f6e-6dcc-4eac-8645-0cde48ce3f63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930556, "uuid": "9963a973-7916-4f4d-b715-03ac31357760", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2022659b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958849, "uuid": "9b5805d5-ab05-418b-b560-e967cb3d4ec6", "comment": "Malware payload", "value": "736a1682d379c4cfb1214697a433ce31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958849, "uuid": "4fd0e1d3-567f-4558-a45e-4591f699acfe", "comment": "Malware payload", "value": "193bd8d7b766aa517bf1b51c36abde8f61c5941b55bfdcd1b1802d1a88aaa2e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958849, "uuid": "c9ff4ee5-2781-4adc-971f-9066a1c0384a", "comment": "Malware payload", "value": "48d8e45a21e46662d012164866984cb721a17227", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958849, "uuid": "99e64a90-fdfc-4360-b8bc-c6e350ad014e", "comment": "Malware payload", "value": "af8b5754102b6058c5525b21d94b9dbf917c5b1c3ac4f694b568b8a91742f98c7c6dbf2cfcb50ecb8708ff8617dc0721", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958849, "uuid": "b4ba93e1-a15d-4b4e-8df5-b9605585f14e", "value": "T137E046FD046BDF17C1456D0AA07AE877F033D7D662A1CE069EC8A43AE1D49207233E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958849, "uuid": "8eac6d7e-ba1d-46f6-87dd-90be7c3ecb49", "value": "6:LMFt5/rHzALKVMFt5/laLaNgBVMFt5/pFGNIvF+6iyJVMFt5/nfiAK6iwly:othfALHthlaLaNggthSNIE6iyothfLKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958849, "uuid": "cbe2ee3c-73ee-4a83-8ab7-07788ca43488", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958849, "uuid": "eb53fadc-2b6f-476e-86f2-83cae57be42b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958849, "uuid": "31e28a27-3c74-499d-bd54-dd9dc295ff2c", "value": "ont.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4f56b4-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931002, "uuid": "e95796f4-22e0-4da2-a868-895d27e79978", "comment": "Malware payload (Mirai)", "value": "09bb2654fe0e0bc20863c254062ee398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931002, "uuid": "6fe33e67-4b71-4832-b767-76f7d2879b83", "comment": "Malware payload (Mirai)", "value": "1978751230570e48b93d198fc65499de7f23b9120328b907fd66d22730519623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931002, "uuid": "a98fe375-ae91-4143-b297-b921aef2c8aa", "comment": "Malware payload (Mirai)", "value": "1ac09044127d4ce031ac9f3e680da62a9d150ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931002, "uuid": "a9350f61-0a73-4394-b2a5-f5c226257594", "comment": "Malware payload (Mirai)", "value": "47bc0882ef7edbccfe378952f87506b3dcf06389797c1b255cdd135342c204d663463c899164858ab93f1f0fd90babe8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931002, "uuid": "ae4d2db4-2caa-4899-b45d-44f8da91cf91", "value": "T188B423FA20AEFF5BF950A671718682E0A4D490A157988CE1FD108D21AB3DF372771735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931002, "uuid": "9455270a-42ee-4aa4-95e3-2f46f5042407", "value": "12288:3gY6gh0hOYKFyUmUoxsryjS00GBL99ViEF:NxeOYwyUmtsejkgnV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931002, "uuid": "256eac2a-82cd-48c3-80c0-50dac3e2e0b7", "value": 530452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931002, "uuid": "1dd96e20-2a49-4b3a-8d5e-f0c04d540fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931002, "uuid": "51efaf90-d741-4a7e-b1fd-38eb41bb6781", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0035e0-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958894, "uuid": "1a82beea-1519-4f90-b954-847a97128598", "comment": "Malware payload (Mirai)", "value": "2b26b05867f5c3f36da108ed6738a3e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958894, "uuid": "ebe92899-df8b-4536-8111-dedd4fa44870", "comment": "Malware payload (Mirai)", "value": "19b2bd95811408ce8e9559aa476350f490be1289492993d8f3a6c354883db866", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958894, "uuid": "44cfa251-8f31-4a6e-92fd-4cd46070b77f", "comment": "Malware payload (Mirai)", "value": "6bd08fc9131c62da2200ebe71b896b68ad046b02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958894, "uuid": "bf8eadc7-d764-4d2a-a444-7c4300c4f4a9", "comment": "Malware payload (Mirai)", "value": "b07ce07c864f3a6372c5d28fe14f1dd7a0b0766ba7a8f5f05e2733c6fe480223c728acebf61a8bcb99222d57974a72bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958894, "uuid": "5a41ac3c-8d4f-411c-936f-486523cbd587", "value": "T13B01A9FF004D693C1E40855AB567841D74334BEB71E5C60AAC8FA933B2C4528B572E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958894, "uuid": "432f6ac8-ba50-4a16-8aca-cd03f73acd9f", "value": "24:ZvCZOv9k933v61O91O9k933v6Yok933v6bDbnk933v6+O5k933v6q9q9k933vXw:UZAk9Kk9Ak9Gk9mk9Ok9Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958894, "uuid": "646e04f9-3d81-4a98-a9ef-ee44da29e5ed", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958894, "uuid": "bacc5974-dd27-40e6-b513-ccf691dad1ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958894, "uuid": "0590b206-d6f2-4838-941f-d945d67aed46", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a295572-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958893, "uuid": "8cd2ec75-47c6-4076-aae1-0723f6989ee5", "comment": "Malware payload (Mirai)", "value": "8c4335f4b95130e1f5c423fca8c91440", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958893, "uuid": "34f245b3-99ae-4c98-80b8-b0954c4e2259", "comment": "Malware payload (Mirai)", "value": "1b5426116b30810b1531eb4fce062be0c2e33faa55ab56f9db21ccb08c9464c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958893, "uuid": "c2fa5eb6-363e-4363-9cb8-7df7fb5f6a56", "comment": "Malware payload (Mirai)", "value": "1ee06e682d1e71267d2a2a8653e3f5c84f79df44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958893, "uuid": "41e789b0-1b74-43bf-a154-62c3f364e8ea", "comment": "Malware payload (Mirai)", "value": "9c33683a193eb621ebe4ae69f782405d5b5717613d48d5ddaa74ba8dddf80c81fb487a4baf13ecfa5c1aab90cfc34252", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958893, "uuid": "6253f0ef-8671-4e75-b38d-dfd19aa87cef", "value": "T1BDE0EDAC4313550F011F9D36B1B647843072F74E606779897C81B03BF2C0524E071E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958893, "uuid": "279e0906-5151-4409-a82a-c72fb27e3804", "value": "12:sh/9AW1r7Oh/wAmL/Oh/PAqOh/WA4EdMvf:eaW189EMAjvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958893, "uuid": "dac4a084-903c-42dc-a8f5-20df3eb71fe4", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958893, "uuid": "8fd3760e-b881-428d-80e3-0b79e88b4764", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958893, "uuid": "081214eb-1721-489f-badc-9e94bd97b7aa", "value": "poco", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6787543a-d20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764960687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960687, "uuid": "5d6c54b3-abfa-4e00-9f57-0ab2ef7e83df", "comment": "Malware payload (Mirai)", "value": "baad7e37b98561164beaafb5ef60089a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960687, "uuid": "d56eb284-0cb4-4327-8f2a-f0f760cb2871", "comment": "Malware payload (Mirai)", "value": "1b6ea2bf9b398b1ac8f2752d267b5ad6ff6b2a01f5ca9cea54d4d9c28375fe70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960687, "uuid": "eaf6cf97-2383-40d3-b933-a564a9109610", "comment": "Malware payload (Mirai)", "value": "975c8b7807a224a75bbb1ce1fbfbd8cfdf09c55a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960687, "uuid": "efb457ef-c2e5-4b48-940a-551622505a46", "comment": "Malware payload (Mirai)", "value": "228f2af8915cb5fa6482cd97d8bd1cea4db6fc3717e8fba20ce6aed57dd45b26bde339d3637feb7e3f3ec7f35cadc9be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960687, "uuid": "bb782b8d-92c4-498e-88fb-9de9d1cfa856", "value": "T19BE44A06EF845FEBC45FCD70892EC34715DCE89792C1A22A71FC4A5DBA5D25A0BE3098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960687, "uuid": "58747953-715f-48d4-ad8b-da7ee439c14a", "value": "12288:i57I4R+84Qe8wmTHD3m2afRWDO9j9eNGeBgATQVI/jD2to3hR9HfObx7NVUBdsD+:M5+8ne8wmMKfq2wKZA/JBIAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960687, "uuid": "12b52fe2-82db-4c9a-883b-7620a4aeb3d4", "value": 695820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960687, "uuid": "559d7273-e83c-4e51-9ea5-e6b5a25dff88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960687, "uuid": "bd1463ed-4dea-482c-8eb4-6b2592c024e4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25042fdf-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958428, "uuid": "f05f1a83-216e-4b8b-ae37-bc72c28ea0ad", "comment": "Malware payload (Mirai)", "value": "b273a9dda3d9c78e2604ae32b16dde61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958428, "uuid": "e13a4c5d-3417-4c4f-9068-1aa03fd713ed", "comment": "Malware payload (Mirai)", "value": "1b837f0807855cf1b562522edd6da76e9e899ecf8d8c751229cbc5424bd6f297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958428, "uuid": "7d662ed1-0ee5-47ee-b713-a71aeafe75aa", "comment": "Malware payload (Mirai)", "value": "e239c851e1c90d1d60b194f8e3a2321c567d340a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958428, "uuid": "613988ae-e74a-4a88-a669-30e69652b59d", "comment": "Malware payload (Mirai)", "value": "43ca89e5a462c519639a22a61d8fbc5ca2b5f92646caa350d68e64a2f32b127215e129993c50fc1889f8fa0e013a41d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958428, "uuid": "71f6979b-994a-4cee-8a41-678b26b21b11", "value": "T155A2D11572632E65F3EC1C3DC96E8317F9A71BFC90F5327679442620C94D24A3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958428, "uuid": "9dda4b7e-5086-46c0-ba77-27f5011a31a2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjFqyhymdGUop5hI:vvQn4j+ZO5fKAlxB5s3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958428, "uuid": "cdc64498-958b-4bee-b0c9-eb80a3283550", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958428, "uuid": "05044442-1bb8-46d0-a10f-6b13e5860eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958428, "uuid": "b5c5ac15-d26a-48e6-8595-09084db6b5b7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50542c0e-d22b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764974392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974392, "uuid": "06b420f1-f6e9-404b-917b-9970f4156c75", "comment": "Malware payload", "value": "4b92167ded21eda1b46e8b1aef0882af", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974392, "uuid": "479bfdac-c4ce-4bc9-96d1-8ed7d54992e5", "comment": "Malware payload", "value": "1d5bda62fd481921d3b4cf0b1c7e01e861a48f744a1571895fad609fdf471bf5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974392, "uuid": "80d9f1f0-9186-44b5-a1b7-a99c82bf4159", "comment": "Malware payload", "value": "5698e964053eb966412a4b2034369ef74b7836fc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974392, "uuid": "08161d1d-41b1-4d47-8984-6c27ab338b8d", "comment": "Malware payload", "value": "9d022b2f07cf44e2aa5e2323d895f25e8929eecf1ac30990b7046bc512afbb99d8e70d14afd3a9bab63fa6be1c57d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974392, "uuid": "78a979fe-aabb-40ce-a31b-020981f78f20", "value": "T1C973538A0ADF85E85F2B74A4CADF5C02F7A89503571ED691BA4D79B02F1143CA1F4EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974392, "uuid": "85e042d7-10d2-4aac-b25e-6518ff002559", "value": "768:7/5/hY3XuMZ9cAguOBNHHVde9aaRGIGGOYyfkJUaCsbzzBFvZkgjWy6/2fbmAbP4:7k9re06/2iKmowIOpiRgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764974392, "uuid": "40eb3969-4463-4fc3-be7d-4cf265da88eb", "value": 76439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764974392, "uuid": "b8e3b978-44d1-4c46-825f-5708943d5c5d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974392, "uuid": "ce104733-a9a6-4916-b3fe-7002a4c9a997", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8de5280-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917498, "uuid": "76264161-78d8-43a4-8a2e-7e52aa9b570f", "comment": "Malware payload (Mirai)", "value": "68e6a32a658abe7db66d5ecb6e5f1507", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917498, "uuid": "51b390db-87aa-4897-9c30-6c9f7717cb21", "comment": "Malware payload (Mirai)", "value": "1e8b4880cb709c5661737adc0caf3d23f48fdc7180191794b0a98fe5660bad20", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917498, "uuid": "4e46e31a-9d0c-44a9-876d-ce0db25e6202", "comment": "Malware payload (Mirai)", "value": "a7cc27c7ed4f284ddf0147ab106efaa84115a1cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917498, "uuid": "939e436d-3053-4ed2-b697-9e64ff5e6f1c", "comment": "Malware payload (Mirai)", "value": "81a726f9d55ae338b513ba7ef8d908a3f0311c8c75d098042f9f2c500f3d9888212896b7de0001d0ab49dd99e65ba4e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917498, "uuid": "6bb8074e-9231-4287-a9cc-1418b3b79464", "value": "T1CE1130DF740326408BB8CE4EB879E515655C62C264C82B1BA9DF0F3FC0ED558B512E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917498, "uuid": "6ce87847-7a4c-4bdc-9be5-f9f85e0c6c9a", "value": "24:ewicSvicSyicSpWicSRicS8icS7aicSDicSeir+:ewi1vi1yi1pWi1Ri18i17ai1Di1eir+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917498, "uuid": "28cc16ca-6fd8-4c02-9bd6-e44bfb95cb3b", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917498, "uuid": "802b0555-88dd-49be-9025-0e0f61dc203f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917498, "uuid": "6f9b7ed6-960f-44ac-9d44-9f7991373a16", "value": "ipcam.goahead-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580f239d-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764952071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952071, "uuid": "ef24f6db-8311-41d4-b345-8c62de2b7fb1", "comment": "Malware payload (AgentTesla)", "value": "67c47864ae935b4d0fb8418f50c32df6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952071, "uuid": "a5a41076-5958-4967-aabb-8b73871c01f6", "comment": "Malware payload (AgentTesla)", "value": "1e9755455d9133309c667acbd0022c52939460110ad7aaa39b502aa7e0ab5ba2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952071, "uuid": "54975095-752a-40c0-b509-843224a37543", "comment": "Malware payload (AgentTesla)", "value": "c94df5d55828569d96996637ce327b818b685ef8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952071, "uuid": "ca5fe232-1f85-401c-b8bf-c90aca61f578", "comment": "Malware payload (AgentTesla)", "value": "c4ef2d0d65e87827c94a895dbfefe2a29d69d0bd7bb1536114ab9f4951598a5a6902d2ddd64d897018dd4bdaaf5a0581", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952071, "uuid": "d176c914-b983-4fca-b812-394cb8db6f7f", "value": "T142B342C53EE1F03882563167296FA1DFA22F8C44720C8552E2A75DD8B67D30CF57A6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952071, "uuid": "67c0c6e4-46fb-4839-ae8d-cf70ab81d794", "value": "1536:mbqfdSjtNa257y2cgkB+MxtXsRULhi8luiZA/:uqAjy2o2jOpt8onlK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952071, "uuid": "1c32b622-a4b1-4a06-afc4-08c7afbc6711", "value": 114451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952071, "uuid": "01c3432f-0d00-4b6e-92f3-97c33c9e4d23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952071, "uuid": "74c8cf68-b4de-459b-9d7b-9c15c800c145", "value": "Invoice_Petromar Shipping_#8201B340.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3f11b5-d1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764943303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943303, "uuid": "e0c6b823-ca21-4893-8ba6-10771ca631eb", "comment": "Malware payload (Formbook)", "value": "1bcc3590d22975404f49e4738ef97cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943303, "uuid": "1d8335bc-064f-4936-afa1-ff0209c37876", "comment": "Malware payload (Formbook)", "value": "1ead277b73239b1e41be4c70c1bf9b850a9e99dcce938356b1a54b1f5ea1a61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943303, "uuid": "b0ae351f-a0f3-4b73-bd1a-f34206590741", "comment": "Malware payload (Formbook)", "value": "802f44c63194c76f97c86d65e7afbda021fbc124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943303, "uuid": "c06d72a3-1715-4cd0-9094-083be38dd4f3", "comment": "Malware payload (Formbook)", "value": "f52d3a6fc0f874ed8a6f9f7a2a4c2a631b2c3b95f5a57a14a7d5638df05e8968b950598b826468bce6f33ada46ec88e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943303, "uuid": "31c56cf2-4479-4e3f-9785-0ae5be031cd0", "value": "T1D545BF027382C066FF9B96730F56F62156BD6D2A0123A51F13983D7ABE701B1163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943303, "uuid": "b0bf727b-8d23-4887-86c3-c6299ea6f954", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943303, "uuid": "6f959fc5-6154-4a18-96a1-b10058067723", "value": "24576:g5EmXFtKaL4/oFe5T9yyXYfP1ijXdaP1NVLozvcnrvx:gPVt/LZeJbInQRa9NVLAEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943303, "uuid": "e93f2618-afff-497d-bd4a-9591ec32a93d", "value": 1272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943303, "uuid": "bd2c2235-b553-4f17-9274-ec3758a1abbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943303, "uuid": "5c6166b1-ab1f-47a4-bded-0cd39a1ea296", "value": "1ead277b73239b1e41be4c70c1bf9b850a9e99dcce938356b1a54b1f5ea1a61e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4002c29-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959500, "uuid": "4e87a4f0-fbf8-4ec9-90e6-7b9021e3afd6", "comment": "Malware payload (Mirai)", "value": "419db0550a559195f7b9fb8cafaf4857", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959500, "uuid": "37e41b98-b6ef-4223-b06a-189cc1021706", "comment": "Malware payload (Mirai)", "value": "1ee3cd54bc72abba77c2c865232d5eb5906258f9bcc8aebbb05c74001c10182d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959500, "uuid": "222a264f-8b6d-4d7b-985e-5e14ce6353de", "comment": "Malware payload (Mirai)", "value": "2870b5ec25492cca67ef83d8d6061b7058e187cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959500, "uuid": "cb06be9a-ec17-4e43-b759-21311daf1b43", "comment": "Malware payload (Mirai)", "value": "3267e26c8200ad845f614b52fdb089533fc5e1ccbcd324855241e76b18ed01a66c1a340d683c409c8cacdb7af2e60e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959500, "uuid": "ec78cbf6-e440-4882-b3ca-312c99e04187", "value": "T14923E9C27881AE29C7D057BBEE6F018E3354A798D1EA7353C8240B947ACA90F0D57F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959500, "uuid": "94b1c5d6-b01f-4d3c-9095-0906c49c1722", "value": "768:PqPo2Ap9tDjGuqPDkj9o1uDuTA3nRqM+7ojxed1VCFEn/OXwCVy/zmJHUhG1jewA:CPDC7jnqwj9KTAYrd+Gn/FzVLS1S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959500, "uuid": "c7e08546-ba94-4aff-8a15-bf71f1fdd5b3", "value": 46416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959500, "uuid": "ed4e35a5-8f2d-4741-8bf5-4c90c022cdcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959500, "uuid": "4aadd2a8-4304-4339-ba39-17b9053405cd", "value": "Omni.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e583d6-d1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764943174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943174, "uuid": "f6852e7c-19d6-45e2-8d3a-046caa00d9dd", "comment": "Malware payload (Formbook)", "value": "d3449e071d613cfafa9e20a83efc76cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943174, "uuid": "74bbbc8e-cca7-4559-b0fd-2e6e4ea42a69", "comment": "Malware payload (Formbook)", "value": "1fb2640c673c8dc92ad3b9085489c13c45af5aa3b4ff05eb1e647238e3d45126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943174, "uuid": "f81d7881-6da5-45e8-b726-66bda345818b", "comment": "Malware payload (Formbook)", "value": "6adf9efa56871292040263a65f8ee1bbbbdb6e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943174, "uuid": "c9404ecd-97b3-43c1-b6f5-06967c02060c", "comment": "Malware payload (Formbook)", "value": "5247ef1dee0ec06e14060a2cf03d27774e6fb292aa126214472c7a3297d179fbdd0a69f787023a577c52d2b5d532c0f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943174, "uuid": "965eb848-355e-4f54-b14a-e641228adf37", "value": "T117254C7E5863912AD94A80FC74494B6259B1B33B03B41FF700A69171271B9B2EEC73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943174, "uuid": "3cefde4e-1037-4dd6-9904-0d2b675081fa", "value": "24576:GdEy+CL7n2o4I2A6gIvX/Bdg2pDVYlml1VveARKTTfu+t5:GdTHL7XUQqulm1veARKTTG+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943174, "uuid": "de5fa789-0f41-4cd2-982d-f79fae4a866b", "value": 1016368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943174, "uuid": "d692594d-6e5b-4ba7-a3d0-52544962deaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943174, "uuid": "5f2542c9-9611-4753-9b63-e75d6e572189", "value": "license.ini.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4582fc9a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958912, "uuid": "d3c61c69-a04a-400f-b308-3a09efb24fcb", "comment": "Malware payload (Mirai)", "value": "c65bfd2ca74ba059da5481c640d0a332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958912, "uuid": "51798b59-bf5e-4df0-b888-6867b4eaca9c", "comment": "Malware payload (Mirai)", "value": "2033657684c9fe40aa9b7ca6d57e53104238890c9c9086bbbfb66e38de7ce115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958912, "uuid": "9b1ce64d-41c8-465e-9ed6-d6b10e033b85", "comment": "Malware payload (Mirai)", "value": "3508f20d482a164d2dd02a917b56218263f030be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958912, "uuid": "02565b5d-e443-47d9-b7a3-bbaa3c7ddd40", "comment": "Malware payload (Mirai)", "value": "1a7159bf0cbf7acb7d5987608dbd9589d31401b2252591e15b20d937323193506fd700c827f4183630311542a84cc71c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958912, "uuid": "8545f62a-abb6-4877-ad8e-64ceac056e37", "value": "T1E7A3F909BF510FF7DC5FCC3B45B94B0528DCA51A22A93B356934D81CB29B24F9AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958912, "uuid": "4d7d4a2b-24b6-40a0-8e80-f6a7b2faad7d", "value": "1536:4WTPzUojrvUHno4SHuVMGSXTLGJJsWOsiOPT1AnJ8nMUQ7fnI8sRID:44bRjrMHooJHonHRjnI6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958912, "uuid": "b9cd826b-fcac-48ea-aa50-daf624351261", "value": 99500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958912, "uuid": "e5d63b41-29cb-4aae-ac19-2eb9c9fb3e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958912, "uuid": "c43fcd10-7841-463f-8602-a5f788730689", "value": "ampsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02739198-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958370, "uuid": "9c3110e7-fb2e-4e9b-9dfa-cd7411d205e5", "comment": "Malware payload (Mirai)", "value": "17fc97c4d30dc180979b11991a88a343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958370, "uuid": "a3cd5c36-a9dc-479f-b7be-16f1329cb361", "comment": "Malware payload (Mirai)", "value": "20886548f554e0b05fb08bcc865497469c918f76e44290e7a80df2978dca793c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958370, "uuid": "3b9934e4-c09d-48ee-9e8f-c569ed7a5997", "comment": "Malware payload (Mirai)", "value": "45fde1e73fe2232d45043d670ae3b17e7538301c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958370, "uuid": "5ff3fb2c-c963-4f3a-8942-e813f7f6dad5", "comment": "Malware payload (Mirai)", "value": "4dd8d87f3044c60d75710daccedfec9c6113c0053d1fc7bbaab98024796ebb24f947f9f4d8be265237873e1f1b472b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958370, "uuid": "00139273-d671-4c75-9583-60b877ba7fac", "value": "T1C5C32A03F48184FDC486C1301B6FB63A9935F1DE1238B6EB7BD4EB127E4AE614A2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958370, "uuid": "b98e9df0-a803-438f-81b7-060b6e9cdcbc", "value": "3072:nH6sSa5g2cl97ArMWO3EDtKo2BidiGlxsdjNJ6sKzQ8GZUOIsW3:nH6VQg2cl97ArMWO3EJKo2BidiGlxs9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958370, "uuid": "7310165c-81e2-497e-a091-95f3c55afe2c", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958370, "uuid": "0a45d57f-6203-448c-ab2a-7133ce3ec493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958370, "uuid": "30307619-34d9-4abf-aa0e-c730a4be32a7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886e92df-d1d9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764939267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939267, "uuid": "d429e13d-061c-4bd8-b092-634f000c3876", "comment": "Malware payload", "value": "8b6cc96796268e86b9a821da4d8d08d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939267, "uuid": "34f55e6a-fe05-41a2-8858-8ac09b2e4e46", "comment": "Malware payload", "value": "20bd5bae45ebfc4edd91ff2385dd191a1ccfd07853c00c6671d107e86fc8f4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939267, "uuid": "6b2dd547-9fcb-4384-8b0e-e5cb3a444fb2", "comment": "Malware payload", "value": "a90e99b5170a192b1eb7c5c9808c6b6ab69b9e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939267, "uuid": "82601213-6f0d-4211-b98f-943e5c8526f8", "comment": "Malware payload", "value": "a7136b8a080102ddbcd07fc5c3f5b8b13302fea3279d0717762352060064ac7f490d6564c483d450904b3bc38bf2c144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939267, "uuid": "512b46c0-82cb-4a8b-a434-0ed5afc55fb0", "value": "T10B545C4937A440F4D9679239C9A39A46E7B2B8550770A3CF036443B96F3B7E19E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939267, "uuid": "6e20fc2f-bab3-4efb-beae-4b77f8b4cd0a", "value": "b95e73ad92c2049315610876e4406ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939267, "uuid": "209c9934-78a0-46bb-8a12-32461993d5c1", "value": "6144:+hzTLdWUF63UDlkiy2x2/hSTyC2fPJyTpg+q9k1s:+ryg/x4JSg+q9kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764939267, "uuid": "a708c85f-c367-4476-aab4-e58b3ac28b24", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764939267, "uuid": "474e1f67-6861-4e6c-af8b-061d3416ecf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939267, "uuid": "ea61ccc4-a837-45db-9620-d97d818d840a", "value": "SecuriteInfo.com.Trojan.Clipper.835.20853.12052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e8b32f-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931040, "uuid": "b35c8219-de75-4221-9f9e-1afb092445a9", "comment": "Malware payload (Mirai)", "value": "dd4d96683739300d43b71b3a708141e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931040, "uuid": "d08d0f62-9e58-4814-a407-9f50ae538c2e", "comment": "Malware payload (Mirai)", "value": "20ecc400cded5b0b9ee0e2e1de311d8d2fba90ec2d70dae90a33505eb8509704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931040, "uuid": "0aecaf3d-2658-48e6-9e2e-9f0745efaa14", "comment": "Malware payload (Mirai)", "value": "7d1ff0b2233e8da382ca3af2dd33fcb9d65e6bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931040, "uuid": "80d7c5f7-f522-4087-a1b9-553ad1665355", "comment": "Malware payload (Mirai)", "value": "98ecf4679f793fd2297f5790fcf94f719d807523c3947c3f99c0f16b4323392070f613c057559d39becf1eebe00127ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931040, "uuid": "89304c7c-94b9-4f21-b25d-ccfe0d0671b8", "value": "T16B457C2BB2B2E66CD04BC03497DBC6A14521F0756A323D7B3784CB352EB6DE45359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931040, "uuid": "d4123add-b798-40c4-b4be-9255a634fad6", "value": "24576:RA0xx/eNg/nEYhkoavLkcH58+6FVuGq+h+8qUO3R6m0:RAyeNgv+oVcH5ufrqUOz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931040, "uuid": "46deaa37-e73c-4bd6-847b-733c3635219f", "value": 1269560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931040, "uuid": "b5c84f96-f6a2-4c5b-931b-1c5c8002891c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931040, "uuid": "0ccfa2ab-8570-4b7e-9696-b74c81898b87", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99454f7-d1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764922196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922196, "uuid": "7de2cf62-91a9-4be4-a04a-2862bd7051f5", "comment": "Malware payload (Vidar)", "value": "2cfafe927cd8f163f9a44614fec3ee4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922196, "uuid": "f9da673a-8823-40f7-b373-48dc5652433e", "comment": "Malware payload (Vidar)", "value": "21574ecfff3d615283b491da24aae0f58eab1c9d5b2d32a1b7c8c60fca053829", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922196, "uuid": "0ee6b18f-4723-4920-b58b-1cb22cc2c7cc", "comment": "Malware payload (Vidar)", "value": "8b6f322810e79c53593b3f5eca7d078f22c3d9cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922196, "uuid": "5b7d341f-9e17-4ca0-b5e2-0177dbe55c8f", "comment": "Malware payload (Vidar)", "value": "5e519d4e30b2341cec2d6255fee4f16c61fa2512b602712fbf30f3ed5c79ecd4d32f81dbd321f4d37936130492b75ebb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922196, "uuid": "965d5c39-60fe-4904-856d-d9a44919c837", "value": "T1BF863942B98249A5C6ABF238915163517771BC1C43313AE76FD82AA90D3AFC4273FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922196, "uuid": "d086c308-e4e3-4e4e-a7da-72abf1dd008c", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922196, "uuid": "8791a8ec-5953-49ed-9816-8e7602ed750d", "value": "98304:it367N2uXSW8KY+uU7WlusnySvff8LrmpK6xvdy3:il67N2pfZG03ff8VuvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764922196, "uuid": "399ab8e7-b4a7-4d3a-b28d-f106b0defe4f", "value": 7937664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764922196, "uuid": "21771ba0-407e-4a51-9569-ccee470bccfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922196, "uuid": "601ba525-06ec-432f-981d-b9cbccbdcd84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56228131-d1be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764927586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927586, "uuid": "37d1a2a9-efaf-431f-be2a-01e0740c1e6f", "comment": "Malware payload", "value": "c72a28f660132ea571ac1bc7984d7267", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927586, "uuid": "446bcdb0-cae0-49bd-a37f-25313a263e84", "comment": "Malware payload", "value": "21aba2329d9a6f68fdc358c487a54523beb8ee7751ec69779f53df09b14f5e10", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927586, "uuid": "a7b7954d-8ca6-4e0c-9d98-5ec8e3be248b", "comment": "Malware payload", "value": "fb3ff991ceaaad8ddcc9fcdac7dcb2e213a6543d", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927586, "uuid": "d9f9ad40-5268-4b79-abd5-e0053c4576a3", "comment": "Malware payload", "value": "1dc11e9e89b2a977bc8ef94257b5003267f101b09c2bf113f2e9d4cc02944c0ecc799a2b885530d28cdb39b4ffc0767f", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927586, "uuid": "b00b38db-b7bc-4dff-ad27-0a81a467dd47", "value": "T1EA214517220664FD8174D57195871397F6D381DB5102FFE8718601D813276EED2DBBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927586, "uuid": "86f84ec2-e892-49ca-a959-eb65e138b8ed", "value": "24:wqF70mCfmgong0aB3jlZPqRmJmX78VSqjLZ9WivoV0IzIO:umCfmgongNTOkMSHWKS0IzIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764927586, "uuid": "014da5a2-6264-4d38-a8bb-b31a2e82b00f", "value": 1326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764927586, "uuid": "98035183-5dde-4545-ba83-65bf4d7dd111", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927586, "uuid": "8d386990-2f98-464e-96a0-88658ba185cc", "value": "document.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81092475-d1a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764915632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915632, "uuid": "cd14c3e0-f36f-425b-ac76-1c83994d28f0", "comment": "Malware payload (Mirai)", "value": "aec23eeaab99d26b5f88c636ad5bdf68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915632, "uuid": "4d793f3b-dde7-4433-b823-8fa5fb0c76e5", "comment": "Malware payload (Mirai)", "value": "21e2a171206571aef8d8acc6fc2a52035cc422615cb2b31d40d0dabca7d5d352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915632, "uuid": "ab744a60-a456-47e6-8586-9de10dffc7a3", "comment": "Malware payload (Mirai)", "value": "e405d4162e14409e4b8c238ec34e0d0ea6896104", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915632, "uuid": "51ee99ea-067f-487b-80e6-4a6d7cf89509", "comment": "Malware payload (Mirai)", "value": "691c07158319ca32dcffc9c0c119c008f23e784804d25d424052298955ed57f25b1192c85b34162ef49258c323fafadd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915632, "uuid": "0b678741-1162-4907-a6e0-1dbcf9a8ea5b", "value": "T10083A44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915632, "uuid": "8c0d1115-fd5c-404c-9ec0-daa3836e170a", "value": "1536:VYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+a:V0bY7lmZH0iL5iNl5GKjVXz3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915632, "uuid": "c2405510-d013-43aa-9d80-e86331c6fbce", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915632, "uuid": "09101912-46a0-45dd-9e3a-85be196e81ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915632, "uuid": "ccde8e99-f732-4a79-8d80-482a95ba78d8", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a7fd31-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908600, "uuid": "fe3e6862-9266-48a9-8e97-f18908b951a1", "comment": "Malware payload (Mirai)", "value": "959c9246e4f682cdb4b1bc850fcde820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908600, "uuid": "71d077a5-0b39-4f52-8f65-f07e7f1b1e5f", "comment": "Malware payload (Mirai)", "value": "22261889412cc5173ab7b000210ad44bf680a64d7dc40fb0710b78ff3b63d1d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908600, "uuid": "04d1321a-bded-40a2-a3c5-df853e27ed83", "comment": "Malware payload (Mirai)", "value": "7221f1736a576ceb0c81fce6eb7ada0e32389630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908600, "uuid": "afee0e1e-cfdc-413a-b2f5-f632ca82295c", "comment": "Malware payload (Mirai)", "value": "4d01a2576b4eff63e345b9b99b247e4d87b46ea3fb613377f2e5369cc80457a769b1edb1f546fbbdda18f8bfce46136d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908600, "uuid": "97c80f1a-2be7-4a6f-9d3c-f5bc1e20cdba", "value": "T170431881BC819A23C5D4137AF5AE568D3B2133E8E2DB7217DE214F5136C682F0C6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908600, "uuid": "162e0aec-a172-4247-88ec-6e24010ff6d0", "value": "768:WBMEMzNVo029FdOcWQbb/Y65ZQ3Ey8eb3ZFP0Rt+sZ/Q16NS06gDAvUGFG7aJP7x:dEMSdOchb/9PTy8MYDPC1Emj7b8RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908600, "uuid": "31e09a2b-96c4-43c9-876e-9191459c0563", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908600, "uuid": "a377daac-0158-49e2-9a1d-cdd3b273fd60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908600, "uuid": "6f36b5fe-d687-4853-89cf-3ddc3a0f54e9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca08a7f-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931006, "uuid": "44160cd8-8267-4ae7-829d-b01e523fbaf0", "comment": "Malware payload (Mirai)", "value": "2b92113c5f36458e67d45ce1c8718816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931006, "uuid": "9770fc7b-60d9-4d0f-9a09-6eb9b85d21ab", "comment": "Malware payload (Mirai)", "value": "225d0ad2a0f3b2acfb0751a64f12816d71006b79cd2ea39740b51da601828f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931006, "uuid": "155004a9-aaba-42da-9e55-6b9de13ef433", "comment": "Malware payload (Mirai)", "value": "99608a9f0a57528cdeb2f2fe9a18e266fd1c0b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931006, "uuid": "1d2c8efa-4621-4c28-9f84-94d82ffef59b", "comment": "Malware payload (Mirai)", "value": "4b622e393eafd93a7189af9e4bf26c0efdcd91a9e3a08909b2aa795d96fe94f6f70e467d96a4d204c82ebd9d8b86faa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931006, "uuid": "d008a379-efc8-4cf8-8fb2-f7404f78b7d6", "value": "T101830240B4E699DDFF15C278B9C391E216A147383B76B56F998B8D0CD4F60CC9607C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931006, "uuid": "bdf33018-693b-4014-a524-42be12e1a307", "value": "1536:2xCCZPn9VVZ/aGmtnX+SLozypxhegOk0AMAWB9aWo5vllFapDrq+wkxjU0VHILgN:8P9zZixFhck0AMn9Jo5vVapDr1xF1Iwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931006, "uuid": "9c95a89d-5c3a-46d8-8467-4664e6bd866e", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931006, "uuid": "6bb88572-79b5-4cb8-ba60-976f4d1f8ae9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931006, "uuid": "7792f012-8b0c-4d13-a58e-8c6dc2a8bb62", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fc933a-d1d7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764938270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938270, "uuid": "2be84240-5670-466f-8524-49d918d36859", "comment": "Malware payload (Mirai)", "value": "e343b5c7a241ac65eb2d0dd3aee3ec64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938270, "uuid": "59d81969-7d10-4a16-a955-23d1be444bb1", "comment": "Malware payload (Mirai)", "value": "22b410473ecc2e5bff6d579cc15f41cb67f2d5343c9bf78573ae252cd9214da6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938270, "uuid": "0e70fd34-3740-4917-b89a-3798ab38e067", "comment": "Malware payload (Mirai)", "value": "9c8657faf6ab7cc115d715ca82b208eab0775a13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938270, "uuid": "f43016ce-fba9-40c1-87ca-41cfaaec959f", "comment": "Malware payload (Mirai)", "value": "dcd39257edf51487fa185df74c9e40e9c71da1414e2a969b8e9405a5c4154c0e83c6f86fc7dc18abacf5ffdb8e405101", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938270, "uuid": "7946ce35-8715-4658-b7d6-62f6a4d8028b", "value": "T1C111128F7890BBE09668ED373879EA0C6245935161D03B2C54CE0B36C2FE7847906FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938270, "uuid": "04ab6fe9-7e5f-45ab-b328-5bf3e4fe53b0", "value": "12:78ZQajkEZZajkEZuajkEZpKajkEZXW2ajkEZkajkEZ72ajkEZ7xajkEZ7+ajNaj:ehkSekSPkSpLkSckSVkS73kSakSzNaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764938270, "uuid": "c6b4031e-3693-423c-8b0f-99552f3f09ad", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764938270, "uuid": "d1d65fef-f0d6-4c74-b9c9-7cd6d8b8ea38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938270, "uuid": "ae2050dc-709c-4733-bb06-3e1e9ec5cd74", "value": "dvr.tbk-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbf70b4-d1ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764934548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934548, "uuid": "2c720877-375d-4575-94a7-f1d4a9064693", "comment": "Malware payload (Mirai)", "value": "01d3f114f809c8572297eafaae03f910", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934548, "uuid": "b175096a-acc4-49b1-9286-cb811944cb2e", "comment": "Malware payload (Mirai)", "value": "234cc4e68ba76b24903846332b595297fa119e970580901e44f5236f2332901c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934548, "uuid": "5423ac36-3bd0-47a0-9f97-5b98baba1005", "comment": "Malware payload (Mirai)", "value": "85e534d82b9ce9d6afa53ae02b81abf711d592ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934548, "uuid": "0b9796a1-f11d-4c8b-8835-f950a7ee8ce3", "comment": "Malware payload (Mirai)", "value": "e1645f61b5d3c8244bf118be408ead010979bde43e16b6872eef84797117a9ea1b055644c9853ec2281ef9a3269df798", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934548, "uuid": "493c487d-0856-440c-85a2-08b4349adc55", "value": "T1C01142EE24419FB09FA8C65478B2A900621AC35254C07B14E7CF777180FF54F352BE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934548, "uuid": "5f46f67c-1203-4874-822e-bcf41e853af1", "value": "12:78ZNjZ2jZ/jZpTjZXWXjZpjZ7XjZ7+jZ7Pg:eNF2F/FpTFgFpF7XFqFrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764934548, "uuid": "14ce22c4-2def-45f5-828a-61838ff1af09", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764934548, "uuid": "7e6c5743-05ed-4b44-9ad3-5ded3d093195", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934548, "uuid": "39db5765-92fb-4295-9c7e-d0a46c0f8782", "value": "router.faith-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0dfcd0-d1d2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764936052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936052, "uuid": "11986963-513d-4b53-93fc-c7068da55c4e", "comment": "Malware payload", "value": "5b40fbe7ab03af558a174a2e3905cf7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936052, "uuid": "d78e8c16-91d4-4fd9-a9d4-c4cfc5ef00f6", "comment": "Malware payload", "value": "23b4a8d8e006d471dde584418feae521d6fca51167fee8c46d8e457134841c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936052, "uuid": "d73c7cf2-6474-44a0-a8c9-5ea410dd4e0d", "comment": "Malware payload", "value": "a31fcbb3f51a6f753d05a5a3127c2853dccc3b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936052, "uuid": "147404be-63bf-4c1a-a69d-f352bf388562", "comment": "Malware payload", "value": "e3be79fb5317a3fc44dd85c2471e89b5a2fafc6b1ad07e0f378bb8455dae28f819b1a9556df39d914f7d6be9841038a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936052, "uuid": "656e29c8-6e7c-40d3-9384-fc1f64666fb0", "value": "T18717BE20B6528039D94511F09D7CBB7F472C2B7E077586E7A2E81C6C2E715C2373AA9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936052, "uuid": "1e70c8a2-2a83-437a-bee6-3327c6ecb62b", "value": "2621b857dc4b3267842fde5336673621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936052, "uuid": "efba937f-c522-4a94-84c5-4e35baf9408b", "value": "393216:aj+P/esQMce+Il4e6p9419q8VXLSeuBxrqNOwpG:h/eHIl4sxSeuBxIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764936052, "uuid": "7b1c182f-e007-4d51-9321-2e56c4313c48", "value": 19012960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764936052, "uuid": "8914bfd6-cfb5-4b7e-a265-31cf765a8229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936052, "uuid": "392981d2-b886-4982-a422-b9d313c2b499", "value": "getscreen-824417860-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a968bb6d-d22c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764974971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974971, "uuid": "76b1b10b-9c53-4c14-a5f3-c83cbbefc24a", "comment": "Malware payload", "value": "ec0d231ae6a8847a719b282e3c4af6de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974971, "uuid": "9015db51-b46e-4a9c-8c92-7432a30ca1e1", "comment": "Malware payload", "value": "2453f3c026aa3460dacc2386a5d725c124f9737601b30513f479ae338f6969cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974971, "uuid": "e377086a-2282-434f-98dc-eae5459cc963", "comment": "Malware payload", "value": "ffeb64cfb4c934eb882769bc584c11a2667f9824", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974971, "uuid": "7e07052b-2c51-436f-8f27-7134a06b1e18", "comment": "Malware payload", "value": "b38125d2936939728fa10b8a907c0c4f2d924c1d2a312100a60e6a59dd75508e9367c09f93e6a48756e05605ae8516cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974971, "uuid": "287adc8e-050a-4db4-95fe-797b76cb32c8", "value": "T1B81121DF382E1A90CD94C65C74BBE902E32AD24500F02B1563FEC731829BD067A1BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974971, "uuid": "e1dc91ba-e17b-4e7b-a945-fd51757c569e", "value": "12:78ZoDCe0ZjDCe0Z6DCe0ZpODCe0ZXWCDCe0Z0DCe0Z7CDCe0Z7bDCe0Z7qDCeLFD:eouxjux6uxpOux1ux0ux7CuxHux2umFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764974971, "uuid": "8ce89624-7877-4577-89cd-039bfcc2c2fb", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764974971, "uuid": "faf6c0f5-125e-4566-b174-67398c3e52d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974971, "uuid": "d115dfe9-dae2-4c21-9299-7b2e1dbdc0e2", "value": "router.faith-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145870ba-d1a1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764915020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915020, "uuid": "56fed4b8-13bc-4d43-a45c-3f79dd45b183", "comment": "Malware payload (Mirai)", "value": "a4ea6a8f5f2e58422cd6bdcda0a8ea0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915020, "uuid": "cc8ea4fc-bffb-4554-97ee-fed34a8caf66", "comment": "Malware payload (Mirai)", "value": "24989ce6341c309120f80d8f3c2e198b583e4fd93f64f6d4a615ea6d322ed638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915020, "uuid": "a4773cc1-3c26-43de-a0f1-74e18c12754f", "comment": "Malware payload (Mirai)", "value": "596b4d80d7955d4d73e22db93a095d2d28b6133a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915020, "uuid": "9f5ce07c-12d5-4b5d-83c5-d86f25a8bd63", "comment": "Malware payload (Mirai)", "value": "21835f58a5d673c30b25c981921a99ec7a2682d2ce5d2fc97997a59974ad64bbba6e6c33ad7f3324ce3fd5bd83395461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915020, "uuid": "f4eff8c3-248a-433c-ad57-3e21ea6e74ca", "value": "T12F836B03758590FCC889C1346AABA135E2B7B57C123077553784FF2D7E4BE211F69668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915020, "uuid": "78f7bad4-eff1-4357-9435-95e7123f15a5", "value": "1536:T1dWgOVrKdWLu9wMsjPuuORXp9Q5Iij302C3I+Sk0JUSAFY:5bOZKAWwvkpof30g+SlrAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915020, "uuid": "6c437319-91d2-4c34-8339-1bf7d9156572", "value": 80992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915020, "uuid": "52cef7cc-01e6-4c6a-b773-435727fb5f14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915020, "uuid": "1c645b1f-f40f-48ba-8934-59f6000b2ac2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337b2133-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958881, "uuid": "d19c8e45-229b-43b6-a0cc-7daf5dfb8e41", "comment": "Malware payload (Mirai)", "value": "020d7262387bd793e49c2ee827cd5d08", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958881, "uuid": "4d934283-e0e4-4791-b287-eb1181c8be51", "comment": "Malware payload (Mirai)", "value": "24a414e3e3abe17d8bf01a4808216b62bc360f793d6148482346a066193439c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958881, "uuid": "26caf0a6-e922-40c1-9b23-97521c8be3d1", "comment": "Malware payload (Mirai)", "value": "ad48ea35fd15b8dcdb4f44601eb77ccb459c9c9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958881, "uuid": "88ac6ac0-9721-4a4c-a538-3da55b9fbec0", "comment": "Malware payload (Mirai)", "value": "c109ccba1a5e8cb06098126690f147740cdb6889607394d95a29ae2aa241672bf3580e910a13b5bbb24bb893325c0909", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958881, "uuid": "a894d03e-9509-4b77-9a28-547f64304192", "value": "T135C012B9001B2985C005AE156069385DF26287CB95334B85B5883032B44C831B222E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958881, "uuid": "5ff14364-f3ea-458f-acee-7f51234a5b91", "value": "3:LxAjtyg/w8NBzSa+TSJa4TJvGBwVxAjtyg/pONBzSa5T69LwJvn:LA5/wk2QhJVA5/Mj/hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958881, "uuid": "6b6a66ce-9a78-41e1-b809-63127a107f13", "value": 176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958881, "uuid": "73e4c5d4-529a-4f81-9c06-804950f8ec61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958881, "uuid": "e53783fc-4526-4f9b-8914-696e77fb96bb", "value": "bah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9b0dee-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958979, "uuid": "96808caa-122a-4437-ad96-b7ac87aa8a2e", "comment": "Malware payload", "value": "948ea2c49ef7a0366c2f65dc0855c273", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958979, "uuid": "bac71dc8-5315-4a25-bba1-329d78d932ee", "comment": "Malware payload", "value": "24a9318bde5a9ac5b2d46bc18dc3c01ef6efd39938a634485e42b47fc1011f37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958979, "uuid": "48170bf7-9aa2-48d6-b5a4-04e78553b6a7", "comment": "Malware payload", "value": "6a0efcadd7351efbf5b7458f31825d852e6a46aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958979, "uuid": "40ad042e-48be-4329-b7e8-36a88c57cf55", "comment": "Malware payload", "value": "5c8257df77a5c71851d433345c295acaef3efeb0590d91e31e82056d6c74e5fc4a930dfa988a7c2c71614cc613826ebd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958979, "uuid": "d695adcd-135f-4900-a7c6-c354114b8696", "value": "T143E01DBD013BDF1781109D35B47624737032DBF661B5CB0AEEC5A43AE1C45207232E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958979, "uuid": "644ed91a-da42-4601-ab32-ef4c7a338363", "value": "6:LA5/rauzImwVA5/lcaNgNJwVA5/pjF+6PwVA5/neAK6i4Z:sh+yIchlcaNgN5ha6HhnK6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958979, "uuid": "875fc93e-65e2-4db8-b3bd-d61ab087a0e4", "value": 316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958979, "uuid": "a06126f0-ab45-44b4-9e60-c434f49d25cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958979, "uuid": "d2fc0123-f485-4eb8-87b9-2878cd991bc3", "value": "geo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21147370-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958851, "uuid": "18796325-6a0a-44d4-9a06-5c285b3b0b87", "comment": "Malware payload (Mirai)", "value": "2196e8b46c5b3582167be4d5d6aa3955", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958851, "uuid": "dffe73fc-6c31-4c87-b03c-3ebefd5d0ce6", "comment": "Malware payload (Mirai)", "value": "261bb8d05ec1f291bc97452a28e1144e4378a03a90b3119e63c7d2b993f0bf7b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958851, "uuid": "e28f0aa3-351c-4de7-ade5-166bdba5c6d5", "comment": "Malware payload (Mirai)", "value": "d2270f48f0af48642e560c5c69a27278013a156c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958851, "uuid": "492ed8b8-a2ad-41c3-8997-a92ec61700fe", "comment": "Malware payload (Mirai)", "value": "39bf60467c91b2fd0a422e8ed6869d9ee6f2ca67882f69e05d4207a94245e38724d022e5d4b96ddc12ab84c3f4cf0f48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958851, "uuid": "ee9d8cc0-34f0-4de4-969a-4d64f58b1478", "value": "T1CB1151EE4512EA0880284A35B03FC496703257EA64F79652BDC5513EF1C8A10B132F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958851, "uuid": "0dd53e67-4b66-45ed-9f88-3a24160754db", "value": "12:shd2ha3hJ6h+6uhlOBHhn8hO2EhwD9h56hcDR8:eOaq+lYBumwWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958851, "uuid": "e5a58684-2deb-4b0c-8404-16dc80d23bbf", "value": 952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958851, "uuid": "c9e540ca-4b45-40da-83ed-27370914f4b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958851, "uuid": "1e1ab692-69c8-4bcf-9035-3875d590a357", "value": "swget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc305c3-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958439, "uuid": "cb845150-8251-4938-bfb6-11436baa55d7", "comment": "Malware payload (Mirai)", "value": "bc30129c78f18437f1e7c2db1311a9a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958439, "uuid": "f8f6589b-14ed-45fb-9645-99d618c7534b", "comment": "Malware payload (Mirai)", "value": "26dbcd595cd19de4be93a4a16537c3ac7d7ed3f6a39e4ebe9f01d8a8cd64d7ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958439, "uuid": "cd3978e9-07f8-45ca-87c3-638db42ff974", "comment": "Malware payload (Mirai)", "value": "bf886efc614dde2ca35e1c7ab2ef3e82c32359b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958439, "uuid": "1f65e3b1-e52a-47e7-88b2-debc879d4f96", "comment": "Malware payload (Mirai)", "value": "d4886cef0c3265225ccb2a279161dfafcca32297cbdb49afaca27098fee49daaa1755f0f5caa5dfc7cf77f0728a29e12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958439, "uuid": "63c36497-09a8-4f8b-92dd-0eb556ec761a", "value": "T160E34C8AF403DEBDF80BD5BE44670D19E971D35122830B3A22DBFDA3A9311A94D16EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958439, "uuid": "933eceaa-4dcf-4714-8574-f42d58a1506a", "value": "3072:v06EPlIsXvOHMQ2NYBv5JE1eKYm2MHrCCUcZq:YlZXvOH/5pxm2M/UcZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958439, "uuid": "be9cec20-b2e0-4164-ace0-f5448034e8cf", "value": 150576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958439, "uuid": "eb0231ca-afa6-4785-9530-4f76c0615def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958439, "uuid": "09f504c9-b871-48fc-80fa-a4821140bfe0", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5286d328-d1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951203, "uuid": "e8dd2fe1-21b2-4c5e-9e64-e5c050ab63e6", "comment": "Malware payload", "value": "c1c8f12eba501c6c88cb4ead22eb740c", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951203, "uuid": "628b433d-c2ed-4f34-bda1-578072047d9b", "comment": "Malware payload", "value": "272d2e2c8d45bbaa8eae70ac37fcfdad3c60afda7834b712f5743aa850361489", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951203, "uuid": "e13c8388-7abd-42c0-9279-da1a4f779464", "comment": "Malware payload", "value": "a67fc31d6812b6bdf9ec545978617c8b8df72b33", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951203, "uuid": "4e7d18d0-c235-4781-a59c-d596deb75da1", "comment": "Malware payload", "value": "4422619de234c047084e26828d19878b3f9e1ea3793b56700dab240c1ce4cf97340684de70d0021de0f4ff7a5402d865", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951203, "uuid": "bc3bd5d3-8117-4300-b736-0b32a3eb00b3", "value": "T16CD05B75C745804DE622773ABC50B400541DBE6748C2B74C5491D85F05D019B7154796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951203, "uuid": "6e951b7c-2a0e-43f8-92e6-6de790436448", "value": "6:HRYFVmygAcISWAIEUSWz3RsBBArSDxDXtCf2RsIGE54vVG/4xHy:HRYFVmySWA8SQWBBArSlXtCGIfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951203, "uuid": "4810fd44-7812-4e9d-868c-0f69ae4cc3b3", "value": 269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951203, "uuid": "266ca2b6-4ca3-403a-8a3c-775ae2d08c88", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951203, "uuid": "d78da6c6-1f2b-4681-a4df-f70dacfaf825", "value": "Invoice #8765455.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db6466e-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764919895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919895, "uuid": "f8103b67-7a49-4a34-861e-1586a6c08e05", "comment": "Malware payload", "value": "a732fbd2e46b491e615c48c552fffecb", "object_relation": "md5", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919895, "uuid": "209aebf7-6b52-4489-bff1-883be2d2649c", "comment": "Malware payload", "value": "273f968085b4cd46f4bd6de112fcc155cf729fe0ac68fa19ac3e8bbdaa6284ee", "object_relation": "sha256", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919895, "uuid": "3df8acf8-f222-4004-b11f-76c4bff045d6", "comment": "Malware payload", "value": "89e941959a50dad42c5f0cba5e7940a34768669e", "object_relation": "sha1", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919895, "uuid": "f9cad288-8e84-4bac-8de8-49556603b353", "comment": "Malware payload", "value": "e1bbfe2944784fe8dafbf5fec21ee71740bd030c8044cd886a05712a7e04735559c6dc48a17648ee05fbfca0e8b32e98", "object_relation": "sha3-384", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919895, "uuid": "64ad5b64-0e5d-466c-91cb-7f010d11d042", "value": "T18EF42302ACA9D493DBD987B1C9D64EA49738E6B00C15D6B87F5F860A4CDF3CB710B522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919895, "uuid": "1055b5d5-e8fe-469f-ac69-834471a12ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919895, "uuid": "b048dfbc-9cdb-4d4b-83a1-1dc2811700eb", "value": "12288:vtJHeksNc7F+Rcd1QiOmBTXrpcxSOvTyoHEFfOUTlpgrFB39DOrO:vtJONI+uuoHJYRkFWUUFBFOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764919895, "uuid": "6242a267-4f6b-460e-a718-427827f15bad", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764919895, "uuid": "2496e2c0-f70e-4ca6-97b3-d3152b6c3538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919895, "uuid": "4e80ea54-1102-402e-8462-fc6be5b016e1", "value": "273f968085b4cd46f4bd6de112fcc155cf729fe0ac68fa19ac3e8bbdaa6284ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517ec07e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958932, "uuid": "fa3115fb-6688-4e5c-a846-f92b429fe891", "comment": "Malware payload (Mirai)", "value": "158e4f11dd7d7223c66f6cc088523ca2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958932, "uuid": "085ddc07-eb46-49df-b69e-f687fca96059", "comment": "Malware payload (Mirai)", "value": "27541e583a8bee9b9bda00ea81bd1d84184daa6ebef575a7cf31c14057542741", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958932, "uuid": "0e90c50c-de5f-4584-844c-7d8abd381a65", "comment": "Malware payload (Mirai)", "value": "ed9d79a6eb2e55ab65ba4cf7ddcdeb8bf5d2f0b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958932, "uuid": "9d643056-a1d4-45f4-9d49-3f4fb6bfb5eb", "comment": "Malware payload (Mirai)", "value": "596035e47ba2a1cd5f26dfc78dbe9106524acc64755bf9017b10c0478423172d69b87f968851fcb9503ae2b50774d977", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958932, "uuid": "af2bf6cf-d297-4686-91de-9a42cdbf0cc9", "value": "T17911337C410AAAD58449E43FB285C00CB0A24FDE18FB87941D455A3D34B01FF71B2E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958932, "uuid": "0c87fb8e-63c5-45f7-bdfb-07155638f96e", "value": "24:+FdaFl52aFLaFAaFAUaF0aFJaFmaFaaF7aFA0d:+jafAaRaGaXaGaTa0aQala7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958932, "uuid": "0b1eeb68-9792-4307-a8a1-57270e2aa845", "value": 1052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958932, "uuid": "03827de4-8cde-4245-b692-202eeaab351f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958932, "uuid": "5066bef0-96e3-41d2-acc8-15b3cdcc110c", "value": "ssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf5d733-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958357, "uuid": "cea34375-fc43-435b-b403-8d211dad3a32", "comment": "Malware payload (Gafgyt)", "value": "ada07afb446c61f5ddb6f1a5533bb8cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958357, "uuid": "0b802937-173a-4487-bf2d-68eb5044716b", "comment": "Malware payload (Gafgyt)", "value": "27aaad7ab77f1bde311565c897beb809d8340fa8c7703de97427501e62c64c33", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958357, "uuid": "a3a90ede-d689-4b4d-a971-e5070cca9198", "comment": "Malware payload (Gafgyt)", "value": "ac93276f6bd2ffe0fa3f9bd2cf274860736ddfe3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958357, "uuid": "4cdc1b7d-d64d-4d72-bde8-ebf31018018e", "comment": "Malware payload (Gafgyt)", "value": "155d1d5cab53b9b910f0c9ede08853ffdf16209700a3c390065f1a4445105fc405a01cda193d0b9e06dad3c196c818eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958357, "uuid": "c40bd1ef-2f82-442a-ac65-5a512253024e", "value": "T14F213A8E2258B687191DCF48706A80DCB5F0E9C4F4B48957E884B8FAD4847071178FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958357, "uuid": "b7db1b5b-ca39-443e-8709-8b677f55be48", "value": "24:3J3/pE5eeEcbMNIZEtksEVKT9FEHqcEOxiMETKa3E3eM82EKPPzEzUxE19QmEkrx:p0eobQkDQ9cqExipKaEejePPUUEm4rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958357, "uuid": "f03066b0-92ca-442f-b417-81051a36494e", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958357, "uuid": "f4713b77-12d3-4679-8aad-453bb5335d46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958357, "uuid": "da495de9-4a42-4f05-90cb-502d7ace2c23", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3d1d71-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959487, "uuid": "a30797aa-0556-42eb-a9c7-fd7c20533c6c", "comment": "Malware payload (Mirai)", "value": "f5450297116080445b632b58d3f3a8ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959487, "uuid": "aa071eec-e294-4c69-9480-4d2f063ea653", "comment": "Malware payload (Mirai)", "value": "27cd08d06037e115b340e1ace170f62fa9d7f95b03e5b64d7b7cfec2d0c5090c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959487, "uuid": "a87342ee-e067-46df-8d12-de5f35487cba", "comment": "Malware payload (Mirai)", "value": "1538297b28e79c415c6ce42de00182dc6c40776e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959487, "uuid": "602b4b01-a43f-41c0-affa-c74dad378034", "comment": "Malware payload (Mirai)", "value": "cd350da1c1915f46e557e6068382094d1f2b318b99928ebae2390ace9f4ac487a2e79e2d046cc79e982b21ebf1f375df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959487, "uuid": "b2644196-4bb5-461b-80b1-075a834d9004", "value": "T158232A35F9761F17C0D168B621FB4B68B6F106CE26E8CA4E3DB20E5EFE619405503AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959487, "uuid": "64ddd8c3-73d3-41ca-a937-140207b0e210", "value": "768:B4QWohuZvDxIUfkGt93ybHrb55qCY0QkQjqO+9rpoReVgwj:B4b/ZvD+U393ybLbyCYzkQj49usj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959487, "uuid": "c5b5c3ce-6cac-4099-be8c-5f6037f521c8", "value": 48800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959487, "uuid": "30e1cda9-57ee-4949-b56b-bcd3448e2160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959487, "uuid": "e1234c2c-8a54-48d9-a401-b15c578357a8", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5e2284-d21b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764967458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967458, "uuid": "3218da0d-74c8-4a74-8e56-f736c2203e52", "comment": "Malware payload", "value": "5a12b7b7ae0b0038d6d699c83405ad72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967458, "uuid": "36a5992f-8698-46d9-a22c-18caddc9a151", "comment": "Malware payload", "value": "29f483e4931773693ada4ce1a1ed1bdce9a4df4664771f72d62a5395894a7ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967458, "uuid": "d3ae5715-a999-4929-89fe-bc53005795a4", "comment": "Malware payload", "value": "dbd2474d50c8c1e630fddac4e64bb6f8e21bb166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967458, "uuid": "be6c6a0f-75b5-428c-95d1-cf5a6a63a60e", "comment": "Malware payload", "value": "ddb90e45bdc00ab0fa7b81557a7bafab7a0377d78b37c3fdb9f22a50afe4f832608eb4eecf42656e562da85f16da62a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967458, "uuid": "d82e8f6a-8069-43da-90c8-b20f63e24647", "value": "T1FA54F12ADE6351BED6298934C9531C06D9B2BC8B47A0FFDB17900CE639619D49B3F701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967458, "uuid": "8d5c1415-075e-43a7-afa2-1c1c09be1d3e", "value": "97d2d684309cf7a1244a9ca45a0086e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967458, "uuid": "6b5d4fae-083c-41fe-8d82-8ef471b28b22", "value": "6144:qGS3E12kF+5a27iIJeinBKxMtq07UB5vxMGDjqHzU:qGS4V5MLn8xwvOxMGSHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764967458, "uuid": "94bcbbae-2d70-4fec-8fec-c825ad2952e7", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764967458, "uuid": "5e6bd235-b29d-4a92-b75c-686c96b5f8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967458, "uuid": "a8ac4c94-0362-4058-834c-6e456b79170f", "value": "flstudio_win64_installer_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df760652-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951868, "uuid": "d05086ee-ccbd-4db3-880d-8d1d0aeaf709", "comment": "Malware payload (Mirai)", "value": "afddcaf61373a0497fd5d614b7490731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951868, "uuid": "4ae27011-9735-4445-bd94-7f9ba7960682", "comment": "Malware payload (Mirai)", "value": "2c3b8f7ef1dbbbb369ba77f9ceb595bb7b223137a925a99c98eaa1babe85b147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951868, "uuid": "590b94c6-18e0-4276-a778-0b9c8e892122", "comment": "Malware payload (Mirai)", "value": "3f9d64528b6f0e06030a1f0c8851809718ff8d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951868, "uuid": "1d04d91b-04b3-4f51-8eb6-dae13978d57b", "comment": "Malware payload (Mirai)", "value": "3a1246a993074558a8b63c0159dfb945fd5cea09a9f1faf1b336c26edc2f67504a22cdde492340614d88738f19dc5baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951868, "uuid": "1183e2d0-d540-430a-b4c6-4b21f082eb7e", "value": "T10DB44A55F8809FA1C6C12976F64D46AC331347B9C3EBB20699245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951868, "uuid": "f1545073-8c53-42c0-a548-75397999ebfc", "value": "12288:HYU10zqTE/WUk+sBEKry+/5BKxQfgpjjgX5h2:LqzqA/C+sBN/xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951868, "uuid": "6c066f0c-7743-4e6b-a2ea-ac19e8bc345e", "value": 513384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951868, "uuid": "43a1c0ff-9341-4cde-adc4-c184b2aa75f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951868, "uuid": "b37cf0ab-6cab-4def-9523-b51010b5a88d", "value": "SecuriteInfo.com.Linux.Siggen.9999.29486.20705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bda0e95-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764919758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919758, "uuid": "a68d2cec-828b-4f97-9df6-a47859dfe75e", "comment": "Malware payload", "value": "a93298f07025798b4adb7a1d2b0a27fb", "object_relation": "md5", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919758, "uuid": "206c4d3b-3f5d-4e9f-9980-e552e21955ad", "comment": "Malware payload", "value": "2caaf6ec466cd38dccd20a5555633e20d11ee3b345e0b93e12daabdffa676228", "object_relation": "sha256", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919758, "uuid": "fc39b994-57d5-474f-8703-be64379c02f5", "comment": "Malware payload", "value": "ebcd68c3172538b2a08cfb23b26eb4607b0fbc48", "object_relation": "sha1", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919758, "uuid": "82890a07-c9fb-41c9-bd9d-3b646445256b", "comment": "Malware payload", "value": "05492d0cf343274c1c3b0735f7c1fb29d889636c4b3c5ba78cf12c9732811a3543c2c8fe16c96f671712bf189d952de7", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919758, "uuid": "3f9ced84-98f3-4e62-bd05-7d3faff0f31f", "value": "T1D501DC1F210B99FC84E0D4B0A0571B0AD7D784C32642F7E5324A01E4512B29993EBA5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919758, "uuid": "17d89612-b83c-49e4-b090-e0fcacb32611", "value": "12:wbYVJ8z70mbnh1D+gz08I3bkzdXzGjLRdPPPqu3/ZTIAloOVj0V/+w2p7IKWNZ:wq8z70mjz1y2zGjlZPqu3/ZkmoOVul2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764919758, "uuid": "75365b80-d372-4148-8d0e-c765ae0f80e2", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764919758, "uuid": "df336681-0e78-4eb2-bb31-35fba984bf47", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919758, "uuid": "62961c5a-3274-4354-ac3a-bddd1dd8e1ba", "value": "Document.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ef41fe-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959021, "uuid": "35c5df4a-b5b9-4902-be08-4eff1e8a5abf", "comment": "Malware payload (Mirai)", "value": "5928c492872cc64a5f2629d4e547ce73", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959021, "uuid": "3f606d3f-d14b-4dda-ade6-06bb138a52c0", "comment": "Malware payload (Mirai)", "value": "2cc7a00b8a44c675993c666c897aff1b39b25482cd09a2172566a98d3caadc87", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959021, "uuid": "3e59e4bf-8d8b-4e4b-a8f2-37d4efa8142b", "comment": "Malware payload (Mirai)", "value": "d2825fb67b8db3a5ca0fc29f56cda87e484560a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959021, "uuid": "8dea387a-cb75-40c3-96ae-513ff136c1f8", "comment": "Malware payload (Mirai)", "value": "f090241c64928c4a6580af242ed07c08800efcbf4650e4e924c0c1903a8d04431f38978321f167f3dbd3684dd8b59976", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959021, "uuid": "5a6b4dd2-23b4-4cdd-a9d1-13fce197564c", "value": "T126D01264300E05C14D40BA953A1B20713162970BD0A79A1F9862A1B3D653815F011D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959021, "uuid": "66f96ee7-297c-4a88-b036-b06d5505297d", "value": "6:LA5/kWiA5/oAaka3BZhKYzEOELE7AwRkoLhn:sh5fhU137T+LCACh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959021, "uuid": "4d12b64d-994e-44a6-8193-db74475c2b62", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959021, "uuid": "053da5e6-8950-4c07-a0f3-7a0cf0b7206c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959021, "uuid": "7cd42ac1-c6e9-4a12-bc12-419801656764", "value": "zb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94af2d-d205-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958331, "uuid": "ef557351-75b8-41f4-b7ad-868fc4da9acc", "comment": "Malware payload", "value": "d79d00c508a7eafdbf0fc8eaa490dd21", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958331, "uuid": "3ae141b8-b053-4dbb-b46d-ccaf10a2e094", "comment": "Malware payload", "value": "2dc9eff615621aaa77f95a63254b84fde2d0a0aeeb4140e3f811efbfff5e265c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958331, "uuid": "5c63c0d8-84f3-4576-8dfc-f19614a6a59a", "comment": "Malware payload", "value": "dabc7e47a434a57ba0f0e0e2f18065f98be8a04c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958331, "uuid": "670d0d5f-1d38-4f4d-91a7-0f63490b2cd1", "comment": "Malware payload", "value": "051cf8d0c29769c8a21fd28c3caa488f444d3505c6685a012c529b61d9b010b79666346172273f29d0a68db5690bf79f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958331, "uuid": "f5f1e7ec-c7ae-46d8-8576-710e0674a3c5", "value": "T13BD502BB98B268535A908563FB0F2C1A335B29D43B54D345EA4151AC3F3B1D38E92B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958331, "uuid": "79a09cba-be2a-412e-9db1-2ed10a6b34c5", "value": "49152:zOc2yD4lTPxlhtOZD30M45admBbJEyg6HYTQPlzWL1BPAiAWI7v1RgvfN:zoyEFP7bOl0MSE6dbgzTiNWL1BP+vNR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958331, "uuid": "c3679631-0d10-4457-8b3a-5de69c036575", "value": 2911784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958331, "uuid": "b7a74f12-2bf9-4257-ace6-8c210c932bc8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958331, "uuid": "5a5a7ab1-243b-4b9e-9921-b7b4e3c9a414", "value": "INV.E6849.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9285abee-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959041, "uuid": "c9e86d73-80ad-4235-9e82-d9c6be6d78e0", "comment": "Malware payload (Mirai)", "value": "df11ff201416700699973469c346e680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959041, "uuid": "490ba0fa-2ab3-4c4c-8288-75803fc42395", "comment": "Malware payload (Mirai)", "value": "2e551fe146561dda89f65b47c1e79e7eb7a5a99ca8889d7dbfede5928250ae6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959041, "uuid": "f65bcde8-ec7e-4d3f-aff7-4217be4fcd17", "comment": "Malware payload (Mirai)", "value": "341f2a2a5cdb05ba7972a19061184bc1fb5daa84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959041, "uuid": "416fdcc0-aa1a-41a0-8a20-8298faf7b409", "comment": "Malware payload (Mirai)", "value": "6598dfd96d940a476e1f0f5fe2505ca9dff6a3c101b96e7da094db23dd02e40aad80fe8e514670e0a61f4d9ebbfb1043", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959041, "uuid": "cee700f5-e46d-4a94-ab2d-337f76d478f5", "value": "T1A453B61A1E269FACF768873657B78F31968833D326E1D741D15CEA011EA034E741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959041, "uuid": "a9fe57aa-f48c-4888-b3b4-a68ce84055cd", "value": "1536:JwpesUa+1nZYKXqMyERPiRExPP8nPiZnPPUDpe0wqqud:SzUasnZYqbqE0hqud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959041, "uuid": "a2d586d2-a74b-49ee-b872-b93d3be08bef", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959041, "uuid": "fe91816a-8e0e-41ee-b905-1ef4144abdcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959041, "uuid": "ca05eaa3-0a88-4f3f-8ec4-f4314dabb5a4", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663ae100-d20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764960685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960685, "uuid": "93a0d1ca-a760-43ec-838a-d6ae1ad7e75b", "comment": "Malware payload (Mirai)", "value": "b460deb236589d5c48766c3e86dfd286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960685, "uuid": "355a7e90-85bc-46ad-81c4-861389a8a5e6", "comment": "Malware payload (Mirai)", "value": "2e84ecab51b94f9a08c13f0250aa4097cfad852d2bbbdbc743fc0511d61a4fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960685, "uuid": "fd2f1858-ed46-4756-8eca-43923c33b2ea", "comment": "Malware payload (Mirai)", "value": "6dce38abbff688dced97db52fb0abc03dfba9570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960685, "uuid": "43fb679f-1b4a-492e-ad8d-9224fe6dc2ab", "comment": "Malware payload (Mirai)", "value": "2e7eb54f87d4e1c7fe0d0bd7f846cd5c7bad109aaf48d54cdef018e1dde284f7b5c4c181b0e4b5d932962f13dc2e6257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960685, "uuid": "2f16b097-a505-43db-9d9b-ebd8bb111e12", "value": "T1BB446A02B68080FFC595C0781BFFB636EC21B0AD5279765A37C4AF562D4DE601F2EA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960685, "uuid": "243d44d6-2e2d-4fbf-afee-310e83bf3683", "value": "6144:dMlgf1IFKtyUHSbVihEGXcsRTGsj4ntvlME1:d/0ESbVihEGXbRTGrH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960685, "uuid": "ab0f917b-1d63-4d89-a76f-e93c0c7eac47", "value": 262568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960685, "uuid": "ca38d6ff-d6c1-489f-a387-f2578f7c16f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960685, "uuid": "81b507dd-641c-46eb-a905-6dfb5ca4d816", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231ff95e-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908603, "uuid": "68fd8a99-9f80-40bd-9885-0ebe8f42b007", "comment": "Malware payload (Mirai)", "value": "668799ab766784e578141fda0d4baf7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908603, "uuid": "38b62505-6230-47d0-8e64-f779da8132e7", "comment": "Malware payload (Mirai)", "value": "2fc0c344c0ca60c28755db0042aabbf8f7a27d440e577e1667cd1cac04bff2e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908603, "uuid": "662b0450-d958-41cc-96c9-7ad012a2b32a", "comment": "Malware payload (Mirai)", "value": "a61665849b7a00c9b7f23ab23a30b0eeb3ea9406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908603, "uuid": "80df0901-d302-4c1f-ae08-a8797097fa84", "comment": "Malware payload (Mirai)", "value": "70fc5d8a38b9495abb6806764dedd753d16dd2aea57ede2e9fccee25b5aa59b3fb56b88ffdbca6e99c0c7f19d3dd8953", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908603, "uuid": "bc1bfa06-ee0a-4636-832c-e5d87dfd2d2b", "value": "T114230791B8819A27C2D41379F5BF998E3321B3E8D2CB7227CD614B107AC551F1C6AFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908603, "uuid": "3c0456f0-9698-4dc7-9047-b11ff99580e0", "value": "768:knZOJmi7siy7VmQyIz6042GhUZQS8pJWYYe/3+bgmMSTlNS06gDAvUGFG7aJP7LS:kImivfIz62GhgcJWYY4EpVDAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908603, "uuid": "c7745449-c26a-4839-8bca-b9bbcebe002c", "value": 46992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908603, "uuid": "59b7d860-c763-41a1-8c9e-5899e020dbc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908603, "uuid": "5554d6a2-1d58-4361-bbf7-1c2c60ab7369", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc08374-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959029, "uuid": "c70bbf10-1454-4d05-bcb1-7071bf35fa6d", "comment": "Malware payload (Mirai)", "value": "250fd2ce801b3ba6285caabfff2b0849", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959029, "uuid": "765ace5d-e0ff-4ba3-b03d-df498f5ef711", "comment": "Malware payload (Mirai)", "value": "300696041ba1e7fff0655a07faf1090d7f50e3c27d6d929a30ce5543cafecfd1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959029, "uuid": "8a1e8bc9-c281-4b3a-b857-1c5877eee5ad", "comment": "Malware payload (Mirai)", "value": "a3f620be3b67603928d9ec11cb015660307b4d73", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959029, "uuid": "04f438ce-e225-4b80-9c70-8facc66e73af", "comment": "Malware payload (Mirai)", "value": "45b85814d92d300e327356f2016a43a646d251f417cd317545ba6fd42d3dfe529b10d989b609a5f0ec25f1e45fb4bb95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959029, "uuid": "530d7d0b-8af6-46a9-ae56-826552c89133", "value": "T1BF0180BD0227EA19C124DF65703F5491B132CBF6B9A59B0D69CCE536F1845B07023FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959029, "uuid": "b4e77590-0951-45e7-a402-d3511cc9c383", "value": "12:shdvhaihJ7h+63hlOBShnthO2lhwDYh57hcDH:ejXHzlYQDrl7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959029, "uuid": "bea7b4ba-df58-4184-a970-d43c771e8f87", "value": 798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959029, "uuid": "9c4303d7-cff5-4a84-ac61-1f984004c896", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959029, "uuid": "2542c104-46ae-4714-b423-5ea41ceb400d", "value": "ipc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d292a4c4-d21e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764969027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969027, "uuid": "2287c042-f852-4e74-8c64-9975265389f6", "comment": "Malware payload", "value": "79029956765af0fdc3dd549ceeb796b9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969027, "uuid": "78ee20f3-3aea-4c21-9572-df71abd56552", "comment": "Malware payload", "value": "3071a90e290ee07aaa533e6c19d669ebb455f1400312bc856800256aaf3ebd85", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969027, "uuid": "0f77c427-af49-40b3-9d0b-20913678d1e8", "comment": "Malware payload", "value": "6c03a676c0ad9f4e4adca3436a98ea29d76ddc2e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969027, "uuid": "f8cfdd7a-5a79-431b-94c1-099188a3f992", "comment": "Malware payload", "value": "5f08185c07d6cfa1c8fdee919894cb9f8ccaa922428552f4316d073f27cb94771c26e9fb99d9608ef2745eaf1138d772", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969027, "uuid": "477ea667-f140-450a-b80e-9f19d9671e0b", "value": "T1EA4109E240ABD496E4D39FD581D202FACDC08E615930E7D137E9BD0AD8869FCF795188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969027, "uuid": "9e09f44f-86ee-48f3-986f-10031268dcd5", "value": "48:/Bi6sqpkp9d4Zv1/XVYrWjTvNx2qgAAoPTyHaK64J465nIW1+AN:/gYpe9GzXVqcT/xgOPy3F465nx1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764969027, "uuid": "178f4cb5-dbd4-4ca2-b337-3456d5576ddc", "value": 2119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764969027, "uuid": "2ad904e3-b8ec-4917-8a41-b050e7e88b29", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969027, "uuid": "7c3736d4-f71d-46dd-b536-078d4050b184", "value": "social-security-statement-upd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb9fd7d-d229-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1764973451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973451, "uuid": "c3f2f126-314e-4784-b833-31050b4638c9", "comment": "Malware payload (Amadey)", "value": "909683a922246acc8bdd9f73622d8c45", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973451, "uuid": "ce9dbb44-b91b-40df-968e-677b26d9cc94", "comment": "Malware payload (Amadey)", "value": "313284d14a0490d2256e2836ee34fdf8a61abfdb4742e5fb98a9a722a31b6fbb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973451, "uuid": "ab42db55-31d2-47d7-933f-9ecf7801c56b", "comment": "Malware payload (Amadey)", "value": "e4aff15fab17281877e47b38cbb55fe9c89b843c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973451, "uuid": "d67b6400-9ba4-4d01-9b74-26472aefa0f4", "comment": "Malware payload (Amadey)", "value": "d7fd85e5cb2ff259e897e095fce64b2a9da023f59f0dd244d02f20a51571c8f68dbf3c898552a862c27a7baaca73aaf3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973451, "uuid": "57b77b60-0766-48c9-9f95-af1c619277b9", "value": "T11A168D02F790C1A5C4AB83748AA34222E77178644730A7CF5655EBB51FB7BE2693F312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973451, "uuid": "5dc4ae26-824e-43a9-ad8f-1e36cc3c9f9b", "value": "49152:sHCo/Ip7UXWHV1Ok2W3AmsPwVLo+UzmUYzfdVZI5IP+lB4YtevCOWEoLF18nCd44:sHV/4UEsWw1upCOWNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973451, "uuid": "6c83604d-e637-4b68-a905-6400df720b56", "value": 4045312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973451, "uuid": "96144eaf-d05f-42f6-bb52-5ab593d67abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973451, "uuid": "e7d10af5-f231-4ead-a23c-160809ec0065", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64b3620-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951799, "uuid": "b7d1d833-a71b-4326-8ac3-4debbe001350", "comment": "Malware payload (Mirai)", "value": "43457f91cc599a4585e9fa94d80d420f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951799, "uuid": "312a05d0-e2a2-4a9c-9841-002c200fcfd3", "comment": "Malware payload (Mirai)", "value": "325b3c54c4c870c1ddc89c78afaea8735b306487b4a05a030a118113bc1557ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951799, "uuid": "8d2d8b64-8e97-48b1-859e-a5c6da49a3da", "comment": "Malware payload (Mirai)", "value": "fd52f1ca65bfb33038b917ce0f6a10af48bc998f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951799, "uuid": "75cbf089-8c77-4381-96fa-961b95be2bdc", "comment": "Malware payload (Mirai)", "value": "527a26623e518b04e1a79937c7f8183330d5bad26d6793271a3f8a24d4c04d54ad92fee129c3eb90d39bcbcc92cd014d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951799, "uuid": "0ed0c6ba-2fc1-44bf-8432-dafa8b228a27", "value": "T138042377438FF8CBC65A98F8D851A6182B8F1858BB185E60B73AC7C551381CF0AF55B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951799, "uuid": "851f9acc-eb76-45c3-8856-385d17f8b7f5", "value": "3072:rwFzBOzfKIzserU5Zm/hC490st6foUrIO3OXoMMrZQIiLlj0W/MPxiT8D:85BefKIAerU5M/hCitgoQIS4Llj0W/1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951799, "uuid": "ce49ca45-d2a0-41b7-83d2-ef14ac2ceb62", "value": 185972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951799, "uuid": "e2bad561-c0e2-43fe-ad18-b9eb185cd338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951799, "uuid": "69a4c232-e7af-4d98-9674-aa37d9653041", "value": "SecuriteInfo.com.Linux.Siggen.9999.29486.20705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3f408a-d20f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764962547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764962547, "uuid": "bd844509-eae9-467a-b4f7-f64b42487db7", "comment": "Malware payload", "value": "9b699a66bbfed34349c2777554f308e0", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764962547, "uuid": "2e6fd330-adc0-4e55-a065-89b21023e8ea", "comment": "Malware payload", "value": "3355b7dedb6d83bb8b8243e4ec5c1da9716747541b64239a42f8af6549c4be2d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764962547, "uuid": "a1080f45-6963-4c3c-b519-5aa20642a332", "comment": "Malware payload", "value": "0b1d853d4c15e2f2988eed458d3c50815862476f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764962547, "uuid": "a9bf17b3-235f-48be-ad46-cd2fead35977", "comment": "Malware payload", "value": "0dc546c80be8825f2c2a45636b015345933de13e63fcb6d2d6afb7e208d6aa4ff7908b1df6072e2d1836439fbbda2975", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764962547, "uuid": "7cfbbe37-9423-4371-9126-b669222ca3f6", "value": "T1817330484ACF84E899277458CADF4C43F7E5CA23061CD6F5FA0D69A12F5283CA3E86D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764962547, "uuid": "cc967f4c-63b1-4006-aeea-6166ca083a0d", "value": "768:yg2mEAhsZPY0jRQ0u8YjgiJ9OjehH4HZTBFUBLeMDQEXQLXp9zTf/aLSrZ5f4Tzq:U3Khj4HZb024zogsoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764962547, "uuid": "528ad328-da0b-458d-bc97-13a80d60bff3", "value": 76662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764962547, "uuid": "57ab05eb-dabd-4dda-b3b8-66821fb118a9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764962547, "uuid": "e4d5ab3c-26ee-4ef3-ac18-4068fd10cf48", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a9ef73-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908552, "uuid": "2878cbc2-e06c-40f1-8937-e10f760c0df9", "comment": "Malware payload (Mirai)", "value": "90747527c1dbf0677c2357850b11b4d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908552, "uuid": "3b7be3a9-4db7-4eaa-9e07-a6bdfb2bc65e", "comment": "Malware payload (Mirai)", "value": "335d202e85b0cadc0daac36efeaeef08b9781b41a94bf64bd048561296fadccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908552, "uuid": "dfc1516a-d8f2-4a34-bb6c-a4f77098620c", "comment": "Malware payload (Mirai)", "value": "5f2ba729627f81101838506dadc67861ddde6461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908552, "uuid": "081b6935-1aa3-4973-b105-6305220b32ca", "comment": "Malware payload (Mirai)", "value": "e922731bcab7d80e1278abdb58d470a836e2de8bb1b2963a2d01ffcff7e23ccc77928cf56f82ee11c0ce9b04c3bac48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908552, "uuid": "3fda9408-ce88-4ca0-b02e-a8eb875d58f1", "value": "T10C432A25B53A1F23C4E0A47D11FB8B59B2E15ADE26A4C64E7D720F4FFE21A406842DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908552, "uuid": "ba8932c9-03dd-4e3f-ae9e-fc6ebeee1d1e", "value": "768:vOohkbPzFJj9pKM6YgMUQuVzHOGuT1rBURTvPBB7DnPDjoXzO+hnLw8:vOvb7FJj9pKM6/NQuVzHOGuT1rBI4XW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908552, "uuid": "fa3c38e2-8ae2-4b64-99e2-74622aa4756d", "value": 56944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908552, "uuid": "4cb7ee12-5047-47c1-bfa1-f74106a4cb63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908552, "uuid": "9d2bca88-f1c0-40f2-accb-fda34a20ba6a", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38725421-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958890, "uuid": "7244ca2f-8a62-425c-8228-297e007109ab", "comment": "Malware payload (Mirai)", "value": "d784d36dc4f32b3dd80c6ecedcb0f9d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958890, "uuid": "fd470b1b-0c06-4286-9548-d98eb91a415a", "comment": "Malware payload (Mirai)", "value": "336f8f46c5c6c400ed5eab7ce10d56c81e0ddf0e7962e5083fa38cda9e2adf59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958890, "uuid": "12077007-e57e-49cb-9b6f-8f7711440dbd", "comment": "Malware payload (Mirai)", "value": "938a13d4e5f9e6cc8716693151ff5ca9acdd89c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958890, "uuid": "51c4c781-6473-47bd-8f53-313e129b1456", "comment": "Malware payload (Mirai)", "value": "1757741a01866d3165c2c101bb1e1938e285043b629ef83f5306d2825e70c85ee08e60736ce1691af44248bab1c4b7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958890, "uuid": "d582d4ff-a1b0-4694-8e0b-93a10e25f187", "value": "T12333A509BBA18E77D86FDD3B05AD0B4538DC960722A83B753834E428F35A54B5DE3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958890, "uuid": "0b9e5a0e-57a6-4c45-9268-5a2e0dc5abb1", "value": "768:q//1jKdqx35wE/XVFZoSEeW5yESEeIpQet2Tl07LXik8lDwFQuB:q/tjKdSpwE/XVDApo69pQI2xA4Dwuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958890, "uuid": "8bd3dd98-1aaa-4804-9d3b-b6f0f57da2e1", "value": 52260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958890, "uuid": "aab6afe5-1151-450f-b5fc-ccf6805a60f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958890, "uuid": "72d032ed-05de-48f9-8fd6-0b3960a06ee1", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065a79aa-d1d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764938619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938619, "uuid": "aa39c486-845e-4dd9-b4b7-f91cdcc8c883", "comment": "Malware payload (Mirai)", "value": "c3e760eb72c362d165617f6ff87bdd0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938619, "uuid": "d8483c86-85f0-4fbc-92ea-c6c29bf2ee53", "comment": "Malware payload (Mirai)", "value": "33bd46c5f00b789cc31bc21ba95d2e9fd9f2f22fb065cb9dc41b463ebc96013f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938619, "uuid": "306edca5-7646-444a-9131-92047c69945f", "comment": "Malware payload (Mirai)", "value": "906d12148f8c9c818a571e308be078462b7c8b1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938619, "uuid": "20033b9a-83f8-49ba-b262-4d63c4353a6d", "comment": "Malware payload (Mirai)", "value": "f5d0e1ae646867ab93b382dc009a5e05a84a6a7634cd0a0ef8b0dfe300eac8baa518b64a0f12ca329e674cfb76bd3310", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938619, "uuid": "f1bfdfad-cfeb-43a2-a5f1-27248301d4da", "value": "T12661B3FB23428B3B6DAB89D3B3A846497541449FA4CF4F755BEC38B61C8CEC86C41642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938619, "uuid": "eb371ecf-b8cb-4175-a854-5f68a2fdfe45", "value": "24:ItXZslbhrkRlfdms9TQRGgJH69nLGfNIpKkspMEDhrsgNcGgJsQApk:iC3YzVVQR1axLKJDdggNBgJsVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764938619, "uuid": "52ed79a7-9f9f-4635-914b-7bbc29854a3f", "value": 3344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764938619, "uuid": "73fc6d0c-089a-4b05-9585-ece455616231", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938619, "uuid": "5da58ae1-af24-4f03-b2b9-dc5dc8247bee", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d404872-d184-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764902795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902795, "uuid": "3904781b-0e39-4a3f-9baf-f76a87706fbc", "comment": "Malware payload (Mirai)", "value": "d9c473d59e65a16c24bac231e5fa22e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902795, "uuid": "6469e8b2-74a3-43cc-a6e8-bb49aa4e8bab", "comment": "Malware payload (Mirai)", "value": "33dfbe0bb1570713a9590a1765aca7a5524efafafcce529476f17df090b817c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902795, "uuid": "dcb32cc4-339f-4ff9-bd97-c511df96ddb0", "comment": "Malware payload (Mirai)", "value": "8bfa4f8b85dd62926217be0472dac7e475048b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902795, "uuid": "96499814-62e9-4ec5-ba04-d990b9879812", "comment": "Malware payload (Mirai)", "value": "af852237b49555df982b7d4a4d35883f8b366f26a2a512ec22399276683f192156466f25f91ac7f6fdb9e75b491170fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902795, "uuid": "f7952f2c-b71a-4954-8e0a-91b281c565ae", "value": "T15F739D52FC652D48D44942B471758BBD8B83A14285874FBA3AA3C37D9483E9CBD1E3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902795, "uuid": "b797c628-2605-4c62-b89c-fe646f099570", "value": "1536:DQgV2i4HBMGlld67HPO0kCuuKn2iddqCZMk0VmS+VA:DnV2hhBATO0kdBnPZMlV7eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764902795, "uuid": "652c3962-abc8-4047-84af-f5ffa32fa0b8", "value": 75252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764902795, "uuid": "ee45f8d1-33d9-4195-8471-08ab5a67c1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902795, "uuid": "31e13225-e0b5-48a2-a027-519a49082519", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed54679-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917803, "uuid": "3fefa11c-4ddf-4044-93e2-723bf357ca78", "comment": "Malware payload (Mirai)", "value": "843bae41dc03ac9684d4e1c5ea83bb58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917803, "uuid": "18e3dc80-1cd2-4625-87c1-f41162b666be", "comment": "Malware payload (Mirai)", "value": "3437bfa5ae14d692abe705d91f0360fea4c20529ff06c559101c7c5524d37273", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917803, "uuid": "1155d747-35b8-4713-8ccd-2e9a4a74392e", "comment": "Malware payload (Mirai)", "value": "6149c5d8762721613e7b613d4b0376636745e1b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917803, "uuid": "55fe50b7-31a3-4399-93f6-3d7749533ae6", "comment": "Malware payload (Mirai)", "value": "7ef1f166c1e5f63e972414cd8075ab9ae60e1dcd9a05f95dd7769c2554335e2cb2434a4cfd779b121b6101279b4a8925", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917803, "uuid": "067cc9fc-aaec-413d-bdc3-529a41df7e78", "value": "T14C517FC6B3D74A30EFB25D9A75F640547080E195A7C3CF96E0FCA4BC094FF0A5490AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917803, "uuid": "b51e3187-702c-4dad-a9e5-66a79afe3d1f", "value": "48:vXg+gYgOg0gUpzEg7gggVgSgKgYqUfgLg+z:vXg+gYgOg0g0Eg7gggVgSgKgYqUfgLgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917803, "uuid": "b534fdc6-6774-4e5a-9a36-f665260c15e8", "value": 2849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917803, "uuid": "874fb6b4-7e46-4233-92db-aef888d98e84", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917803, "uuid": "43a47631-efa0-4941-98d5-48b1ec9ee384", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cfa96e-d228-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764973023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973023, "uuid": "e4fd6052-e8c7-4a3b-b222-fc66bb0efe1a", "comment": "Malware payload (AgentTesla)", "value": "e9fdaf7561e710fdde8f24966c4297aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973023, "uuid": "de5fd60c-ff31-40a5-8c59-6d67273f8ef7", "comment": "Malware payload (AgentTesla)", "value": "3582cc9dcba425a744a7cd1a30118c2999e27bed855e2ede54e26327fc5d6661", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973023, "uuid": "661aff5d-424b-4516-b7a5-368f44df7b8d", "comment": "Malware payload (AgentTesla)", "value": "75ee52370b576406cdbc9a3a026fc9a10a99155e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973023, "uuid": "f92063f0-896b-432e-ad7e-82d771533610", "comment": "Malware payload (AgentTesla)", "value": "fe8ccd1528815904bbd28bd2cf31cf65413a861d7672af4be0d3df1cef9da61e9907368a9746122df722f077f0b383b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973023, "uuid": "e8913c09-9a78-4544-9e68-3e1d29dff5b8", "value": "T13D45F1144DC82FB8DFAC991880FE171EE3F04A8E5117658AFB2BBE47AFE7644011B195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973023, "uuid": "0ee080f8-e7ee-4a82-b0c9-7320882f0d35", "value": "24576:11KVJ1z8Tl+BeFizZgkYuOpB9kaHiwusWV0/gFLu:A1gTc+IHEFVWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973023, "uuid": "464c87cc-2b1b-495f-b743-5e90c0379337", "value": 1249895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973023, "uuid": "b041b79c-b602-4865-b2fc-01b6be479a69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973023, "uuid": "e194621e-3dcb-4282-8b7c-2bd27eb80815", "value": "50200022797510-SwiftAdvice.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26dbc75a-d1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764945975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945975, "uuid": "4e4da642-73e9-4e0b-bd8e-a4c8e730ce90", "comment": "Malware payload (PureLogsStealer)", "value": "b0ebfbe2eb8037582a13164068b50647", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945975, "uuid": "d8df19a3-a8eb-4e5c-8454-e612053e6016", "comment": "Malware payload (PureLogsStealer)", "value": "3652e0279435be214791abc22275875ba3456a25719e40ef498e2dd0a3b11721", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945975, "uuid": "d94cfa0f-ba84-4e72-b82f-386268413674", "comment": "Malware payload (PureLogsStealer)", "value": "630314e1768098095c61f787cd172c013855e929", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945975, "uuid": "e4fb1d29-6b48-4367-80c5-8d20e07077e7", "comment": "Malware payload (PureLogsStealer)", "value": "14b051c0a2667493fedb5c4a0daddb2cddb6473728c0bbc486202ea544a06c69768f57ca3e30b650de422facd106c7b9", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945975, "uuid": "040bc38c-da4a-4655-8712-14114243788e", "value": "T19494239C914F3C387C0089C3CFB468E9EE4EFFB5B955D9D7A808968A063157BDE5108A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945975, "uuid": "67a7ca25-2850-4d43-900b-46d68c6ec227", "value": "12288:xkIVCrjdxSuHFJHiYY5ksAHWFQ3AmyXXTGmPhKU5G:26CvjblIDPZF+AmyXXBJ35G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945975, "uuid": "445e05ed-5921-4ec8-8665-648a5e20312a", "value": 423256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945975, "uuid": "dd20ac5c-30b7-431b-acf1-64259b054ce4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945975, "uuid": "9a3e351a-c60c-4776-8902-c75b94d64a00", "value": "CD93-SwIft-SEO20-CM8493-LOS903-CJNF93-20394-849XNJ-MS94822-TUIG9403.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366564ac-d20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764961463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961463, "uuid": "d079f5aa-a3b3-432d-b2ff-fc7aae8025b4", "comment": "Malware payload (Mirai)", "value": "b19393e445e758672c6f35406a902c15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961463, "uuid": "c053fa29-1ad6-4d24-b6f4-ef73afbfe0dc", "comment": "Malware payload (Mirai)", "value": "36721ead9b62dd60028c7ad5f5f57c017110b4bdae6ba811d1b3e4cab6a07e84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961463, "uuid": "9bcb3b71-8bde-48d4-828c-4b6e70730222", "comment": "Malware payload (Mirai)", "value": "1c9c9b5f06590a6c044ac66115aeaa37a7c6b216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961463, "uuid": "a118119e-9dea-45b2-93e3-f53c07250deb", "comment": "Malware payload (Mirai)", "value": "ce50d7feea6703630aec4265fc3592d2fe4ed1621767b427f53ca02e9b5f4aa512761151edc9d9612bbf2062349a28a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961463, "uuid": "be9a9f65-dffc-4fbd-b8cd-3c9f37923e44", "value": "T179342881F987C5F6D80388705096FB3F8A319876D176C75DEF99AF32DA2B601422639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961463, "uuid": "e2f71d63-8d5c-49ed-96bf-68c8e7b78d55", "value": "6144:hSw5KKjNRpMuhgeZDGX3Y4+yvjtmxTdwC:UINjN3Mu2e5GHnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764961463, "uuid": "f23b2c06-f262-455a-bd8b-0b5b9ed2c533", "value": 232040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764961463, "uuid": "6e701a7b-6612-48c1-b0ab-e47176fb2158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961463, "uuid": "6c5f71c1-1d49-43fa-9c0b-4cc84e5d2deb", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa15b37-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764952003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952003, "uuid": "797cd171-2654-4c0d-b5cf-db1c5e78186a", "comment": "Malware payload (a310Logger)", "value": "33444da979782a44c347d12d384b82fa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952003, "uuid": "8b8f1afc-a264-4b59-8f3a-452ad561975e", "comment": "Malware payload (a310Logger)", "value": "36b00383e570627344465a94937f2846bbe07f99426becf8f916ced4304ab920", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952003, "uuid": "23e0a1ad-92f3-40dc-9bc4-4e921088ad54", "comment": "Malware payload (a310Logger)", "value": "95a6961f9d309b94df258d6c824b5edb068aa7f0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952003, "uuid": "da31e803-ae5e-4dc5-b253-3ee4735bc260", "comment": "Malware payload (a310Logger)", "value": "cf755bfe95598f18b032a2b9217221e637a8670fa048c5e6efab936b957d3764f96d95b3b4c29b96301f650718593011", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952003, "uuid": "c7322358-3df0-4bb3-9963-b803e377e3ae", "value": "T1E645BF027381C062FFAB96334B56F6115BBC79660123E62F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952003, "uuid": "51bce71c-ddf6-4382-9d20-057b93f7e5e0", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952003, "uuid": "a95ef79a-e105-4d46-b12f-90d425007340", "value": "24576:k5EmXFtKaL4/oFe5T9yyXYfP1ijXdal4dGRZkNF8ODfm/w:kPVt/LZeJbInQRal48RZeGOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952003, "uuid": "d0c9c935-77fe-4716-bded-7d46be489149", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952003, "uuid": "3a45ce10-092e-4270-b85d-60585219eeec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952003, "uuid": "9f8509ca-420c-4846-ae68-226024185cca", "value": "Pre PPC order 1201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79f832d-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951802, "uuid": "d4cd7f43-01bf-46fb-b19d-faa2c4d54d31", "comment": "Malware payload (Mirai)", "value": "21a4f4dbf1589b4244a741e8fdb3a7e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951802, "uuid": "c7f7d807-2649-47a0-ac30-17e3bb528bca", "comment": "Malware payload (Mirai)", "value": "37dee13676188b19a94a569bd11a4bc243fa27d9f09c6d0e37c4ebfc4dd857d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951802, "uuid": "6932d0a3-4cc0-48e1-a864-1d653cc677ab", "comment": "Malware payload (Mirai)", "value": "1a5a83e5c090424f42904924401768815ad6ab86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951802, "uuid": "34280b8b-6fbf-43ae-a41f-fcbfbc3b56a9", "comment": "Malware payload (Mirai)", "value": "11960fbac91d2f721718a2958b205be480b5e8674cad76d356f4d995dd95d6132b12e5059b1cf96dc71d567dcaa2192a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951802, "uuid": "0c27146c-eab2-4eab-bbc6-5e44a95b6073", "value": "T1CF0412ED8995D8E08B31A8F0528B0D4F1DE903AD60DE1189D5EC34BE5B53F8617988CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951802, "uuid": "7e8fbf54-9df0-430d-8340-d73b56938c59", "value": "3072:t5e0/e9Ri0Sxj3SaO5GYTMZCz6NdBhLDWhT3jMRpcq7JuRnK9vcQGPo:tEv9RijO5fTMZE2hDWB3WpVduFppo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951802, "uuid": "301c2a53-9260-4b71-8970-3c0c7804a14c", "value": 186496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951802, "uuid": "f5dbe5a6-98d7-4646-94a9-b2a72652a4ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951802, "uuid": "ba4f37d6-d22f-46e9-88e8-198230e73d98", "value": "SecuriteInfo.com.Linux.Siggen.9999.32484.26000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8873f4e8-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959024, "uuid": "50439c6d-d5a8-456f-9407-2bd9f4a37f80", "comment": "Malware payload (Mirai)", "value": "e4af7df76dda77c00232fd1c9430cc8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959024, "uuid": "85611da8-0ade-434f-b4f1-0602e4983d72", "comment": "Malware payload (Mirai)", "value": "3817babb838dac74cd93b32c6b090bd128af2726f46acfea2af9d98971941cfe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959024, "uuid": "1f0c293f-d4ff-418d-946f-2ebeaadee2f4", "comment": "Malware payload (Mirai)", "value": "c467194b443bf4bc99f1e98687f67091094885ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959024, "uuid": "975d561e-9ecf-4c79-a173-22458ca47cdf", "comment": "Malware payload (Mirai)", "value": "7a2a8ddd762920b5c830abb4caa2625e10e3089d25ee535460c5d05a426f323a8a5a97a820fcca18c02edc9599b77735", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959024, "uuid": "256c1c69-3254-4f65-8027-0051b53ce1c2", "value": "T132B0127E401BCF5A80480409F030003270B7534511628104CECE601DA0806233122E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959024, "uuid": "d4ec9a16-d1f6-4df1-bdd0-9b8f414442a9", "value": "3:TKH4FBCAjtyg/PISoeNOaDSoFSsJOPIqw:h+8t5/nninsJOPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959024, "uuid": "702d30c1-1bc7-4e26-9e4a-9feed754da33", "value": 93, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959024, "uuid": "1781705c-68e3-4fe5-bd9a-5c3855479463", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959024, "uuid": "5745546b-ea4c-466d-adb8-4661f50f36a4", "value": "st", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ec0f70-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931000, "uuid": "e12a46c9-0bd0-4b1e-867e-9595dc89c1b8", "comment": "Malware payload (Mirai)", "value": "13827ebfaa7a6f1f9ff7ad49e09775db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931000, "uuid": "597d33cf-ef52-4545-92cf-ef1a55951d8f", "comment": "Malware payload (Mirai)", "value": "3905afa64359c1b62012534ad8b157ea86e3991efa9b9cf94ba58d0800331298", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931000, "uuid": "6d89ee4b-3472-475e-82ff-d04d43387100", "comment": "Malware payload (Mirai)", "value": "d3976741258848193eac68c37b104d46a0d95111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931000, "uuid": "24545fcd-8989-474b-a572-98459cf3dd0b", "comment": "Malware payload (Mirai)", "value": "62e31ea23befe08df7237960a98f77c3421318000dcd706ce4f3f9d2b10b23e53ec2d43b33138c2bfeaca0c0e35abf97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931000, "uuid": "29d6025d-1535-41b5-8983-16c138389c2e", "value": "T115635B00B71C49A7E4525D784B3F03B593B9AD8259FAE1085909FF461730F37A6CBB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931000, "uuid": "f400d3b1-3ab4-4a47-9df8-aef95f31e499", "value": "1536:bYoQ03xNHN9/3HyATyw8uykOJ8oay585I/I3zV:sk3fHyEywgkOJ8oaoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931000, "uuid": "6ff03b28-aec0-474b-966f-1b662f1e37d5", "value": 66720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931000, "uuid": "8d9a8924-1014-4dd5-9f33-88536e6c5075", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931000, "uuid": "d157540f-1504-468d-9490-ca98e73f2363", "value": "VRppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9950985f-d202-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764956905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956905, "uuid": "ebd04b9a-bcf5-4347-9c75-0aa0ada687ac", "comment": "Malware payload (Vidar)", "value": "ae85f87149d4761110d93ddcec0ef45b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956905, "uuid": "1b84365d-adb5-427a-80a2-69d498f9c9f3", "comment": "Malware payload (Vidar)", "value": "39b2bfeacfdf7ee6cfacae5823f9fea8e07fbf04dc29ac89193c1e92cce53f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956905, "uuid": "1ae59125-c996-4224-8a52-a50532069212", "comment": "Malware payload (Vidar)", "value": "54f8f7990414ec769134c8fda7d883d1c28f9229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956905, "uuid": "0c07cdf7-2679-4523-b9d3-6dbbf5908bcb", "comment": "Malware payload (Vidar)", "value": "14c0b0f20a364ff2d96abd8b240640a55aaee460210f92274ad1f6b1e765c2267dc325d52b0318c6adf5ce347cb41314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956905, "uuid": "a0a5c34c-6d86-4851-89ea-ee8618be9eaf", "value": "T1195506796451D25AFE3980B950F2875EB120713286722BFB0160D263EF1B5B1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956905, "uuid": "e9894529-4e87-49b9-9a12-f0cff1f062d9", "value": "a40658832e597eab10a2b68099d8706b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956905, "uuid": "c6669d86-52c3-46bc-8ed5-e3dd31942e8c", "value": "24576:VgT3C6mMxJEhDLKl8JoLP9K0sQxpx9Z0Fo/tQIb1Ddo2QIdz:VV6kKuJmrqEHbhdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956905, "uuid": "ecd358b2-43ac-40fc-a6ec-707a32f31dd0", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956905, "uuid": "9f09b57f-451c-4f58-9c15-36edb5d44c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956905, "uuid": "fd539cf7-8018-4c27-b6c7-bd0337d48e97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffa1b28-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959010, "uuid": "c4de87b5-deaa-468c-9739-7d534b13dcbc", "comment": "Malware payload (Mirai)", "value": "3cc992f18cae483f4ad9c468853d8975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959010, "uuid": "ee268846-af52-4755-9763-f0b4b955cacc", "comment": "Malware payload (Mirai)", "value": "39b546d6927a6472585eb26b2e5973dbf69c4405e8018924cdeebaeffebc04d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959010, "uuid": "ced14ef3-c26c-472f-b936-e64fd2cac5d4", "comment": "Malware payload (Mirai)", "value": "eeebea04a45b6a0e264d3a18e8baa53c95218828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959010, "uuid": "8679a8e8-5cb8-4bd1-9302-a957cd8942a2", "comment": "Malware payload (Mirai)", "value": "b1a3f5ad0a82b572701c4ebc187b4fc3d3e2d3766c97c706a2f8040ecaa63214f81c954f93e9813efa237d6561b88446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959010, "uuid": "41ecc3fa-9e55-4243-a11d-99781f74d45d", "value": "T1ED63C51ABB640FF7EC5BCD3B05B91B05288CA50A22E53B357D30D818F65B25F19E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959010, "uuid": "ea9e4f0a-74f5-45a1-a865-4539aa7a9024", "value": "1536:hN0cp69bye1NnLLZuhFqJDD0iXf3+JVUstBWjN++uN:hCcpuue1Z4FSrmso+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959010, "uuid": "d77cccf1-e57e-4c51-8fca-a7d42090af43", "value": 71740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959010, "uuid": "eaa0ef09-3372-4ca2-8fd0-590f4c203a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959010, "uuid": "ed1492c5-7e15-4cbf-ac92-552289be1ccb", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94eaf24a-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944012, "uuid": "3bc0e36a-da54-4bf9-af1f-f28409463e92", "comment": "Malware payload (Mirai)", "value": "6c4c611e28f31238b2eb42c13cbd8b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944012, "uuid": "de12a35e-4a09-402d-9161-7001a0c8d5ea", "comment": "Malware payload (Mirai)", "value": "39bb86329c007b9fab89729638037b8899d24a41646dd7107a1cfee762f32055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944012, "uuid": "2f98be2c-20c0-4a28-834c-3adae6dabb08", "comment": "Malware payload (Mirai)", "value": "810efb61dd2a50ecb25b9c509a9b964d8439f1c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944012, "uuid": "6785ac21-e9ff-43e9-858c-10d82071110b", "comment": "Malware payload (Mirai)", "value": "1008539a9f5063031d8fd794b18d77979878610708714d3215e5347884399cf4c333c3cba04dc385439cd3fc776df655", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944012, "uuid": "a1a8f90d-0887-437e-bb63-ca9a41343886", "value": "T178F45B42FB1C4563D9431DF06A7F43D9F725BA4340F9923A370EA7572621E3A968338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944012, "uuid": "7084841d-3db8-422c-bb85-dd7beb1af97c", "value": "12288:TYUoJhykJy/4XEO1dA+5q71uvVqwqV+ipRWtLUKekfoCam:vcy/8EO1drs7YdqlViLUKekfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944012, "uuid": "f684e7af-e6d6-4cb8-b592-d161f01d2d12", "value": 726060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944012, "uuid": "d4daa218-93f9-4b0f-a21c-7647593c54d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944012, "uuid": "7abdee21-f8fb-4797-a211-489ad748b451", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a9ea32-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764955850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955850, "uuid": "7e99518b-0793-410f-9843-34ae8d3bf0ad", "comment": "Malware payload (Vidar)", "value": "d625de8364e54c83f44c2716941d0823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955850, "uuid": "e3b1e928-05cd-44d4-987e-fb590901c4af", "comment": "Malware payload (Vidar)", "value": "39bca284e2af6a13a6973c360ce6bc6df5f33aeba51b39825a6bbec35c8927e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955850, "uuid": "d8deb0ac-93ff-4bbe-9db3-c5da286cb87f", "comment": "Malware payload (Vidar)", "value": "01634fd3659e54dd6d3120027f833ee7b8dc40d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955850, "uuid": "7c354704-fc67-49f9-9256-44d6ab3ab606", "comment": "Malware payload (Vidar)", "value": "799ea9d4632c54b38758f9d99290fa10942688e96b432d9adb302f1c6b3e7abac628f1d94e0c4934d04b56243b516b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955850, "uuid": "132fa63f-79bb-4d1a-9dfc-a424f5b1a05e", "value": "T161A62992B9824925C56FF2349CB1A26177707D0843312BD76FDB06A90DEEBC4273EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955850, "uuid": "eca23d4f-89e2-420f-94b4-42df4e32460b", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955850, "uuid": "8dcd9ae6-17b1-42fa-8c8e-a01fbd89966a", "value": "49152:fQiTaD3TL342WHSK146fCjcaRY7F9MTG88nIF17Bd2TeOni6mmC8vVsrb5v2Ag8i:dA3MHCpY7F9MTG885tk3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955850, "uuid": "700b28e3-ec05-4e51-804f-836352374046", "value": 9799408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955850, "uuid": "19f2b9aa-55a8-4a0d-b8b3-47db9b213ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955850, "uuid": "1ed75755-ccfb-47cd-baa1-4999a4ab553c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999b4411-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959482, "uuid": "4f89cbce-ec76-4a64-a0c2-98635bb11f80", "comment": "Malware payload (Mirai)", "value": "7c4c9c87dee1b42766687d06b597cf5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959482, "uuid": "58dec95a-f06a-4e20-9d10-3a84387ae59d", "comment": "Malware payload (Mirai)", "value": "3a070a266d3c1b231c899bb477d7a70a9e9690ef2f5b582fed59ce97699a4b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959482, "uuid": "a7904194-730f-4f56-820c-568dea44fae7", "comment": "Malware payload (Mirai)", "value": "e1463d0775eafd2e233cf428745828a7b98af5b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959482, "uuid": "34a4060e-aebd-419d-ad1e-e3b6f6d03c2e", "comment": "Malware payload (Mirai)", "value": "07fc48fd6e8c995347b53dc430dcd2094cbec1eda93e31230018df152c8badc453735a36b3a0526925a1495370547ae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959482, "uuid": "61c30474-7429-4254-9d9a-9f5decfca13a", "value": "T137134B52721C0F17C4A35A70253F5BD08BBEAAD032E0F289655F97A68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959482, "uuid": "be7e0997-569c-46c5-921c-6c8e4de43315", "value": "768:/4hc2/dFJqRDgR60KRCZkn6vrYZK+aL28yU5zJOoMFDdO9atLxvwC:ghcBWqOvnxvFMFDdksLKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959482, "uuid": "d13c0545-09b7-4dfd-a1c5-a44f27f023c3", "value": 43748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959482, "uuid": "41a32548-bb92-4ab3-88c8-720e88d8b7bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959482, "uuid": "c5fd69f9-d852-43e8-985f-ebee5398d0ce", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c4f2a8-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959053, "uuid": "d6e9310b-9e59-4f03-ba8f-b24ec76a2cfb", "comment": "Malware payload (Mirai)", "value": "2ee9ac82205b7725f1c8026b1de5f2c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959053, "uuid": "fbd74626-657c-4b24-8190-0153b73e1c54", "comment": "Malware payload (Mirai)", "value": "3a13858de2b641d3b6ef3a4c27aef288cae2debce60370629c4ad901a97e9b4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959053, "uuid": "e24ea849-0a14-4edb-88ab-b1567512ab70", "comment": "Malware payload (Mirai)", "value": "35a7e09824d7269801a1748529962d114df43f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959053, "uuid": "9cc49bde-7a64-4fb3-a0d6-bc9f68a1393b", "comment": "Malware payload (Mirai)", "value": "160f62a0dbdd269078c21f848db1f21b3e2903ac69beed5e8d33adb049b136b3407e2cae1c9701c254974180eeee7c95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959053, "uuid": "8be7480f-0762-4d6b-aa34-85ade0190c58", "value": "T185137E76C47EAEA4C1484674E8318A781F83F501D2571FBBAE85896A4083DBCF6193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959053, "uuid": "4a6b4fba-3387-4bcf-ac4c-20df435536e4", "value": "768:lSaqwtPy2mONecUf5cmnJ1VqEPIFrNpvC1jUpXCLoG4dC2vu:saqwtPHdm5r1VvPkKdUpXnPdC2vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959053, "uuid": "4e050944-7710-4cbe-a2dd-f445769d152a", "value": 44856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959053, "uuid": "7fea1d18-d507-445c-9d49-15b810e5568c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959053, "uuid": "6a7c8ea5-e152-4d16-b576-59c82eae55dd", "value": "zersh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da2127a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958872, "uuid": "ca20eb06-8c06-42e9-859f-60cfa48913d1", "comment": "Malware payload (Mirai)", "value": "f021f4cc584f4fba74d9d058b6450695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958872, "uuid": "4ee1ca01-f3e8-47a4-ad22-6994a20a6ead", "comment": "Malware payload (Mirai)", "value": "3a3c87461994d23c1ea8be8f33d91db3112c15f0c1240607ba30e9feeebd984e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958872, "uuid": "cc4e2e7b-9629-46fc-9d37-40d021c6803f", "comment": "Malware payload (Mirai)", "value": "3789348f40212e390ed03b8a7a9ab3f06da8c373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958872, "uuid": "e538d427-1118-4445-b9d3-7f6ce2c9827b", "comment": "Malware payload (Mirai)", "value": "73b2b188b5ff068ae530007ac1105777a56452473f3221c24bceeac65e8bdbe9ab6d7d6396ece9bb89ae8a7e776c40e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958872, "uuid": "cd0e71cc-2874-4fa7-941b-6367fb29d320", "value": "T158735D0272080A57D1A75AB0183F2BE153BF9D9021F4B3CA791FA75A9671F325486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958872, "uuid": "b307b4c4-42df-4368-9254-7143430ea919", "value": "1536:291mAQRfAt6toyESRM6VZLZ7Te6S9eYPnI8sRG8:2TbHSvRte99JnIE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958872, "uuid": "9f64e5da-5465-4ed9-9396-a4c575e5e762", "value": 75500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958872, "uuid": "6052c7a0-729b-4e3f-abb0-ea4c6fde94ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958872, "uuid": "6e3a12ef-6f36-411d-8304-6c1d13704522", "value": "appc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b7c5f6-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908605, "uuid": "e778b76b-bde6-4f06-bc22-450bf925fcb4", "comment": "Malware payload (Mirai)", "value": "7bc5c13699b64f0ce5bc03f9e499c88c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908605, "uuid": "155ce830-29ef-4359-8c43-eb25045e0f19", "comment": "Malware payload (Mirai)", "value": "3a4f6e4b2f599d0f014a2bc8ddb3f0bfb6f99a34b07af4554cdf47ab0ee24a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908605, "uuid": "2fdd94ea-032f-4879-a609-159f5015811c", "comment": "Malware payload (Mirai)", "value": "d385a37f6c66e2aa9319bd7f86e485d8e5c65753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908605, "uuid": "6ca3075d-52b7-4b6a-9d04-8666ca00433b", "comment": "Malware payload (Mirai)", "value": "e7a9303de926bcb04001c975f9ef0a893bf815548f3d7dfeaf1c69d3281e37c0e00f079eb2d446807dd6ef3f3c1bfd9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908605, "uuid": "ff6557ff-07c6-4a69-889f-515588bdb62d", "value": "T153C34B46EA414F13C0D61779B6EF424A3322ABA593DB33069A149FB43F8675F0E63D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908605, "uuid": "f4dd0027-8df4-4582-9739-1b07d0b917ba", "value": "3072:QgsTtFEesQCKRyFk0RC2ORnc6QwU5rP/jM/9QRu4Mw:QgsTtFEesQCEyFk0RCPRnfhU5rPbM/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908605, "uuid": "ca0afdf2-c63d-4908-86ba-144b801d1634", "value": 129330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908605, "uuid": "98734a2a-1fae-486c-8441-c81162f1921e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908605, "uuid": "ea2d57f4-42fe-41ea-94e6-42dcfa3ee333", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b035f-d206-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958467, "uuid": "97d63ebb-a927-4ecb-8966-474ac1003472", "comment": "Malware payload", "value": "a455f938588909620c2cb3b75260ffd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958467, "uuid": "c1e31269-8a27-4aeb-87a2-9b3e365e6ee8", "comment": "Malware payload", "value": "3b15c0074c83f4801c5a77ef46cd85471e70232bcb4bb52f9b75cc4822186d2c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958467, "uuid": "0d0bcdfa-e7a2-4264-a167-03ed6fd2226f", "comment": "Malware payload", "value": "eedb9c2a8d4cdd67dfde1c5dfa2ff050508f62cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958467, "uuid": "39ba546f-89c0-4f75-8ca7-56e46a5d802e", "comment": "Malware payload", "value": "5318d5b8d7b1d9be4a8d963c46f12de07a2c03574636f15eb927c50705ee2520014d3341015688a0fb776f692fc8aa12", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958467, "uuid": "11f63a04-c7ef-44c6-be03-836b09948c5b", "value": "T111E0E51DC10C8BBFA416898F7EA839EC611E91591A8F1F04ACBD2D1A74859285181022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958467, "uuid": "615eb4e9-43f3-4522-9a52-4d0a388ca62a", "value": "12:/5949dJ3+aVXUy4gZesFrFBEGgbu+yfuT+JF8EpASLye:ha9X+eaWrTBEGjTuyLpvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958467, "uuid": "3657e871-b8da-453e-bc6a-5afda77757dc", "value": 419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958467, "uuid": "cf2dbf88-822a-4132-9e70-3f1d05f74b9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958467, "uuid": "ef0475c8-3c50-46b2-a5c5-5c18157dc441", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00524fd-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951816, "uuid": "bf538399-5ae1-459c-b968-461f32d4b970", "comment": "Malware payload (Mirai)", "value": "a75753331a4260353ff36a0e683ae98b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951816, "uuid": "3483f57f-e598-4929-8cc5-c2612578b1f3", "comment": "Malware payload (Mirai)", "value": "3b27da933255eb7464088a9c9207d408f48ac3427f9b2c3ab1aa8004ba166359", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951816, "uuid": "0c3ae9cd-3e39-4fcc-8306-ede27280f9bc", "comment": "Malware payload (Mirai)", "value": "2e46fbd5a4de61c23426d8dfc818ab46a0d9962a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951816, "uuid": "7766c62d-cffe-4973-aa01-e9621b1d5e07", "comment": "Malware payload (Mirai)", "value": "67117903347cc7ccc451096be68b2fa09e59fd0481beb131bca6e2c29d9ad8bda64aa1ef74d07a83ded8056e26e5f34e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951816, "uuid": "a39ba2e0-a6fb-4dc2-8a22-8802fc358e38", "value": "T129B43956F8809FA1C6C12976F64D86AC33134779C3EBB20699255B343BE786B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951816, "uuid": "ae095150-158b-4a60-ae80-731effe28e49", "value": "12288:mLAiFhRWH7cB+UKDV5mZkXIdW9Qgpjjxn:mLAiPR0cB+hgxAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951816, "uuid": "670139bf-58b2-4cc6-b7ba-7273524dc4ba", "value": 513388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951816, "uuid": "111d9b6d-cfd2-4b79-a5c9-e45433c6c482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951816, "uuid": "4e265bb8-ac81-4ab2-9cc6-cb3856eee569", "value": "SecuriteInfo.com.Linux.Siggen.9999.15616.789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4450fd8-d203-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764957460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957460, "uuid": "bfaf8558-7619-4d2a-9808-572bb2e6b6b8", "comment": "Malware payload (Mirai)", "value": "6ad742f71d71c84b22bf872efd0e15d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957460, "uuid": "f4a686d7-b1d9-4ac1-8dd4-7784e5dbef52", "comment": "Malware payload (Mirai)", "value": "3b29c74264a2a44ea039f6565509af221218fe84c9249d1d240fdd7d154aacdc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957460, "uuid": "cddae299-1d2c-474b-9c93-7fdafc2d4823", "comment": "Malware payload (Mirai)", "value": "cd44c2bf3c1cecd5685af99b4c45f424964f12a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957460, "uuid": "c07926ae-cade-4995-91a3-a51a2969cacf", "comment": "Malware payload (Mirai)", "value": "3b8c2086a4b73946fe5fe0aa728e3314fbf385c1367eef00daa68e4c77c6fcfa7f4d94f32d375868bf5280e449652de2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957460, "uuid": "b102bea1-e3e1-4ea4-b8c6-9d6e65f49b88", "value": "T1FB114F6F24419E65BD58D60978B6E6027124EB8680DC3B2981CFCF7DC0F99043A07EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957460, "uuid": "c173b695-5f1d-4572-8a8b-ab301234142f", "value": "12:78ZNPiCZEPiCZvPiCZpTPiCZXWnPiCZpPiCZ7nPiCZ7MPiCZ7/PiI4XD:eNP5EP5vP5pTP5GP5pP57nP54P5rP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764957460, "uuid": "3b3d2bf0-dc1d-471a-95e8-c73f6e3d75dc", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764957460, "uuid": "46043449-17a1-4755-aae3-e88fb56220c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957460, "uuid": "aec5fbdb-9b3e-4519-a7db-8713ab923a36", "value": "router.draytek-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e49f3f2-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958846, "uuid": "072d71a3-29e6-46b4-a67e-a3d674d88533", "comment": "Malware payload (Mirai)", "value": "6fe7a06f7ce917af699ac3882f60d95c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958846, "uuid": "57e208fe-9b10-4f0f-bfd9-4012e7f0e74e", "comment": "Malware payload (Mirai)", "value": "3c72cae1dd5ec0eeef7eb73f3871425d5b1d308bfabb57f10a079744ea0fb160", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958846, "uuid": "8b3199bf-efa7-4e8f-8ff7-8809fa4513ad", "comment": "Malware payload (Mirai)", "value": "39807acf13a8dfc5369a4a7f2354c7afa3785c94", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958846, "uuid": "b5b11c8b-e715-4f5b-8ec6-d36b98cff10d", "comment": "Malware payload (Mirai)", "value": "be4090d6844a0a4954df7896574bd76b1642697265015e28c023069ad0c6c72e6a72b3437a8bd08b545882e37f6becdb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958846, "uuid": "0dc2c33d-c8b5-4732-9eb4-ca93beeeb074", "value": "T1A711EF5E31106403A9B9FB4079B3ED02618C82B15AEC37166BCA9D31C0F97487D26EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958846, "uuid": "0045f5e4-626c-453b-bf43-4bc20bcafbe0", "value": "12:78ZwPTTZPPTTZuPTTZpyPTTZXWmPTTZMPTTZ7mPTTZ7XPTTZ7ePt:ewLVPLVuLVpyLV1LVMLV7mLVTLVKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958846, "uuid": "57f212c8-8d1a-4757-ba6e-efd0f10facd9", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958846, "uuid": "5ebc6992-7c28-4249-87a4-8cf9dd5a9402", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958846, "uuid": "000ca5c9-89cd-43fd-bc08-8652cf4ada1c", "value": "dvr.cenova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4977b42d-d1d1-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764935725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935725, "uuid": "c0dff57f-4cf8-4130-bef9-d20bc77f2217", "comment": "Malware payload (GuLoader)", "value": "43ad7a29d559e2a6fe937c7e0a214117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935725, "uuid": "53e08184-e663-4a59-866a-bcc233ec61df", "comment": "Malware payload (GuLoader)", "value": "3cd82d31495b72f55a9dfb02320b3973de82b204be9fd78c9a28937aac1d9361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935725, "uuid": "fa787277-9299-4fa0-9683-3f34178ed6fb", "comment": "Malware payload (GuLoader)", "value": "5d5f2356ba23c3e1774fe4f568ef349f4ba30fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935725, "uuid": "86fa6ba5-10d5-4beb-9890-550c26256ca2", "comment": "Malware payload (GuLoader)", "value": "ea819bf671004ce14968ee4135b76e98384e26c0f2d3135a97fa5d88a9a4beb46f840458a530e86819d38463ea532431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935725, "uuid": "d5cadbb6-692b-4deb-825e-ac58dde3dd6d", "value": "T1DD15F1F736408364C4E14BF0D962D3A0D167FED2D5E4E387125AFE79293209A86C9ED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935725, "uuid": "a2ea5957-2fc2-4a38-94f9-f603a99ba2e7", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935725, "uuid": "83f27b50-b6b7-41d8-8ef2-4133c3c92c30", "value": "24576:xFA7BZvzLAeQND1OoCTm4bLvB16vgjBLor:PA9ZvgB1OoCimLvBc0BLor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935725, "uuid": "0e4f89ad-5740-415e-a6af-d4586f95ca52", "value": 911496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935725, "uuid": "c5891cc9-eb00-4d97-ba1f-989e6b7f66b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935725, "uuid": "dbd16560-516e-47ae-8f66-f21be7c95eeb", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567c4e21-d17b-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764898811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898811, "uuid": "384a6aa3-09e1-4922-81ce-4f0c410cae32", "comment": "Malware payload (QuasarRAT)", "value": "2124ae223c1472f25a9b6099eeb0f147", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898811, "uuid": "72a5eb85-1d9d-4eaf-8ddf-f67fd041933b", "comment": "Malware payload (QuasarRAT)", "value": "3d7b81ec0219244c31855e8e592a1e6a682c20c0215a964d7274d30458cc5602", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898811, "uuid": "f781e682-cb7b-45aa-ab14-a70aed16e5ea", "comment": "Malware payload (QuasarRAT)", "value": "1536f9a3979ace65b8681b2ff78a3e7ace4f622a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898811, "uuid": "dff48292-bd3c-446b-b6a3-7ef41bdab8c3", "comment": "Malware payload (QuasarRAT)", "value": "6fddc8c89a944c865f2947cb597dc1617ffe0d19b165b9aee325c929ad3b57304c1e33e00a8ff2883462d554fcd03843", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898811, "uuid": "a890f626-b745-4602-96b0-43308e7cfc41", "value": "T1F9E56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898811, "uuid": "fe8c6ddf-fb8f-4e3e-ba9f-de23296ebf99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898811, "uuid": "b0a3f1a3-b610-4905-b902-230b1e8c2759", "value": "49152:WvuG42pda6D+/PjlLOlg6yQipVYERJ6EbR3LoGd+THHB72eh2NT:WvJ42pda6D+/PjlLOlZyQipVYERJ6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898811, "uuid": "19c61642-d845-42ce-b54d-af95b57fcbc5", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898811, "uuid": "a23c8849-ba27-41e2-97a2-a300d5bca2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898811, "uuid": "d3d9c219-8efa-4d7b-aa40-317f23f7b7ed", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c994fd-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958879, "uuid": "13f90b0d-fa1e-4755-b6e2-9c32d7368f9b", "comment": "Malware payload (Mirai)", "value": "a05e0ef8fab6b816d49a007f32b08817", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958879, "uuid": "b5fe70f7-cb90-4eaf-8dba-aa9691abb5c2", "comment": "Malware payload (Mirai)", "value": "3dea42ff7f9ec7126fd91ae3c2bb4a31d0bafd53cde8c9e6aad90250846d0d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958879, "uuid": "d68bb590-ff75-420a-8571-ae1e1c7d7f16", "comment": "Malware payload (Mirai)", "value": "a6a820088deb137f7f42c9f132f2732e96023f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958879, "uuid": "52befd6a-4da3-4d3f-8b57-8f8de55de84c", "comment": "Malware payload (Mirai)", "value": "64e8ac2f04c47bb424c8e30393dd8f6e8f97f23972426d8d5e8d54f17e0cb9d383696fa138389c37f72800fb3ab2f1d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958879, "uuid": "f85d4ad6-3ed0-46fe-9918-dbc9ac5f721b", "value": "T17F433A21B97A2E27C4C0B8BE22F34724B2E5175E36A8C65D7C720E5EFF159402507AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958879, "uuid": "3b5d5a5f-4397-4fb4-bf12-73739968d727", "value": "1536:yoLSoCPhgZTfa/cnMNVW8DqGHLyAoW8Je3:nuyhfe5B+Cue3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958879, "uuid": "6736b929-e032-40bb-af76-5952176a6dcf", "value": 57120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958879, "uuid": "1ecca1c4-94f4-4dab-b8f7-d33aa0c16e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958879, "uuid": "c4bfdd50-f43c-40f5-bd4c-ab18cbb70ba1", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1440bff-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951871, "uuid": "7f85de66-418d-40aa-b27a-1e93340f86ea", "comment": "Malware payload (Mirai)", "value": "d7e86d625c3041bad10ebbeb4f5fbdb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951871, "uuid": "e9ba5f0e-e363-4550-814a-754d146b705a", "comment": "Malware payload (Mirai)", "value": "3e26527f80c75388c0ed4132485e9063db6e700c75fb58d987b5ec69001837a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951871, "uuid": "9337290a-3876-4fd3-95a8-0d371473325c", "comment": "Malware payload (Mirai)", "value": "2fc4453782561f696fb129934a4112ea6e474cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951871, "uuid": "62182fbb-1e50-4fd6-8750-7c6f2784deff", "comment": "Malware payload (Mirai)", "value": "e5537ac6dbb5d9b1774a89c6bca64aa1ef5f01d762aeffbf05bee8d45dcd8b959ee8bcae6166e350120d5bab3d3b6c29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951871, "uuid": "5c57d154-f1c8-4061-8a1b-f6e47b9e8e84", "value": "T1BEF45B42FB1C4563D9431DF06A7F43D9F3257A4340F9922A370EA7572621E3AA6C378A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951871, "uuid": "29b1e454-c80c-4144-954a-2a133492a8a9", "value": "12288:H1jhjOs8W9iW3KsLI8Vt8HtRokA1Hf3nipRWzy+/ZSp+rjO:Ft9/3KsLlr0ToX1/39y+/ZSpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951871, "uuid": "13823fb3-5e5a-475c-ae00-9beda5b856b0", "value": 726060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951871, "uuid": "09f50ce3-216c-454b-9f13-98c912f680dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951871, "uuid": "9bb9add8-10b8-4348-8cad-2439d9ec00b7", "value": "SecuriteInfo.com.HEUR.Exploit.Linux.CVE-2017-17215.a.25533.29414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ad751-d1b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764924644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924644, "uuid": "f12b8eda-0ac8-4d11-958e-78d6d2981cc3", "comment": "Malware payload", "value": "ce6ad0312f7d3968202cd278bc07add4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924644, "uuid": "6e9f2058-4236-403f-aa7e-927aaa9e079b", "comment": "Malware payload", "value": "3f35d1ca73b97ac75cf087bfb94b43044630922fe80b4e5f47604ad305a292eb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924644, "uuid": "fcc9d968-4fd2-4a48-9773-8350d2f506fb", "comment": "Malware payload", "value": "077a048ba9930e46b8e856d8c982654365f5b6ea", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924644, "uuid": "08dd223c-1f31-4dfc-97e1-0c5eb94775d7", "comment": "Malware payload", "value": "8ab33ab0c9a4b4ec3f578f9d5c2e08d17f569190ec56b1ad399ae2c5facbc17c3723b1c62b8aee7a3b94edcf2f24aeda", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924644, "uuid": "72598619-c6b2-47ec-bc73-dcbd090b8b21", "value": "T18953E059C38F45A4CF85A3B3132A4A4A42FCB33EB30555A275AC837037ECD2E45A59BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924644, "uuid": "72c13f52-d23c-4313-8a6e-590f21d6bcb4", "value": "768:Ju1OncCZ3uZOLj0HHF+BhCq+Dnu8V3+2Box:pcCmc0n4hQDumvBox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764924644, "uuid": "9c6138de-4744-42e3-94a6-8397a50c580f", "value": 62821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764924644, "uuid": "996d563b-95d6-4fda-aec0-0ea7eb5fb45b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924644, "uuid": "3b1cd627-b95a-431c-810b-7880614eb4ff", "value": "v.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b11eff-d174-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764895717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895717, "uuid": "b5a1638a-c320-46a9-9d87-6dfa156648e4", "comment": "Malware payload (Mirai)", "value": "ee0b7ccc09245cca1239325884bf0c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895717, "uuid": "2b907f47-2554-4450-a1e1-8d0d2515cb19", "comment": "Malware payload (Mirai)", "value": "3f6b8f9faadd27b9a90c155a7fb4d3d9883f07825ca77c52861bf507d99f6727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895717, "uuid": "0caa4d89-f80a-4ef7-acfb-872e13c25c15", "comment": "Malware payload (Mirai)", "value": "68a475033fdb2f5252f8b343a1d470105e5aee12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895717, "uuid": "4d9a67a8-3a41-423d-abfe-8e0d354be6df", "comment": "Malware payload (Mirai)", "value": "56ea207842d8c592a99c200185a4d24f0102eb7a0ad408e1e9f743d5ccbcad228dac47a8d1e0d2bfe1064f6096fbc51d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895717, "uuid": "a3dd0d4b-de08-48f6-91b7-655f19781c8a", "value": "T172334AC4E913ECF4DC1A19782173F3336B36E9760029FAD3D795E97AB812641A50A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895717, "uuid": "99e24c67-ef10-4f20-8155-1a3fed92429b", "value": "1536:Y4nqM1cOl3xXL02LnvxQ8QtWzvwofqDpoaZ9v3kF8SC9:Y4q/Ol3p0wvxQdz2qyaTvkuN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764895717, "uuid": "8c77abef-c7b0-49ff-9d6e-a215ac8d3d05", "value": 55092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764895717, "uuid": "834a83b6-20af-4e06-8647-a247b8fde5f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895717, "uuid": "35a7a7d0-b169-4a3f-9dd4-f4ed95de4ec0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84024ddd-d1d1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764935824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935824, "uuid": "2515b2c8-0daa-41d2-9648-9e30c14fed1b", "comment": "Malware payload (Mirai)", "value": "cff40d8e8ae85055b9f1dc5585e96d20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935824, "uuid": "9283e916-e980-4b8e-80ec-2bbd6b9b7053", "comment": "Malware payload (Mirai)", "value": "405701b4b27749bcc98e5ef5b30663494df2a1b5c74645def26badd8bd5cbb12", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935824, "uuid": "c8855ab6-e5a9-4bc0-80af-b66319064291", "comment": "Malware payload (Mirai)", "value": "8e0a3f122b1fb2dfb9f80618db236ffb076d0bb4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935824, "uuid": "90c9757e-b2d6-45f9-a1f8-9864a223c2c6", "comment": "Malware payload (Mirai)", "value": "f9a1f2077eefbe0263a7876ebace896acfdbd56e2e1bb163630cd0334fcf0e587e303582772565783e7ebdc59c30f057", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935824, "uuid": "23429611-104f-4c01-bb09-52192e6944c6", "value": "T16C112E8F75112930ADA8CA847EA2E90171D8D2C514FC37EA6ACA3971C0ED6883E47F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935824, "uuid": "6ea1cd59-f97e-47b1-b090-a204e5d168aa", "value": "12:78ZpbrpEZsbrpEZvbrpEZpzbrpEZXWHbrpEZVbrpEZ7HbrpEZ7UbrpEZ7fbrW:eGdIpUvq7QJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935824, "uuid": "886d5401-cf28-459b-809d-ccd0ae452082", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935824, "uuid": "6d1aa5cc-2abe-420e-bb86-3a6bf9c9434e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935824, "uuid": "9b88acc8-6b1a-4ee9-b209-b4ab28e63610", "value": "dvr.cenova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7d12d9-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959084, "uuid": "a8dc343c-cbdf-4032-bbe3-15737be4889f", "comment": "Malware payload (Mirai)", "value": "fb6f73133e26ec7eb10f6808cab79f28", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959084, "uuid": "03583267-a047-4700-9001-c9eb6e498600", "comment": "Malware payload (Mirai)", "value": "40db0e6af2a95cfcb87cc14ee7b9152750d149b5de3fe9ea805da541926fa126", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959084, "uuid": "b9486327-9d5f-4b92-b27f-9d5a1dc31bb1", "comment": "Malware payload (Mirai)", "value": "9e994bb3fa16fb67dd247e66e69e73c71d1b9818", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959084, "uuid": "54262f94-5699-4989-974b-734a27701600", "comment": "Malware payload (Mirai)", "value": "6ba7969db63707986586dc42ee7b6ad59e01c8bbe552fcefa30a5c87bd8aa52f452039c33b84931c86b0dbdc8082c80c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959084, "uuid": "50f27492-ed05-4b75-9f7b-0f710c600b9d", "value": "T178C04CBD4115F1AC5106799970B5078BB2B38B5F74719E06DC4475B2B5C05587023E69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959084, "uuid": "c8792f89-f307-427e-b8d6-1d63d413eb17", "value": "3:GRFtyg/Kx8DBFSTAKUKjWVx0Ftyg/KoWJZ3FSTAbJTobJziLc:St5/jeAKTjWcFt5/ZWJeAbJTobJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959084, "uuid": "ab190548-b536-4def-bfdb-8c68affd849c", "value": 140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959084, "uuid": "6de53805-e6c7-4d46-953f-89b8c0c7715d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959084, "uuid": "0815611f-63f3-4061-8197-a7eb51c51f92", "value": "vowan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c0478e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958934, "uuid": "3f218280-e8f5-4bc3-bd2e-ed80a95ff5b0", "comment": "Malware payload (Mirai)", "value": "6fa439591c829bb1ef03ae7ca5d1ae1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958934, "uuid": "1b8548dd-dc09-4ee3-8531-46c9d2484a0e", "comment": "Malware payload (Mirai)", "value": "4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958934, "uuid": "9b153516-a742-4c42-96cb-f4b3f7f9fda6", "comment": "Malware payload (Mirai)", "value": "de00f7c0a8eac2c0b5132b849aa201a33e15678e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958934, "uuid": "fcc30233-a681-4b34-ba11-90f1e07313b3", "comment": "Malware payload (Mirai)", "value": "6590446464d389fa70491e66adea83a78b1b10ae8ea3b5049f6f8370c41deddef653e4bdae0216cdaa5fa74c0e42b872", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958934, "uuid": "476a2a14-7d1d-4858-9f3e-ec2a209699f9", "value": "T15E011EFE225E9275094C4D41F06E8818766B8BE66071CF4C644CB4B17698E247163F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958934, "uuid": "813a310b-9c91-4d59-ad5a-3390ff16ed25", "value": "12:6h+0jUah+sLqUah+6NIl5zAUah+H0LKjUahFtaKAUah++7nUahVCUahPFEUahHjK:I+0go+sL7o+6NI75o+SKgoFtBlo+oUoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958934, "uuid": "6ca025cb-6f03-4c29-852e-5eb7f38cada7", "value": 725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958934, "uuid": "fcb00dc3-a78a-4680-ad9d-1cd359f977b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958934, "uuid": "75d7697c-2113-468a-b765-ee47ed7d2da4", "value": "x.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3dde83-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958847, "uuid": "1847d38c-313d-436c-b89a-3e7e303f0402", "comment": "Malware payload (Mirai)", "value": "515c3887f072c1fff383901dad668272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958847, "uuid": "27daf69a-b1fe-46ec-985f-4b0908691bcf", "comment": "Malware payload (Mirai)", "value": "4144f018c6abdb854e368e5f00895eb5efe7ce1ceb2128939b8c84b6afbd213c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958847, "uuid": "3e908b4b-ca62-4766-b41b-3ac4f4bedb37", "comment": "Malware payload (Mirai)", "value": "fe00ae36c5c97b142decb40ce6116e90fdddbb12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958847, "uuid": "d5157988-e3ac-41cb-920d-dfc27f7fd8ba", "comment": "Malware payload (Mirai)", "value": "584cdca748e5b17e4b49b06aa7c6c0498dec840bd6feb6b5fe68a1dde4651e85f9a613cea8387bc7cccac8008f252018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958847, "uuid": "2e726c63-d682-4607-a765-33e5329ffa4c", "value": "T109F26BA1C87A5EA4E41852F1A421CB7E5F93A110D7432FFD552A81A68043E8CFA9E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958847, "uuid": "d52cc11a-0e24-44df-b55b-b1923cae625b", "value": "768:YEtzuQIdEqpvwCN6nxyZjUSCaW5xmXoJhxoqIuCCCu:YERuQqPZxUSQ5xmXT7uCCCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958847, "uuid": "19598f7e-4146-458e-b5a3-9024f26cead5", "value": 36252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958847, "uuid": "20772259-430d-4d21-97fc-66e3f5e1c75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958847, "uuid": "a9ebd713-9e80-465a-afa7-178469835688", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60187a0c-d1fb-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764953802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953802, "uuid": "dd34c251-760c-47af-87b8-f0f2981d89b7", "comment": "Malware payload (RemcosRAT)", "value": "88832fc711e1f79087a74e8ebd10c0da", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953802, "uuid": "2dd72bba-85b1-4f16-9b3c-824439de061f", "comment": "Malware payload (RemcosRAT)", "value": "416a9123cd5fad96b6aba70fdf4caa480e41f804b51a411d721be8da17192d87", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953802, "uuid": "5e1ebaff-2f97-4fa6-ae26-7bcd19c9612c", "comment": "Malware payload (RemcosRAT)", "value": "178960d23ff63d5afef153c2b695ff61f4f6c2e2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953802, "uuid": "4150a45f-9017-4a59-80a2-371d60d66110", "comment": "Malware payload (RemcosRAT)", "value": "6f72863a70ef79e2e32f335d006e52e94aa0ee707c4cc8d55d39a36c691c1e2ddef74a459f6d776ec8c2cecd27d30d63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953802, "uuid": "a50fd19b-6cce-455f-b254-a978202dbfa3", "value": "T138B4459CE75B14A18F519377632B9E0846BD722EF34A51B6316C63703BE8C3D46A60BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953802, "uuid": "8d2b0d8e-2b83-410b-8d56-b964ebb32b59", "value": "1536:j2dRrXRXSHmMMq1t8yvHP3WyYxt9IUl6FTa6rbuc+dhtBZkDHqT2Qcs:6XimVq1tnuxcUoFm6ric+dhtIDHqTZcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953802, "uuid": "0e2ac084-17f9-4461-b934-7b816f604a50", "value": 497122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953802, "uuid": "5a5491e4-b142-47d1-9733-267490a0b63d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953802, "uuid": "f06034ba-6795-478c-b8fe-17ea1f5b3e34", "value": "mydocument.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ec6db6-d20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764961466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961466, "uuid": "925dc22a-49aa-4914-ab6d-ab19ad44a1ea", "comment": "Malware payload (Mirai)", "value": "f60049fb432c108e6d933fb36fef458a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961466, "uuid": "692e489b-c75e-47fb-9a28-9a29b00e5d30", "comment": "Malware payload (Mirai)", "value": "417cb884a5ed947961e7982e6798a89ebf7094747c51234c2671591b11529c98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961466, "uuid": "bce79183-e467-4a48-9ecf-b79e7bca4667", "comment": "Malware payload (Mirai)", "value": "f67f5f7567f00f5994a92015c18da7faed78c6e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961466, "uuid": "d09584af-9c8a-4800-bc7c-26be7d61d60f", "comment": "Malware payload (Mirai)", "value": "31eb39e86539721e7c5a459b0fadd88b0983eb4f16ca51e19502ad84ea721d7f3f4b309b427a8f565972f8d8bea17005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961466, "uuid": "631a6a4c-1caf-40c7-a1f4-c40f47304f1f", "value": "T13F247C81F643E1F6DC420475106FEF324A33A57E603BDE42E7ACDA32AC55642D6266EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961466, "uuid": "e67db258-aa8c-46c6-ac28-55a9d60ecaa7", "value": "6144:aiopgAmYmC9H+mjfdVnV6B5WJpou6PCAqvKL:aioTmYmC9H9V6B5WnGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764961466, "uuid": "c9e825e4-8f1d-4cc0-8c7c-0121171944b1", "value": 212200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764961466, "uuid": "c43691e4-9df2-4d29-ac95-6474471a3193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961466, "uuid": "87412d8f-449c-46b5-ac43-e03524fb2d15", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79497a5a-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933658, "uuid": "078e1e6e-e4c5-4224-bbc4-9de8bea0ef26", "comment": "Malware payload", "value": "a31c4dc85a541df97812ec03937b2740", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933658, "uuid": "3f697631-719d-4a9b-9bc9-876188e53c7a", "comment": "Malware payload", "value": "41a5cdd888ee206b566e2d50e1afe99383181c400bc2f01af6735f04004780c2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933658, "uuid": "fe2523f9-bedc-4dcb-981f-8d6f561e2799", "comment": "Malware payload", "value": "b9a648ac00b1f160dc614b6e7cc3b44ec172f2e9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933658, "uuid": "b8de38f0-30da-479b-84d1-74d57bac03e3", "comment": "Malware payload", "value": "89ccf0fa00a9b344d43d5c32fce9d13fb8f6ef406a291aed5de9657caa919354cfaff195289f95efbc05df24a2c1cc9d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933658, "uuid": "1be96b58-561d-48ab-9af1-225be3612504", "value": "T19C26F19BF718992FC87B04F24AAE523156474D168E839B836D44321C68B76D83F9DFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933658, "uuid": "3e7762e2-eb56-4c54-b1a9-b179915267d3", "value": "98304:MInqXn3NJ6od1bFkrR8Z7RTdL0iPaEgLCr4lj:MIqX9J6212EdBBaxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933658, "uuid": "8239c0dd-cd70-4949-a543-1dd2fc60b681", "value": 4858598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933658, "uuid": "3a30106e-b496-4180-be86-e93ae4f1a285", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933658, "uuid": "95135c25-2d44-4b5c-8c17-e6757e87dc03", "value": "sapu4d_1.0.2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77602599-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958995, "uuid": "8e38ccf9-024f-45bb-ac9c-b52a91562a89", "comment": "Malware payload (Mirai)", "value": "19c278e844162a32d896a32754346195", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958995, "uuid": "364dfdff-5037-4b1e-8f96-125ac83d205a", "comment": "Malware payload (Mirai)", "value": "4202deb5d2189234aef9c1f27e7b1f262da1541b7e77ab465dddd83c123e656f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958995, "uuid": "3292c77a-e90f-4a8d-9576-0d714c8a76a2", "comment": "Malware payload (Mirai)", "value": "d089750a800c063ab6ab0bfbd00c3df17a37ce19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958995, "uuid": "1d4454c9-cd1b-47c3-b431-7988aed14d52", "comment": "Malware payload (Mirai)", "value": "7a04a90f1e9cdae229ca4c5706e9b32d84f09b0bb9cf4fac1267cffd8d84e4a6575d99053af16a5bc3ab8451c264fef2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958995, "uuid": "4c808d04-c955-4c61-8e32-3bbd032ba7cb", "value": "T10AC04CBD102B6655C110AE21A4657459B273CBD761B18B0A96C87433F58D520F222E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958995, "uuid": "69403a5c-7a87-496e-abdb-ac1b07a1c68c", "value": "3:LxAjtyg/w8NBzSa+ANja9EJzgxAjtyg/pONBzSa5Ap9mun:LA5/wkPjoE9gA5/Mykun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958995, "uuid": "9edb7682-ebf5-4979-a0a2-f60667512079", "value": 154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958995, "uuid": "c40c831c-3420-4da2-8570-1ac60a4356af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958995, "uuid": "0b851687-5d93-4be0-ac7e-3583687c1e74", "value": "cnipc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce3f24a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958897, "uuid": "b816486c-594b-46e8-a27b-59325446e3b1", "comment": "Malware payload (Mirai)", "value": "cd5abb2027d096aa2f6a20f572adb3fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958897, "uuid": "c3fec4b8-b020-4527-8775-b67652c4f27f", "comment": "Malware payload (Mirai)", "value": "42d73476e774e72a70393d7f0fa7eeaba18ab428a87e2aa5f73d16ce9db7516c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958897, "uuid": "0ecdf2c1-c298-467e-97f8-71808f50d700", "comment": "Malware payload (Mirai)", "value": "ba79a4e9149fd59bfae2f9c5caa290083ef6d934", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958897, "uuid": "71774d30-f9fc-4b2f-b119-dd7cfe6795b9", "comment": "Malware payload (Mirai)", "value": "eb9d8f333a23be24df1d525d88c8f687246dbc6081764883181411b4ce591e9eb6bc3336bda999c048b57da1d0df74ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958897, "uuid": "a81191e9-4251-4e2b-957e-6165f9cf1787", "value": "T16511337D030EA9A9808DE83A7295C30CB0A24FCE347787455C49617C70F05DF7272D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958897, "uuid": "088ad629-ad44-481b-8352-c08cf7febfac", "value": "24:XFgXYaFfHYaF6YaFxYaFsRdYaFNYaF5eYaF4eYaFTYaFyXYaFQ9Yy:XhamavasaioaEaBaKaeakoa5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958897, "uuid": "dc7f5d2c-b903-4152-bea1-ec9f0a5cac6a", "value": 1007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958897, "uuid": "7e9a3872-f0e3-48a8-958b-ecf78e0cd08f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958897, "uuid": "0321608c-29c4-42b3-84b3-304a508b18b6", "value": "so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6277cd-d22c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764974704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974704, "uuid": "a82d5f8e-d23e-4256-a4eb-1f9dfa9a2502", "comment": "Malware payload", "value": "cb73d385d2005aa856e662e09de543b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974704, "uuid": "8091706d-717a-42b6-9498-9d381a63f050", "comment": "Malware payload", "value": "42dc63c3d8dffb05c31ccd1a318896077be584e626f339bbc19a56fe29293d69", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974704, "uuid": "c3c5f038-6857-4a06-b793-0b720266603a", "comment": "Malware payload", "value": "0d36ce98ade56b5a18044d7b8ccfd3a8e0cf5a64", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974704, "uuid": "0a024397-efa9-4d79-a6f5-59707e9a056f", "comment": "Malware payload", "value": "9223e93ddd032d0b5659a68c6a54955403c61df484ec9fe23726bed5a8dbfebca282f530e7f294c287332bbb5fa11ea3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974704, "uuid": "b9cc74ba-50e0-40e9-b24e-84d89bb2ef42", "value": "T19B11EAAF7408A9E18768EF00B567F991E20DA24191D03F2C9F8F87B9CC99E163931F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974704, "uuid": "a028061e-c70c-494d-8166-a92a9bcecfd0", "value": "12:78Z4uPcEZnuPcEZ2uPcEZpiuPcEZXWOuPcEZsuPcEZ7OuPcEZ7PuPcEZ7muPWuo:eTcSAcStcSphcSicSfcS7VcS0cSJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764974704, "uuid": "9ac576a4-67d1-4bec-8ff3-464dbcfd0242", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764974704, "uuid": "21cbe4d9-64b8-44c0-b85c-ec57c7c489ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974704, "uuid": "094e2280-2aec-4afd-aca7-da07f906254d", "value": "router.totolink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a7fc4d-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898291, "uuid": "3afe5309-8942-49e1-9b6b-674b6f3ec893", "comment": "Malware payload (Mirai)", "value": "1f5ef5a91200a90441da7f8cc8b5f4cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898291, "uuid": "22a6156e-4d85-462d-a41b-3f508707053d", "comment": "Malware payload (Mirai)", "value": "4335c55894f79c51850dc88c738731e248f512182a089cab6d2f593794adcd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898291, "uuid": "87dacb31-f14b-4c19-a8af-d960a3dfd783", "comment": "Malware payload (Mirai)", "value": "20e0003f4e565b28267003eaf919646f5fd23ccb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898291, "uuid": "8dc3eb13-ba5b-4bad-a526-b775c31b84da", "comment": "Malware payload (Mirai)", "value": "b1aeea892c81627deb85c533159c70275e3df87c53d639e02bb0757358746e5922141455086a344ad6b7bc5b3f23748e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898291, "uuid": "2bca5d42-16f3-453a-b9da-31ae2a6708da", "value": "T1E5045E42DA818E13C4D6277AB6AF424A33329764D3DB730699287FF43F8675E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898291, "uuid": "af1187e2-7ce0-4c0a-bc5a-80d7a98a6648", "value": "3072:uuXGVc57fPO181M+LaUZooxa/GXkPmICAykEj76rvRM/9Of9wHNFR:BGWGMLaUZooxa/skRUj76rZM/9OFwHNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898291, "uuid": "e5226b53-4d84-4283-9a66-90b8b9654505", "value": 185490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898291, "uuid": "715e28fd-6708-4280-a092-b13a385483c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898291, "uuid": "d8ba8365-14ce-4e38-9d79-2c275327860f", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfc01db-d1bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926334, "uuid": "e2be2f34-dcc2-4972-9d90-9ae47a7405cc", "comment": "Malware payload", "value": "3dc05c47cddde36bd2de75007ba0c27d", "object_relation": "md5", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926334, "uuid": "f6675dd6-94af-4590-ab7e-60a50f0cc55f", "comment": "Malware payload", "value": "43383ff8fcf14545cae6933826bba0aea1d46360c9a62789273244385253bd6b", "object_relation": "sha256", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926334, "uuid": "bde25c81-2bba-4108-8a00-1ec130d7a07a", "comment": "Malware payload", "value": "de4415375479a8c6778490117d39a82b3c8dd079", "object_relation": "sha1", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926334, "uuid": "aeebbd4f-16b6-4197-a8a5-5f2edf09072c", "comment": "Malware payload", "value": "02109c835efce294cf339c3af3ce92476386c88637f04947195890400c6c12e7dee6d31691a53561389b38dcc1d210d3", "object_relation": "sha3-384", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926334, "uuid": "477cbe5c-89f4-4c8b-b2d6-e4fca027c2bc", "value": "T1D0B2E1D1C7716F69B200BB3FA6D013EF16A4AF4E2EAD109186EF11DF07D052198961DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926334, "uuid": "b2cbe4f0-d030-486d-b1de-ee2949dc89d8", "value": "768:TjDpChAJ0yvr8HKNqPpSEkoCcsHugMdqB3:tChAJ0yvr8HK4pSpRcsHuldc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926334, "uuid": "1313c879-33f3-4d40-a726-17207e93794c", "value": 24660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926334, "uuid": "9dff27ba-d717-473b-9f1a-f259d4e1ddbe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926334, "uuid": "be7322b3-3299-4e40-ac33-f20125ecbd22", "value": "huna.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919f990a-d22a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764974072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974072, "uuid": "b92b4e4b-48f0-438b-b83c-04b7296b8dff", "comment": "Malware payload", "value": "0f4c5de24ccc5f211719f5ced439529d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974072, "uuid": "9e441c41-490a-4343-b8b4-a797ff1c1053", "comment": "Malware payload", "value": "436f0e4fca7e15e9ef7aa277036d9b5e491766c8a735a2ae74aae7f1bb22a551", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974072, "uuid": "5e0c2fe5-e168-465e-999c-6c6740e946ea", "comment": "Malware payload", "value": "2026d14525cfc8f29d8567089fadbc32eb04180b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974072, "uuid": "3eee37ae-1f68-43ab-9700-be5f24534d4f", "comment": "Malware payload", "value": "a3f48ad5f2f6f1ff4767672066aaa37467e5cd54bb3f26d48fa997c791b83d2944d28f4fe306582156d00d5728efe55c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974072, "uuid": "a3a667a0-cd66-4ad0-b26d-7a648080e004", "value": "T1431142DE3502E8849669EE04B8B2F61072B486E111F13B3545CEFA7EC099A053E02FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974072, "uuid": "b1f5a298-2c0f-4070-a37b-4bfc257216b2", "value": "12:78ZQjXEZJjXEZijXEZpOjXEZXW6jXEZEjXEZ76jXEZ7RjXEZ7yx:eHY5ptqT7BMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764974072, "uuid": "ce6a3d67-292e-4484-af12-593a69c8d228", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764974072, "uuid": "dceb6af9-3b82-4d60-8efe-509455ca6dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974072, "uuid": "7cd5aaab-4c58-406e-8520-008a951be239", "value": "router.draytek-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9528ba-d1c8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931761, "uuid": "e63412e4-ee72-43d6-ba10-02d78565384e", "comment": "Malware payload (Mirai)", "value": "967c242b27702fb5438587ff32272b34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931761, "uuid": "4d78d54e-41d5-459e-b83a-8f4980ac157e", "comment": "Malware payload (Mirai)", "value": "4411175f2b34705600b64b9ff141f472face8cf1967e5ec319213713137d8dd3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931761, "uuid": "a8de03c4-978e-48e8-a847-07f657019a2a", "comment": "Malware payload (Mirai)", "value": "78a39e750c9b021127d5550e89a251d829901417", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931761, "uuid": "743deb8b-cdd7-4d5b-b6a5-5d30d1d3df78", "comment": "Malware payload (Mirai)", "value": "29ae0207024f208e4529e13a7b79505ee816dc889d31b17ed4557b30f2ce0dce5b40a763d08504086eb0890f4990ad6d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931761, "uuid": "522dc47e-eed1-468c-811b-a13b67a27c6c", "value": "T18411467E34011840D35CCA62F4A7A727B30FE77121C4BF2843CD7A3680AA9193976DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931761, "uuid": "fb3136d1-cb0d-46b8-99d1-42103126e242", "value": "24:eAQzMXQzMqQzMpeQzMxQzM8QzM7CQzM7QzMWQzi1:eA+MX+Mq+Mpe+Mx+M8+M7C+M7+MW+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931761, "uuid": "7e62208c-a26d-46d9-9dbe-2c68907a6734", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931761, "uuid": "0695627f-6cd2-4431-b2cc-8c0c97a677da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931761, "uuid": "7c374d7f-5e08-4b41-a649-31313c3753e3", "value": "router.bytevalue-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39270e9a-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "3b76f64e-e3ed-4f90-858d-1700897dbcaf", "comment": "Malware payload (Mirai)", "value": "af062fed28fc5ddfb9dfac80d92b6a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "df452ce3-5c75-415a-b02b-5adbe37cdd88", "comment": "Malware payload (Mirai)", "value": "44a188058d13bcdddc7203b150aad888fb4df7624488dacaa99e8247b51562a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "b0b1f0d2-9bf3-420b-b27a-8e02a4e7a254", "comment": "Malware payload (Mirai)", "value": "579442afe9d5563d3d7c6a75fc206c42802482e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "1fd668a2-1bae-4829-ba30-0af56aab4909", "comment": "Malware payload (Mirai)", "value": "92dd7873969d7ab73b9162b4da58d06d6c8e7aa0e39ddd7a267e563f98f0828338f5f9e840b246410159777d4863cba0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "f57a729b-a8d3-461a-8a5b-fd7b2c608f30", "value": "T1DC630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "0a241a5a-a50b-446a-a14c-2f0715738f9c", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958461, "uuid": "7ce5b412-aa53-418f-a3b0-34e4cb71b72d", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958461, "uuid": "a1b7ec68-0e9c-4a69-8665-b4d6e88c5a96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "f48efa64-36c6-4ea1-9d41-4a80462378d2", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8c7446-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943968, "uuid": "b9b15e86-dd73-4d06-b5ac-97efe6cf1d11", "comment": "Malware payload (Mirai)", "value": "e7d382fee25d4021d38b116fd6e09132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943968, "uuid": "c347fc27-186f-4546-b8a9-964e66e78593", "comment": "Malware payload (Mirai)", "value": "44d4de30c88456ad8f828c16b818d22390519563ab5ec58f6b51085752625748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943968, "uuid": "1f93480c-74ce-4623-9f62-3bf02376b9ae", "comment": "Malware payload (Mirai)", "value": "af47191a38b444413a1ae8e52747ad94acb140f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943968, "uuid": "8f014a1c-f2b5-43b5-8b17-a3bdcd69996a", "comment": "Malware payload (Mirai)", "value": "e6cd394ad57a349ffb45cda99f9ee414b0059084084ae182e4f36dced07ad6c71ff0bbb79c8b116d7a3262748f24329e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943968, "uuid": "da43c587-371d-471a-8b8d-b951e8004452", "value": "T1D92423B89D8DADCBCAA91B7F3013979726C5B14833330CEAC21599480A3C95F699A4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943968, "uuid": "3bd9a174-c854-4b4c-bd99-2b9b43799d22", "value": "6144:e3+QW+iqEoMJI4838vjCgXVfKD3Fv5nEevS:e3oZoo/YqjCMxCvqevS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943968, "uuid": "58a4b65d-44df-4f5c-8f35-247fe9938c70", "value": 225980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943968, "uuid": "b38171cd-ff7a-4e87-8208-bc0b6c570669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943968, "uuid": "455bd5d4-14d4-419d-b96d-632a0e29be1d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dee33b0-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958926, "uuid": "f1f3181c-cf82-4fbe-9776-955dbe978ad1", "comment": "Malware payload (Mirai)", "value": "61b99bff0f39ecb5ca37df0f9bc665ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958926, "uuid": "84884174-67f7-4e86-a1f6-d27da0f04058", "comment": "Malware payload (Mirai)", "value": "44f50902d1da11a82967c8b6fe3da05660c3971b48d185440882c164d32c59fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958926, "uuid": "00aefd03-449f-4ae1-b524-43a0876f7da0", "comment": "Malware payload (Mirai)", "value": "1d8cc02611e71cb452d169a2deed5d3f14b1f95a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958926, "uuid": "11816cab-e781-47d7-a443-a88c5e21d2a5", "comment": "Malware payload (Mirai)", "value": "5065eeadcdfef03b61e8255a1cfbf285f51c5ca1bed65a231d5e51fe77180f658087b4b7c1af43ed0aeb2dd24d132c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958926, "uuid": "132395ef-c2ee-4247-82ff-4fb389f775e2", "value": "T169431945B8819A27C5E4227FFA6E428D332A23F8E1EF3217CD125F11778A82F0D67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958926, "uuid": "269eb8a9-df69-4894-a06b-c917ea38575d", "value": "768:pqEIJOX+NPVGV4vRPnCJjVGlOwazQDvtoOu93JM1mDXikgN0XP3vk0PAu:pIJ++pnCJVQDazQDqP6q7R/4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958926, "uuid": "cbff7c8a-7afe-4479-a13e-2652550c73cb", "value": 55200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958926, "uuid": "e0fbc872-1632-4c07-a6f4-5ccc7c5efb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958926, "uuid": "fea82e7f-33cd-43a0-956e-e8c704968c57", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7902b913-d194-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909606, "uuid": "7347ad6b-ecd6-4e7d-b3f9-da57a5ae09c2", "comment": "Malware payload (Mirai)", "value": "d2c39a2564e9aa6f94e6847753aa60f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909606, "uuid": "3ae9207c-0fc5-4c85-a0e4-c324b6f6d551", "comment": "Malware payload (Mirai)", "value": "456511fa65fc140a7ada47395e4ba0f505be9b7b2357a20ae75e5b64ed129e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909606, "uuid": "dc9ff9d8-52de-42b4-a8d8-e36b5d14ec47", "comment": "Malware payload (Mirai)", "value": "65d4e3a6332cfcc9ba3c593cfdbe84701abc4570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909606, "uuid": "b918b7f4-5c5c-4e7d-955f-7dd1e9f88de3", "comment": "Malware payload (Mirai)", "value": "0b3851f03b94a56c1ee06edecb72cfa7bc88091c41c6e7865c0a4e36b048f55c09242abfc318079d752b6c0c7be4f7ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909606, "uuid": "bf46daef-1881-4c85-9fc5-65435a41b670", "value": "T10DD32A46BE546AEBC05FCD70052EC30326EC98CA92E5731E717CDA8DBD6D2064AD399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909606, "uuid": "fb6cf782-91d4-4c47-b856-e4e9e999c29c", "value": "3072:8T2dNUBJL0x7qIx2zSxTT8jfGXmoIX8+e0YxRk:TrU3L0gIxV8TFoIX8+e5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909606, "uuid": "29ff3b9f-8a18-4ffc-b2e4-db7b83d84a9d", "value": 140968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909606, "uuid": "97e98a7e-098c-4ae1-a0e2-1e42410c382e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909606, "uuid": "1807567e-758b-4295-9e0e-371c268450c6", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac67aeb3-d1d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764937180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937180, "uuid": "bdb5f730-1e60-410e-812b-2a76f67485c9", "comment": "Malware payload", "value": "50d1ddbbd7efb4be6f4fe690301e5d7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937180, "uuid": "2645af66-ee37-4496-8669-c1db7b1206ed", "comment": "Malware payload", "value": "45d233dffeef0ccc3207a20e67ff65a2a6bfdc3d887e289dfa82dc2a421ed2a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937180, "uuid": "633ae90d-4887-47ca-88c0-849cd019d3b5", "comment": "Malware payload", "value": "284af0e3f0b7ecfdcc7fca5e06426f4ddc6400ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937180, "uuid": "711022e0-8512-4b9b-a6f2-b0472a6cf118", "comment": "Malware payload", "value": "6a24efacf54fa633d6b3874dfa8b401862924fdfd9a6f7aa6ec09a5e04c8c96b8e5ddf74ab111158e2ad9ac5e2264d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937180, "uuid": "50384547-d6e6-42e1-b8b1-60ae4849f961", "value": "T1DB4302C7E9AA873DF4B6C9B84ED6C4440987022D714370BF468CA5BC24797951E9AF0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937180, "uuid": "53643ab2-2e45-4923-ac57-b636bb527739", "value": "1536:m3LqE6rUQWzVQR7iAGEcUT5PIi7pLqBNs4LOjcwf4nF:mOE6PWo1T5bz4LVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764937180, "uuid": "793892f2-789f-4650-aeae-c7d4f1352539", "value": 55520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764937180, "uuid": "8a501b73-ad6a-405e-9441-b5067d789fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937180, "uuid": "acf8275b-06f1-43be-9c7b-f94c2b6a7ccb", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b32ae7-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958940, "uuid": "63bedd79-4e85-4e6f-8027-f56dd83cb1e6", "comment": "Malware payload (Mirai)", "value": "3ae55187d8b0344036e6b0590530703c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958940, "uuid": "d221c18b-6957-4577-8489-670490b7e7ed", "comment": "Malware payload (Mirai)", "value": "47123066fa8948fe17fe994ba445ad68d9ee388f54c04fddabd2a393ba7dd56f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958940, "uuid": "9067a860-02e0-4605-b5b0-ec554a027e60", "comment": "Malware payload (Mirai)", "value": "5c8b44ed0f9d58671a405a0b47f0ff28d6f0a51a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958940, "uuid": "249bae4e-a47d-4e84-910e-91ccf10a2b70", "comment": "Malware payload (Mirai)", "value": "d56420f5ecf273b44b9c63534fca39e566aefed5e2170f68276ac87f51b169ff49f26c0c7e2d203cad7a25b9065e1e76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958940, "uuid": "512e7160-1875-493c-b24f-143695163be1", "value": "T12AF0ECBD269E92E71E0C8E19F46E844C766787D6B071CA01B028B86475982103063F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958940, "uuid": "01e78406-042c-4191-a196-87b4ba9750e2", "value": "12:3J3Hh+0jQHh+sLqQHh+6NIl5zAQHh+H0LKjQHhFtaKAQHh++7nQHhVCQHhPFEQHS:3J3B+0k+sLL+6NI7t+SKkFtBR+owVz9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958940, "uuid": "8aeab0b4-f115-416c-9899-0c5a113cf525", "value": 647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958940, "uuid": "8acdb299-66e1-48a8-8045-00ce8058fb14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958940, "uuid": "0c1ee1b4-d2dc-49a9-9dbd-aa3cd4ba495c", "value": "h.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac82178-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959082, "uuid": "7376555c-4a2d-4921-8609-a8cd62fd14f0", "comment": "Malware payload", "value": "7c287256b67eecee91a90491373daf03", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959082, "uuid": "c06322d8-bc0b-4d1f-ba24-f1a8cc7396c1", "comment": "Malware payload", "value": "4816c6dc6bb538172c0ad662db48a8787a9e0a258b727f01ca93bfbf70c90e06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959082, "uuid": "748bf935-eda8-4958-a3bc-6f276d6f488e", "comment": "Malware payload", "value": "12fdeafbbfe94613d6edfde496da70e67e4d4769", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959082, "uuid": "62173edb-b0df-4320-bc7f-501ed179c486", "comment": "Malware payload", "value": "5d6dcac8f45a04eed25de2553fa786027a965de8cb60b4e8c095bfdce3e7cc66eeb78f3df8f62d0c612e383f6c6c21b9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959082, "uuid": "724f0d00-8a72-49d0-b281-74e35c7e4106", "value": "T1BA21327C06065EF4808DD43E7292C40A70A24FDF543B8B946E481A7D34E04DF6135E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959082, "uuid": "19dc715e-4df7-4c2d-8616-7cc5cdecf549", "value": "24:QXzFxrFl5wrFzrF2rFAyrFSrFFrFArFMrFDrFASrF7rF4t:Qj7rf2r9rgrXrgrLrSrmrprDrBrqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959082, "uuid": "58eb734d-96c3-46c2-9853-985ebd8c6946", "value": 1241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959082, "uuid": "451d8e04-1969-4ec2-b16c-73fc13c5ee1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959082, "uuid": "17b3bbde-c191-40a7-8896-90d4fbf8437b", "value": "sk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4676f3c-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908847, "uuid": "5420f084-d94a-432b-81cd-bda570b3a6ec", "comment": "Malware payload (Mirai)", "value": "71b1982484040077e14cfeddea231f62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908847, "uuid": "9cf00fc3-c82e-4fbc-8921-5d3b571bcf50", "comment": "Malware payload (Mirai)", "value": "48c36449217c1953b7c826999bf01ea3f1ed14a9879b215c6082afa5fbf62680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908847, "uuid": "bbe136b4-9c8c-49fd-9d66-17139be54786", "comment": "Malware payload (Mirai)", "value": "e5a1290338e93b9d1ba3d8de35a5d52178936024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908847, "uuid": "b42e6bc0-8c47-451f-ab4e-eeb0008992e0", "comment": "Malware payload (Mirai)", "value": "d46121a91859324e34382a516e2e1ddd5f231537d74549e622448cb656388c23ca4415dca3ce422e3132f193ccb53022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908847, "uuid": "f7f5649e-5741-4b92-a8db-faf494978308", "value": "T1A063F945F8818E26C5D5027EF92D128E371267E9E2DFB223AE205F203BC692B0D77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908847, "uuid": "8a7ba44a-2ad1-48eb-931e-115585790f6a", "value": "1536:KtnSZigkxMwIaIWDxqKlFaQz4dBAjrOBjclILicCPr0+fh:HihxdIUDxhjbNaCPr0+fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908847, "uuid": "d497e094-5c33-4abe-a0ae-50f69fe60b82", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908847, "uuid": "c2a554b0-71b7-4fba-90ca-127cd318fba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908847, "uuid": "bb6db2b4-1ce1-4b9e-ac9c-20b5f9a1bd54", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98158c03-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959050, "uuid": "e3bf1d34-8e12-4502-a52f-8e56691a0edc", "comment": "Malware payload (Mirai)", "value": "63d44ea373fcdb87c5c3b54629965170", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959050, "uuid": "df6e1e77-f5fa-4cf7-b9b0-9c25612e7727", "comment": "Malware payload (Mirai)", "value": "48c914a44d5006edee84d550ad9ba6007549f7af27b2e683a61f297e9589235b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959050, "uuid": "a0e64ecd-fbf8-433b-b83f-c899cb24eade", "comment": "Malware payload (Mirai)", "value": "b66153f57f5af6477f70ea2d3283921e0a85d67e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959050, "uuid": "2c29e94f-3cf8-4a3d-b5a5-18bde4d8b1f2", "comment": "Malware payload (Mirai)", "value": "c48fa32d3a71bcbd93644661e9927f3d0c1622bc3dd4fd6e1efda6c42640f5b049567e040831b544307a12fea39c4209", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959050, "uuid": "d994ef54-75ce-4fc8-9834-be5cb2ba3960", "value": "T174F037FD002FDF67C1584E19B061A03BB13247DE25E2C78DAFC5741AB64D510B272D11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959050, "uuid": "08d31902-a11e-4fb2-8e6c-29c46504a2f7", "value": "12:fXhfLK6zXS1QWhlaLaNghqhSNIE62SfhRHGZyhMy/r:fRDK6zXAQMlaLaNg2SNIL3RHbMyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959050, "uuid": "6d69384e-0886-4fcd-941a-836404f76835", "value": 450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959050, "uuid": "4a9ab742-fcf0-438e-bb26-0e7fad21a2e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959050, "uuid": "44d741cb-6586-4758-895d-687656a5f58b", "value": "hell.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c8bf34-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959051, "uuid": "c060f342-a378-4ca0-9245-b0cf9cd24158", "comment": "Malware payload (Mirai)", "value": "af27eeeb966013e5f39f132adaaec2f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959051, "uuid": "14278cac-c62a-429a-8c1a-309583b63938", "comment": "Malware payload (Mirai)", "value": "490323485aa5d9747db4f31d38569438133aa07695d05d3d3ad662e6433ea7e9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959051, "uuid": "594330e0-6d72-4505-a042-525765a3628d", "comment": "Malware payload (Mirai)", "value": "36300b1c56e92e68ddb0b672c32cc004a79c0408", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959051, "uuid": "4bc68344-37d6-47f5-9148-217854ffa425", "comment": "Malware payload (Mirai)", "value": "e6254b252be6187c6a62b716ae978b5d966bd542adfb34bc16e6f57260eadb4cee921d49bfc739cb289860804f33a159", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959051, "uuid": "afcb16b4-2ee6-4819-8b23-2e5aaff90661", "value": "T1D311867E4512BA41C51A5A75F02F40157132CBDB79B68E42ADC4613DA1C47317023FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959051, "uuid": "3afb6560-e7ee-4596-ab1f-1adcb0a84d4e", "value": "12:shdChKyhaJhKyhJOhKyh+6ahKyhlOB5hKyhnEhKyhO2MhKyhwDbhKyh5OhKyhcDK:ekXgXQX0XlY5XEXMXmXcXOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959051, "uuid": "6b645e3d-305e-4888-9ede-394d936cf773", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959051, "uuid": "31c1b348-ef10-4512-965c-0982b55b3d1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959051, "uuid": "a6567820-c912-468c-936a-e78846c8e9d2", "value": "ruck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422397d1-d205-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958047, "uuid": "ff858c7c-9ac7-4779-b114-128a1e6b0829", "comment": "Malware payload", "value": "45b2c1f3189c5480559be586e8a16352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958047, "uuid": "bd490066-ae60-469f-b4ae-1657cd4b5dcf", "comment": "Malware payload", "value": "4a067d2404b01f62ba4529f36a1c77d7ee1094fb736ac9bcc14ea287ee17f618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958047, "uuid": "902ebb6b-7567-4d77-9c90-ad6e5cdceb57", "comment": "Malware payload", "value": "bc197351966da078521ec83fef2921f6b5fb548d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958047, "uuid": "917ba1e9-3452-4951-bfdb-41b85183acd9", "comment": "Malware payload", "value": "9cf99dc91cd0d6a9caf48df28404f894f85d01a1b3329ded1056289f9408c85f321e35b23ee0b38716c498e5b3749c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958047, "uuid": "63ede08f-6fb1-4f7e-ad45-e7a510317eef", "value": "T10A26335C730681ACFC29473C082944AD9576E57E1A12D9B31C0E997ABCD3A98FBBC1CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958047, "uuid": "920ee9a3-4ad6-43c7-bb77-cc06aca21163", "value": "1b051b8929edd297bd54b50b10a5f3bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958047, "uuid": "e9d68933-608a-4baa-afc7-367926874a70", "value": "98304:TNwHjYjtnsizfZf+BJPznDPtCDWdslGkUr77ARPrziAogBYY+g:xwenvZGBJPzcGsl7U37YPrxosYY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958047, "uuid": "a2307eae-bd71-4aa9-9ca8-212c985b9569", "value": 4451682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958047, "uuid": "d19f340c-170a-4b15-9bef-b79377288c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958047, "uuid": "551f06c2-5c0a-42a1-8938-0db59cc89a96", "value": "45b2c1f3189c5480559be586e8a16352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3296b44c-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958880, "uuid": "cae7addb-2aa7-491c-94cb-f89cd638c9eb", "comment": "Malware payload (Mirai)", "value": "6814fa5df6ffb52c517c184db71d2ccd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958880, "uuid": "135f17f2-9950-4d0c-a7cb-f6e4d558cd38", "comment": "Malware payload (Mirai)", "value": "4a1dee40e7a19a9ba5807165c15bbececb3e0233724a831ff42ace34d3ae9947", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958880, "uuid": "fc97d17c-309e-4227-8de2-49f513027903", "comment": "Malware payload (Mirai)", "value": "3fbfb0100a082114782db2c2be92b9d6b6ef17ea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958880, "uuid": "0736d974-b79d-41ed-a056-426167176b9a", "comment": "Malware payload (Mirai)", "value": "8f484295971e438f62b5d3b2f6a22d1a2a2f486e441cb6ca293057419b4f828bd181a542c214a7c0b62b36d9d3c721d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958880, "uuid": "dffcc60f-8f78-41c3-ba39-aecb6ed3d11c", "value": "T105B0127DC11A42040208481D346510407031CB4530EF4D1B5704503151AC030A211E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958880, "uuid": "68a0c28a-6388-4c0e-af52-e492bff90078", "value": "3:LxAjtyg/4HSanWT5YqjKS13:LA5/43WTuS13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958880, "uuid": "b05e9e7d-9135-4bf4-be92-cb51db6a2a2b", "value": 94, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958880, "uuid": "9a587e05-e807-42bf-98b5-8e6a38e0a575", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958880, "uuid": "17dcc417-442a-4d6e-8ab1-6a3a7f16e8b8", "value": "hu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26461145-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917198, "uuid": "cba5e520-2988-472c-b112-dda9dd2ff0bf", "comment": "Malware payload", "value": "e68435f3899d0f01810afff7a420429f", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917198, "uuid": "ea424ba7-ae8e-469a-943b-f655d836c881", "comment": "Malware payload", "value": "4a97ce555290fea3c4fb2948c44bbc7b05b0512d7883bb640eb1ddff0ed4c427", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917198, "uuid": "0c19746e-6e79-4bd7-9522-bf7a51884d3f", "comment": "Malware payload", "value": "47b70c47beb33e88b4197d6af1b768230e51b067", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917198, "uuid": "83516729-26be-41b2-80a4-610267dbc755", "comment": "Malware payload", "value": "56c3f8fd1fafa2397811f1b2580eb8134d6e191b59e2c83fca43015a24cb00cd8aa82236af14e1dbe9d4eda8633b0d54", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917198, "uuid": "67b8bc57-cabe-47df-8c37-6bbe8fbf0fe1", "value": "T19466E04BF7B610C1F5B6C139A562222AFD727CA1873897D75281BA0E5B30BE4AD3D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917198, "uuid": "5158a16b-aa7d-4e62-9053-8333a2c21d22", "value": "3ca70edbdff1dcefc743be3c25d8e991", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917198, "uuid": "13b0e529-1f08-4e21-a614-82b5550a7cc7", "value": "98304:Dz29aTwa0f84sZKfm6ncxUNBA3NlxVH7Xvl6Wk4F2BY28cs5KY:DzZFKuAcxUjshrkIqyNKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917198, "uuid": "958d079f-e0ac-48e7-bda8-20b776a64f45", "value": 6917632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917198, "uuid": "9ccd050d-24b5-4661-8e57-ab4aae1e5a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917198, "uuid": "35c64c64-aa85-40dd-9f17-3e0231764545", "value": "4a97ce555290fea3c4fb2948c44bbc7b05b0512d7883bb640eb1ddff0ed4c427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afd51db-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931004, "uuid": "fffef4a6-b303-4e12-8cf6-04576cade574", "comment": "Malware payload (Mirai)", "value": "3ed40fc7e292a21d97c397088d5288e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931004, "uuid": "92ec49ea-9f11-4ca5-9b91-04d06cca1d6a", "comment": "Malware payload (Mirai)", "value": "4a9ee3d2438813bd195f691e252c1dd0472e39839c395121dabd15b2f5a9cbe0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931004, "uuid": "0fff6e27-3658-40e3-a476-81aea295b133", "comment": "Malware payload (Mirai)", "value": "637a89a4e829703d0e83e2b064afd20313f3fb51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931004, "uuid": "098b4cd9-46df-40dc-a8fc-51abdebc6346", "comment": "Malware payload (Mirai)", "value": "1c6ff1ccd388733db512b28ad1975318fbe256796ce1cd8ead9cf34207939ae7a60373a09c9ed93bab65068e609897e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931004, "uuid": "2895971b-b041-40c4-b293-5570d81ffd2d", "value": "T19E235C44E5A3D5F0E58783700127E7EF4B35BD328129DAABEB843A61DDB17818C4725E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931004, "uuid": "51a358b8-dcc3-41d8-ae7b-227f5e90c621", "value": "768:sVx9GtGbMc/ulDb4cGNa/Ak2rTkv6UQ/ZmDU9hA:sIGbMow4jk/B4X/Z79h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931004, "uuid": "819412e0-a296-42e1-a17e-39f6977f2a99", "value": 46176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931004, "uuid": "baab8552-1ee0-4146-9a34-2e10a5198a78", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931004, "uuid": "f9d89e33-dd0e-4ef1-9062-31d32661c02d", "value": "VRx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed66bf1-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959061, "uuid": "cd8289c8-da2a-42ae-a3be-b016943889a4", "comment": "Malware payload (Mirai)", "value": "4773c3503f0ee4f98e3fd6e89dec7ac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959061, "uuid": "d046b2ad-a1d9-47ee-b363-490da3575e8b", "comment": "Malware payload (Mirai)", "value": "4af4366ab176f0000dd4cfe3f7923e71f31fc644b98fd8ddfc4a5704acf1c0a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959061, "uuid": "9212acd0-707d-4435-a230-a439788e6eb3", "comment": "Malware payload (Mirai)", "value": "f4052325d19f3dfab7ae172c524b0d52db952ef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959061, "uuid": "6f6fa924-af51-4594-8582-12471ac5dc61", "comment": "Malware payload (Mirai)", "value": "5f993db6c4417aea3e5f3cd29d55acbc473a7d9030c8a1b4c9a5ec082399c629221784ba723821e32687884fb1f8d3e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959061, "uuid": "26f47b03-5832-407d-8e25-024396cdbfb5", "value": "T17603F689B891CB16CAD1517BFF1F829D772A13A8E2EE7303D9196F11764B42B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959061, "uuid": "c1fdb672-2498-48b5-a1b5-db24cc495140", "value": "768:DuBfbHnO8nrQWL3HMav65NT1NGj5/778ncuWb6rvtu:SfblrZ8Mj57dFWbtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959061, "uuid": "64accc05-77ce-47e1-ba24-991b9bf38e57", "value": 38472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959061, "uuid": "4d67866e-6ed4-4ad5-a645-7d0a297b6e67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959061, "uuid": "38f65b1a-da4e-4f6d-9ab4-887f772cacc5", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4a89bf-d201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764956244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956244, "uuid": "c3178cfe-4987-49f2-a58c-ba2a44742cd3", "comment": "Malware payload (Mirai)", "value": "96bc0134e9882a76cb0cde5ccab1d7cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956244, "uuid": "a062a426-bb90-433b-8669-aa869eda1abc", "comment": "Malware payload (Mirai)", "value": "4b62fe0c6154e42057c1cd9cab1278719ecd1b0a5da0f7f05c24ad1f7b242375", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956244, "uuid": "468535f6-3b77-4ad0-87ec-31df2e6bc366", "comment": "Malware payload (Mirai)", "value": "161af216dd71aba69cfcf2c1d2c5390a08490e86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956244, "uuid": "39c2ba95-9334-42eb-a960-31589d9dfd37", "comment": "Malware payload (Mirai)", "value": "5fb97ef758837c6ef5d9262ba4efdf34ed0759c710bc9a0194be766b63949acb21eef74901380c09db9db746568d6507", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956244, "uuid": "64bb570e-c843-4055-ba1c-38fc8f66def3", "value": "T178112E6E2801DF569298FB02BB73FA30A119C78560F43F38A7DF973381A96553502F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956244, "uuid": "9f2c3905-1eb3-49f7-8050-e82de39fae23", "value": "12:78ZnCcpZeCcpZVCcpZpRCcpZXWNCcpZLCcpZ7NCcpZ7GCcpZ7lCcpo:ejcVpZ2P7dwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956244, "uuid": "1ecdd526-5eab-40bd-a4c4-6da2ccfaa13d", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956244, "uuid": "828c94cc-5c69-43c3-b862-d7cf14322657", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956244, "uuid": "7d14b10e-69c4-4f14-a160-045b170c7e61", "value": "router.dlink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ba613f-d1e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764944947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944947, "uuid": "f2b284c2-dd4d-4435-ace8-c73d4e673356", "comment": "Malware payload", "value": "6c015e3c3d5d2266858eb6f4ba601083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944947, "uuid": "817fae42-caec-411a-a110-5db68082eb71", "comment": "Malware payload", "value": "4bf241852cab39645c99b0be7dbb2e22ef6ec690b268906541e00dfa3499eefd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944947, "uuid": "ce323670-40c4-4513-b51d-13492044c200", "comment": "Malware payload", "value": "53857cd168699ba2f91558450bc67f23753d716d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944947, "uuid": "7dd0276d-a5ee-4101-893e-a279df92469c", "comment": "Malware payload", "value": "de12e4ca1cdf58030ebfe8f32b39a8e9b8782426ef1901e5c2c41fb6b29408b9d9febef084aa540e31005470045269dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944947, "uuid": "7db962c4-93b9-4e39-a76d-549f638bd00e", "value": "T196187D13B3A704D5E8F7DA7496E65223A932BC062F3085DF324C47261F73AE05A76B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944947, "uuid": "91ebd5d2-9959-4d70-9868-080e821741c3", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944947, "uuid": "83b7e9ed-a064-44a4-b633-8bab00d8152e", "value": "786432:YpNzhI+nsVt6mHaIvAN6v+s4pgPVlcmgj:YDNI+nsPcN6v+A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944947, "uuid": "254bed47-7ff4-4fa5-8942-dceab8b7cafe", "value": 92183040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944947, "uuid": "d1570795-48cd-4dd1-808b-7e48d4f4e541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944947, "uuid": "9147a23e-c87e-4353-b01e-4ef43838f5f5", "value": "WaveLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319d53a7-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958449, "uuid": "7a4ee847-90cb-4373-ab7f-05f89ff045d3", "comment": "Malware payload (Mirai)", "value": "1821b583ce3dcdaaa872aabcff014bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958449, "uuid": "201f70da-bd12-470d-b15b-3e93d5e4ca0c", "comment": "Malware payload (Mirai)", "value": "4cb082a8c97e22c41d2bdace84f90f8ee158ddb0312f442bbe6f883516e3b640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958449, "uuid": "902f5e90-027f-43fc-a492-1365cc90f7c3", "comment": "Malware payload (Mirai)", "value": "2177f2592a1f79bd3900521b5429c63fa17132c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958449, "uuid": "9c8c2778-368f-4e45-97c1-f666d4a6ad0b", "comment": "Malware payload (Mirai)", "value": "de50d00c2310d3a7821bf9ea016895ceaf0e35217c24a924412e8e94cb1086c181ee9749c2244b04be674ea1c2e80006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958449, "uuid": "24564c4f-aa7b-44f8-9538-5e7c02023dbc", "value": "T1A783074AFC819B11C5E922BEFA1E118D336357A8E3EEB212DD111B15778A91F0F77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958449, "uuid": "5b1f9e4b-3a63-4ca9-b8d4-cf75029d60c1", "value": "1536:ORnYfIgsJteplY6GVsxYbOqpYKAMU1L5z1GXsFeKZoq3JNlKniPPz9N7ttu0:vBwtOqVVsxYbjpYDL5zcXsFeKZolqPzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958449, "uuid": "6ede418a-003c-49b1-91a1-c3d23c6797df", "value": 84236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958449, "uuid": "b2a06d12-993c-4d40-bc48-8b4fd8fa67f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958449, "uuid": "0340b7dc-cc6d-43ee-9e26-37d870e4c3ac", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fed261b-d184-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764902719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902719, "uuid": "7da2b4dd-07ba-4166-8f2f-eb80cf0c0cc5", "comment": "Malware payload (PureLogsStealer)", "value": "8722c9f030549c142bf4e9f0f5162f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902719, "uuid": "426e1128-0269-478c-a8a2-2eefc4a91a0b", "comment": "Malware payload (PureLogsStealer)", "value": "4d3b8bfce2a9a553d00af15c4880998ccb4c7062776a4ac6522d92b235e7ef21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902719, "uuid": "923515eb-5dba-4010-8453-a9c93f54639f", "comment": "Malware payload (PureLogsStealer)", "value": "1fe482456ef6cfbc965d52e112f7a3a9361f6b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764902719, "uuid": "ff8a9484-c902-45c2-adea-4997b35944f2", "comment": "Malware payload (PureLogsStealer)", "value": "d6abdc2036823e1b69921e6eda9e2aca0708cf133d980e4c1702451e26ffbe760745d813570f4a8b2bdd56c8b60923ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902719, "uuid": "c8740894-c630-463f-9160-cea527db0f31", "value": "T15DD4E0E1FDA3D026C8C205FACE6D85618A391C5D53925C49F787AB2EA0DB10DEDCC1E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902719, "uuid": "46c3c212-50b9-44ea-a55f-d72ecdadf355", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902719, "uuid": "387b8f50-65b3-47fa-a08c-309226644f9b", "value": "12288:p5l1D8+64O3PaVuux9iZyJr4Zq5vV20PfK7BAdnrYzP00Zg:p5w+64O3iV3Eq6Sv4AKAdnsz1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764902719, "uuid": "8f19819a-5f3a-4c89-8a4c-d8d983a57e04", "value": 647907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764902719, "uuid": "5200ca54-bb4c-4ee2-9438-a291e0ed1d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764902719, "uuid": "cb2b8c46-e13a-4ff7-96ab-2bd138c1b349", "value": "CUE9SwiftXK28939Z29001NF738403920MXLO3930XN89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3342ee-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958977, "uuid": "caea4249-4fdc-42d9-8560-692d4dcf056a", "comment": "Malware payload (Mirai)", "value": "75b34b0993517746d4649637875ee307", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958977, "uuid": "21ed55a4-5f5d-48c9-9a29-ae46daf8e639", "comment": "Malware payload (Mirai)", "value": "4e0f0a7c551fb64cd43ac374e17a79c3e1fb088282d29cdd06079fad2e294bdd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958977, "uuid": "a3823a4f-54a4-4370-94fe-8ef2dd469bba", "comment": "Malware payload (Mirai)", "value": "d4114c0df461b756f02e8dc7e6cc456a41446fd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958977, "uuid": "535674e7-60be-4140-b64b-f66634f99c86", "comment": "Malware payload (Mirai)", "value": "c337636d931828c4f1220c3066ea99b2eaf4c8950f450ad6e40278e136b240942d800749dd0dbc967980db11963f3255", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958977, "uuid": "b355d517-6624-4972-a5a3-008b225849dc", "value": "T15DC04CFD102B6255C510EE116065345AB273CFD771B1CB0A96C87433F58D520B622E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958977, "uuid": "c3ecb5ed-9c0a-4243-98d7-18bc16e18453", "value": "3:LxAjtyg/w8NBzSa+ANjaqzkDxAjtyg/pONBzSa5Ap91:LA5/wkPjQDA5/Myb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958977, "uuid": "7c00f3e7-29bf-40dd-a1ad-d33779d34df7", "value": 154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958977, "uuid": "ab0b9161-c1f0-4bac-9835-d0c96679c4ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958977, "uuid": "662fb290-ff99-4dc6-9732-0c5f78e61d2c", "value": "usr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9743c1-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1764944183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944183, "uuid": "775ca61d-f642-4c8c-adf2-0ea25becd1d1", "comment": "Malware payload (GenesisStealer)", "value": "d23be7662b87560b8b154d4b765b7159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944183, "uuid": "3de909f8-6a40-4d69-9d64-cb9207f95c03", "comment": "Malware payload (GenesisStealer)", "value": "4e25306a7912045b5806be298d0e23de4153e331b0793b446fb123d77f072ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944183, "uuid": "b256ee52-4399-4559-95cf-688052094900", "comment": "Malware payload (GenesisStealer)", "value": "926e1e0230535cd46c62e5df77d57ce11fdb5099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944183, "uuid": "b66ab067-1db3-44c1-ad04-599fd04dae27", "comment": "Malware payload (GenesisStealer)", "value": "75c57ea0f5bbac067ecbabc3c36daa051f5aa401ae8acaa25106c852097e012bb768222dfd6e87a3403f590f48cb6a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944183, "uuid": "f9679224-4d6f-460d-8ec7-7cfb564b81fc", "value": "T17B18331C7F14ECC2C0ADB17F77F776240A61660719326B5602A7CA9E945CF37A3386A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944183, "uuid": "a520b218-aeb4-4235-aa68-0aa26c801aea", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944183, "uuid": "d9c59737-b4e1-486c-82b3-37eebd6a275a", "value": "1572864:lL+BWMFDe45kbPBXz6hDRVO2mJhh94iybSgq/hQv5n0PaRKrMzgBXCOwffoGWkFu:lyBFle45ePBmhDRVkJhh94ilgohQv50f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944183, "uuid": "437894fa-23f4-4a64-a338-12ab77f5db23", "value": 87912782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944183, "uuid": "e7e68ced-2611-4b3f-b570-7f3723a7d2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944183, "uuid": "b9667adb-fa15-4d7f-a27f-d1b4350043cf", "value": "WizardXray Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc7dced-d21d-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkComet)", "timestamp": 1764968482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764968482, "uuid": "b8f88a4c-da61-46ae-bc30-30cddb92f4b3", "comment": "Malware payload (DarkComet)", "value": "ce84b5ced6719ef6680c681e46014400", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764968482, "uuid": "2de52efe-e202-4149-bd31-62e693727363", "comment": "Malware payload (DarkComet)", "value": "4e57af02f430ffdacb81b8b597b251bac12de9c0703fb5325411dc83ca8d8e11", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764968482, "uuid": "fa725775-2566-456c-9c18-e76fc3938b5d", "comment": "Malware payload (DarkComet)", "value": "7960e61fd077596e7d9630fe579ace4842a344e7", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764968482, "uuid": "bf2e8e85-9f9d-4328-b639-df3824f89d83", "comment": "Malware payload (DarkComet)", "value": "1dd9be2b6937e2548cd795e54b5a2e4035d2d4a64391f6fe9e02281ff360d4c109b402b6872d771a478ccd0532fb06fc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764968482, "uuid": "18cd5d10-544a-4687-9e3f-a392191e43fe", "value": "T115A6E1447551BE5EC3E68C32E4FA1C1C933098A61743E30B653AF695EC5F2B66E803E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764968482, "uuid": "ced572ef-217c-4d3e-a1b1-96ace1b934dd", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764968482, "uuid": "f952f46c-d1c9-4343-a1a0-1f1aa1832858", "value": "98304:0bCTz8+F7j9+U22ihIYgOeieNEVJyZlng4p2V:0KzpFOJIEYEVcn1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764968482, "uuid": "f3cd4ac1-c9e2-4929-8959-7c3dad594719", "value": 10008064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764968482, "uuid": "e547d03a-761a-4cfa-8552-671ddc15c3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764968482, "uuid": "907d6115-97ee-41d2-a42a-0e8194d749e2", "value": "Extreme Injector v4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc3ba0-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917181, "uuid": "f3142490-207e-4e01-9dd4-683e0b7d1739", "comment": "Malware payload (Mirai)", "value": "fcc70999af73e2d65968ac5411a2363b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917181, "uuid": "52bfacd3-1a85-4fe1-ac5c-277304f4b8a3", "comment": "Malware payload (Mirai)", "value": "4eda17366ebf1912ebb0270acaa8c266239689c840a5eb25fca5a247026e8206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917181, "uuid": "1d0af896-67d0-4392-984a-c5707d9b7453", "comment": "Malware payload (Mirai)", "value": "7bd201738b98dde5ef1041025b668e2873366a53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917181, "uuid": "c8cfda30-0d70-42ed-9a83-b35e67eff8b5", "comment": "Malware payload (Mirai)", "value": "90642b218a66b16b0d234d209fed7ac83aae51fe677de54ea08d76376f006e98a7b7a7919f6ecd43f79373a7948f96e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917181, "uuid": "17f5cdfe-d0b8-42f7-8f7a-5a858b82b7d6", "value": "T1CBE33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917181, "uuid": "43eb5b88-6cfd-4823-9d71-9dedf6e58104", "value": "3072:8qlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjXhXa/dOL9eXgIncdVm2f:8qlhEFZBTqPoLmpMguHcUlVUHalw7Wgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917181, "uuid": "c5c82be0-17d4-40a5-95bb-153f5521671f", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917181, "uuid": "f1dc984a-8c02-4628-af03-1a22a0ccf77b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917181, "uuid": "479b3ca3-a86c-4193-ad4d-ee909aecf1d0", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755c1d5f-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958992, "uuid": "55739b36-3380-4e48-9d69-ebad7e817a83", "comment": "Malware payload", "value": "f6c71a68fc36c4b99138eab91b239711", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958992, "uuid": "619fec98-1cee-40c8-a29c-9fad8f4703a9", "comment": "Malware payload", "value": "4f4e989b74a0ab4e4371d8e4b7fe674c0076d380e17dc057d458c044f7784714", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958992, "uuid": "5af9a2ac-cb33-4005-ad93-266cb7ab0136", "comment": "Malware payload", "value": "963146c066cc5fcf7018d48889980d84a3fc64e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958992, "uuid": "afc2ce30-67ad-4a83-86a1-86aeffcf8431", "comment": "Malware payload", "value": "1d35c4d39562e841a9d071d42336053cfb59e24adaff4604de4af209b94518756c81cb07b03cc5db6b8e11177be85a7b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958992, "uuid": "2315ca9e-dcd6-4d96-98d0-95ee8fca02ed", "value": "T18111337C0106EE948448D43A7381820CF0A24FDE28BB8B945E89113D74B05DE7132F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958992, "uuid": "4121c87b-d12b-4c2b-acc7-6547911aa279", "value": "24:HOFmsaFl5tsaFIsaFLsaFAvsaFPsaFSsaFdsaFxsaF4saFAPse:uzafga5aWaHaWajakawa9a7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958992, "uuid": "c1318ee9-0e8b-4212-91d5-5ff516c4dceb", "value": 1038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958992, "uuid": "098327f8-9985-4537-8b50-18171c485a50", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958992, "uuid": "9649162d-e42a-44db-8cda-224d348980dd", "value": "esf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0479dba3-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958373, "uuid": "8827a98f-ea17-4606-bc68-ed5680a72ce2", "comment": "Malware payload (Mirai)", "value": "3bb8e6d0332b32b935502e2bb3883e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958373, "uuid": "2fff4dc2-4492-4477-b12e-618550d6ba20", "comment": "Malware payload (Mirai)", "value": "4f9b8986274025bb2a3e7e47799882dfafebddee09551f902fc947f997e3a164", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958373, "uuid": "7fc41e69-ab58-41a8-998b-2271b65082bb", "comment": "Malware payload (Mirai)", "value": "41aa212ef822892d390aa523a6ab2099ab42154d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958373, "uuid": "212a677a-14f6-4077-b4ce-1e6713838e5c", "comment": "Malware payload (Mirai)", "value": "3d829bb15c7231940a854b880ba00d17fdbf6b7419d9dcec8f3be35f6d8e076e274f57ab18dce6721717b954112aeb16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958373, "uuid": "ef0a71af-d005-4a2b-b3ca-ff70972ebc3c", "value": "T148A2E025D345AEF4DFBF9DA062C1D2C276F943C7238AC8E240EEAF012906046B788C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958373, "uuid": "6e4f4d64-5f8f-4aa3-914d-4f5f1de50ed8", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C55FM4uVcqgw05VxJn:9RxsSVsMD6xiJJE5zRWNK4uVcqgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958373, "uuid": "0f9adea8-86e0-4a4c-8b45-67cdc4ee01f4", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958373, "uuid": "b68d7fa4-ba6e-42ff-bebf-24d644d4be52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958373, "uuid": "476a56fe-c679-48e7-bfe3-699daf503da9", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4969445f-d1e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764942597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942597, "uuid": "096e493b-03f3-46ea-844d-ca5e94858b4e", "comment": "Malware payload (Formbook)", "value": "6c433b8c4904231104c3fb9658a19ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942597, "uuid": "b044a9ff-5ee9-4406-ba9b-b1242aa20ce6", "comment": "Malware payload (Formbook)", "value": "50eff0e919f69ff14a29a3f94c037fdda3228f6bf74d5da14e40a02bd71e2fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942597, "uuid": "8154e30d-1585-4ba1-a4d0-b21d4a052faf", "comment": "Malware payload (Formbook)", "value": "eb5f3e134abc1b4e0e47201bcff83eff65814383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942597, "uuid": "4aa750c3-7c8e-4d65-92fa-84a473e6e8fa", "comment": "Malware payload (Formbook)", "value": "20a8e6ff29c507cb63b8576301b4d8c2a2596fdd7d16d1ebb59530557cd4e2de649db5bac2a953c52903c95021a80b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942597, "uuid": "4a7e0b0e-635f-4fd5-8fd9-05997b06b44b", "value": "T13D55AE02F3418C6AFE7ACD324E67F6111EBC6BD64223A55F029409B9FDB3470762E652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942597, "uuid": "7c3629c3-cbff-4826-940a-73bdb7f6dce8", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942597, "uuid": "78859248-1f9a-417f-b430-5c0fea7e9499", "value": "24576:Y5EmXFtKaL4/oFe5T9yyXYfP1ijXdas3yi64v2Dt:YPVt/LZeJbInQRas3y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764942597, "uuid": "91b55603-69f4-4f75-8a7e-df151240d803", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764942597, "uuid": "c6fd7206-f875-482e-9798-ef06764726ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942597, "uuid": "f7a510b3-ad66-42fa-a49a-92f6931e2ec0", "value": "50eff0e919f69ff14a29a3f94c037fdda3228f6bf74d5da14e40a02bd71e2fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efa2a23-d20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764961424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961424, "uuid": "615b5bdc-bf82-484a-8fda-af56cd4c99d3", "comment": "Malware payload (Mirai)", "value": "ef29825218b41310fe731e79463cfb02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961424, "uuid": "aee01735-f1dd-44fc-bc00-c47f522d4d3b", "comment": "Malware payload (Mirai)", "value": "5125ca8e6f62d315285d88c44567a6379c667d4449d576fb191c563cd51c97b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961424, "uuid": "8d1f40b6-18a7-4fd0-b1fe-3a75bfb2ee20", "comment": "Malware payload (Mirai)", "value": "fc6e9804531f65f361cd59963ed25f7bec54e25e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961424, "uuid": "e8f9ebbd-194e-40df-af96-bd6a7838525b", "comment": "Malware payload (Mirai)", "value": "991a7ddcdb69c6684b10bf72529ab877ce71fbbda387758522fd7023bf4ea4f76d8b3fb5ec9aebf2d1574ca6bd49fcdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961424, "uuid": "33c643e4-44c6-4be3-80be-ae8b224e8156", "value": "T185730267F1D226A7CC7E13308C3F289748B0964CB6A140C56FF624769D2432B77A9997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961424, "uuid": "4295f3df-f824-4c90-b1cd-0b7acec25504", "value": "1536:6fjiFzpLFuwy3HPs96prFS+fo0H8K9yaOEf0U5nouy8ty0:6u1MNVpzo6D9y7fUoutZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764961424, "uuid": "fffebea8-a708-4dfc-b266-ca35c2081024", "value": 76548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764961424, "uuid": "e6d5cb3a-5d0b-4014-8c45-5a2c69507277", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961424, "uuid": "141a0038-3a7d-49fa-9a0c-a1da67ad7791", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dc753e-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958429, "uuid": "60384465-0cdf-41c0-ba47-83c0751fe379", "comment": "Malware payload (Mirai)", "value": "df307eaf3fdd298395dd29937b8a4569", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958429, "uuid": "3e96a0ae-18f3-4d53-bbf0-cdea0dff209b", "comment": "Malware payload (Mirai)", "value": "514d1ed0d89286dedbdbc1faec822cef349016e71b8f164f4918d0d55949ccc4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958429, "uuid": "f6037308-d9de-4c1f-84f6-d414a603e2f1", "comment": "Malware payload (Mirai)", "value": "02357948e028faf898a716789b8971c1eff32d25", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958429, "uuid": "959ae83e-7d94-4de2-8d8a-71c3f20666ff", "comment": "Malware payload (Mirai)", "value": "be2770ebf3ee7490bbb8860eedf434aaec4d3775456666d2cf42b7d8dbdf77bd2177357575bede12719ce2f848847cc7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958429, "uuid": "d82a006a-5dae-481e-b5cc-0787151aae3e", "value": "T19E1151CE115696111C8D4D81B17AC6287946EFF03078CE6D9CCE44F3A9C89787265F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958429, "uuid": "a5aa6e62-b510-45ec-aa1d-c079629e1dfe", "value": "24:lgn7xNI75BKgZiVDf8VuEFtBlAdJadcMHR:lgn7s5BLZixf8DllAd0dcMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958429, "uuid": "0d82aa79-6f62-4be3-9048-fe011c3d106f", "value": 874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958429, "uuid": "8d612322-5f5f-47b2-be8a-2f9474e7646a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958429, "uuid": "40e8da4a-778d-46ef-8056-416d83ac62b6", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167d2934-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958403, "uuid": "fb348647-3e0c-4c5b-b0b1-195b881bec37", "comment": "Malware payload (Mirai)", "value": "e82e48a65b8337b5969c606426ca1ea5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958403, "uuid": "8e0e2dcd-9687-4c6f-b747-28ea3730a0a6", "comment": "Malware payload (Mirai)", "value": "518555a2a7eb7604854e35438ecf89ca2cb9a5f8c86d247e00a86d9221cc5d53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958403, "uuid": "4fd4a58b-618f-410f-8495-5ce885180639", "comment": "Malware payload (Mirai)", "value": "914e501c9d36be264e67b8a127ee1dc41205a751", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958403, "uuid": "b055a518-9335-40f7-86f4-353bc77bc233", "comment": "Malware payload (Mirai)", "value": "5645c32832719818272d648ded742c6d94ec8e958ef541f19b8052cd904706c500bcb9f904ec3115e827cce93271a190", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958403, "uuid": "097c9e85-445d-4b09-ba21-09302dbb042b", "value": "T1BB51B48543A68C3C29A7EF13F6B682383086D0562DEB6F95DAC4BAF90A4FD143540B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958403, "uuid": "64090450-566a-4308-8052-200793d5658e", "value": "48:vh7+7N7hhv6GhgnzPhfKWh1oUh717o7Uhf43bhO9Rh5cghKpVhnSOhD+ChIfThg+:vh7+7N7hhv6GhgnzPhfKWh1oUh717o7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958403, "uuid": "4c9a2abc-9103-4caa-ad57-f0ba1f5e5f03", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958403, "uuid": "261ade8e-fbff-4861-92f1-aeb6e67790e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958403, "uuid": "364ee8ae-8040-41bc-a6f3-d816de627e61", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb333a6-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958444, "uuid": "1f66cf62-c73f-4eb4-98d3-c758b94473bd", "comment": "Malware payload (Mirai)", "value": "94c0d3b6c8f7c0518b5633e681775284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958444, "uuid": "70d49cff-e9f0-4a2a-a0f5-6c9c3318b1a2", "comment": "Malware payload (Mirai)", "value": "51a183d8a25cbc9b9b226f261c980d2bdc82ca571132362838cdb9b71120df8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958444, "uuid": "1a35ffdd-2220-4641-b89e-4f2a784c818b", "comment": "Malware payload (Mirai)", "value": "78f404692f40c4e3967ab3c53687ac65f9f2d307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958444, "uuid": "c29c49fb-eef3-454d-aad6-0657083bf9f1", "comment": "Malware payload (Mirai)", "value": "480f4d9ecd30be7ae1c3391f104f2bbdcad9d7a6336f653126ed4d9ee74ac2d5397cd84bf1b7170e4d53c957b190ae77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958444, "uuid": "60dd1475-fb0f-4c40-8844-1f336695b344", "value": "T174230271850E9DF524303C76DE99A393B6E02A71C6673113DA290A3C2FB5B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958444, "uuid": "ef67a28b-7567-4865-a831-79529c815166", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3az9q3UELbUXfi6nVMQHI4vcGpvZ:DECFd+A6YHAxayLRQZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958444, "uuid": "52c0bb48-1804-4842-959b-3fa6aad3b984", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958444, "uuid": "b7e2bfd7-25db-4a63-8475-c033af0705b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958444, "uuid": "6ce6741e-e05f-4c08-817e-f62473a3e024", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6a574f-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958390, "uuid": "7a2e975d-62f9-44bb-8c9e-5b0c9fb63c54", "comment": "Malware payload (Mirai)", "value": "ff7084e27fb6ea9fdb41cd9965d4b8d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958390, "uuid": "ebe33399-64d4-4715-9acc-6a6d405677c6", "comment": "Malware payload (Mirai)", "value": "52434df980bd1f2ed1f63957dfe5d6b35a76d642e006aa853d3ab24640af11b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958390, "uuid": "6a9b2fcd-f312-4b8f-a2b3-5721c09b6cdc", "comment": "Malware payload (Mirai)", "value": "3dd2b2e1ea7573814e329220df72456458aeae77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958390, "uuid": "60cd1c59-92de-4a75-9bcb-f3ffa39b5836", "comment": "Malware payload (Mirai)", "value": "3bc42bf3cf3c179047f94ea9ce60911ba63bcb503c603e3153fc3c53e4b7a307284ef9cbe9f32574ed05d4ed9e6671ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958390, "uuid": "c1fe338f-633b-4e46-90de-2df40f5aa125", "value": "T1B8C2D1E0B726F931C420AC3EE52B4D8A3A51067C91FF383664258D398FC165A67F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958390, "uuid": "950d6392-22b5-477a-8bfa-0317f639dacf", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrL09q3UELuX:NKy4qfqoeJdXWg5La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958390, "uuid": "49a29275-70e5-4f22-9581-b443f7285387", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958390, "uuid": "42332c6d-f94d-4019-adab-1a05234bb23c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958390, "uuid": "48ae2525-11e2-4082-8c03-b5da189d1296", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b86aeaf-d1c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764930119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930119, "uuid": "5b0c7477-bc9f-465f-bc45-4b39d66540b5", "comment": "Malware payload (Mirai)", "value": "102a1bce15281f8fcd0534c1239629b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930119, "uuid": "9ab28d77-070b-4b9f-a2a2-c2c08d63fab1", "comment": "Malware payload (Mirai)", "value": "52e570b9217cd4cca55f060d1daa12073d6ea37baad6985b1da41dfa5fa983fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930119, "uuid": "e4432efc-0337-497c-b9a6-d83547eaf23c", "comment": "Malware payload (Mirai)", "value": "0a8744b931d5b87ce520008ba5812c1c7c926605", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764930119, "uuid": "a4be8d97-4000-4527-973c-c34610247bb8", "comment": "Malware payload (Mirai)", "value": "6631fc4d6c8a530157a1835a26919a22451f15db23cdf473d57f7215bfe0dd206ae4c734f31eb80f7f04b30866d8ce8d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930119, "uuid": "fa670c04-3f4f-471f-afe5-84bf390718c5", "value": "T15711379F2410E551815CC9413DF2ED07A2455255D3C03B2A54CA7EBBC0D8E0EBE07E4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930119, "uuid": "344e5d16-f426-4ea0-afa5-f14c3f0abee6", "value": "12:78Z2KwZ/KwZ8KwZpYKwZXWUKwZqKwZ7UKwZ7nKwZ7MKTTs:e2Ku/Ku8KupYKuVKuqKu7UKurKuQKTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764930119, "uuid": "638de258-c92b-40c7-a496-f87a2aa25b74", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764930119, "uuid": "ca876ab3-3b26-40a0-957a-a0ccd68d9afb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764930119, "uuid": "7d23b097-f276-4cdb-8a15-d25ec2452c09", "value": "dvr.tvt-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01267df5-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908546, "uuid": "58a23466-a45c-4cf2-8d47-65ba1c7edad4", "comment": "Malware payload (Mirai)", "value": "51b825183583ef9e10fea8bb7582cd4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908546, "uuid": "84fb3007-c7ab-4882-82be-3c30771937d7", "comment": "Malware payload (Mirai)", "value": "52ed63333727a4940e8aec24b0140e3d4e5619a319e99a705db809144edc3b41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908546, "uuid": "332fedb2-59d7-43b7-bd8c-aa638a06402b", "comment": "Malware payload (Mirai)", "value": "6641e2cdb015cecf99fbd76fa142dbcba5ffb658", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908546, "uuid": "df685b2a-625f-4771-840c-2009c6139794", "comment": "Malware payload (Mirai)", "value": "53555545264191463ebd0b6a6fd4bb63713996caaa91cc7f6019a27fba7c4028a222db62a46a6655e6ec998b545f5452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908546, "uuid": "e7bb4183-4d11-4952-b9a2-3d79020a1cc1", "value": "T111732781B98B81F1E4238870956BB33F9B70DB584131A61AFF569F7EDA13B4152263CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908546, "uuid": "d5f75e9a-5737-4fa7-9ad9-0afa1a1f0bd8", "value": "1536:UzZ2zPhy0MR3xyrw7D/lgvWUsUVucWVjItRgAPNAZk0cUSwVXI:UzZbBqqlgvWUsAkV8tRgA+ZlEwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908546, "uuid": "7898304f-fd74-4959-983f-4c5a233b3998", "value": 76416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908546, "uuid": "92681152-276c-4fa8-bcc3-b1539b79972c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908546, "uuid": "fe74d556-85a1-42ab-9f52-f860fae65812", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fe734b-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943962, "uuid": "df40d243-d5d4-4707-b451-6ae28e9bda9d", "comment": "Malware payload (Mirai)", "value": "21a8fcb48198da9baae1ea2eba738796", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943962, "uuid": "890c0647-958c-4777-9edd-0a04d1c746c1", "comment": "Malware payload (Mirai)", "value": "53b36043164bb36ecde561c0bba63d781f21c76a07fb05fbc36ec598bf8e62cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943962, "uuid": "366f2a37-3a0f-4856-bc5d-09121ece8d59", "comment": "Malware payload (Mirai)", "value": "dadf29bc9bae73b5228fe22e371c65a3384cad22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943962, "uuid": "595bd2ea-844b-4a56-b31b-67f20a701606", "comment": "Malware payload (Mirai)", "value": "e9ff70c339daad313ddce07efdffcde0c3fc1f77f940f9f5987c12ad123173fdf254c930054e008bc11837765a763e0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943962, "uuid": "4187d9e9-a4ba-40dd-a0d8-2dfe5bf147a7", "value": "T16054235BC029CC78D9673FAF5B553260ED1CC54D6153CCA702AB3B534AE90CABB229D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943962, "uuid": "86693348-b4df-4e3b-a169-c3622e3edab9", "value": "6144:cNyfGulcsfTgm42YPuejIKLmrnttD1iJ5RkNZsnHNBmw:cN+NcysmzYP6kAbiJbFtBmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943962, "uuid": "d7a2f15b-30d7-4b2a-a236-71ce1b6f0148", "value": 281300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943962, "uuid": "4930cfbc-1de5-4c2c-a4f4-c4d4d816d75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943962, "uuid": "d7408eed-f0d6-4fc1-bf08-c8237be65f79", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea8abdd-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898287, "uuid": "e44c849a-a299-4d39-971d-1aeab83b78bc", "comment": "Malware payload (Mirai)", "value": "ca6a18e8eb2bb25a097eee0baef664ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898287, "uuid": "4556614e-0020-4bb9-b79a-24c59babcc7b", "comment": "Malware payload (Mirai)", "value": "53e5df8ec0f445bdd0c06b74b07a32e0d9656e5312b5d747cf0c062a1d9c15b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898287, "uuid": "e1db9869-75e0-444c-a3a8-7a8f5fe5c25d", "comment": "Malware payload (Mirai)", "value": "35f596478dfc6e0a8c7fc1d678ef1e7208b77bde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898287, "uuid": "6250a049-a198-48c8-b679-a5f08b0e5a57", "comment": "Malware payload (Mirai)", "value": "b6ca531de96d8926926ea6d926925161102e94f7c0b104392ed6c16bc78e6f4e523663d596bb3206a3a21cadd5588373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898287, "uuid": "b145dd13-427f-4400-91a3-1f54b45f6229", "value": "T1E9A36DE6F400DD3DF84ADBBE40270609B930536527A30F3B96AAFDD37D321A45A16E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898287, "uuid": "ffab5eb1-6349-449e-890c-140b21fa5d75", "value": "1536:ZPy7LdY74yecNk0PAP72iePt8NQvBK/jGx9UZMDX/6KswnxCCU:ZW24fcmIcSiePhzxua7XxJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898287, "uuid": "3385e45f-5f5e-4061-bf65-b5a9f830a124", "value": 102012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898287, "uuid": "d3bb3862-6544-452a-96d9-d15ca1739def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898287, "uuid": "7c9c8e34-65b2-4791-8cbc-6bdf4a68640e", "value": "UnHAnaAW.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f8d9e6-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920045, "uuid": "13eb9245-1de1-47d7-9075-59f5702fb3cb", "comment": "Malware payload", "value": "89b73b17583303badf2c7763d4edd827", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920045, "uuid": "15a3147c-fab9-42d8-8bef-a725fc7493fc", "comment": "Malware payload", "value": "53f30f0468657b264bfa73ba1b30c1f50c4fd8b81f868e18439198f8bdd44d42", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920045, "uuid": "5ac21978-b5ab-413f-abc8-22b2b27be683", "comment": "Malware payload", "value": "3851865c66705e3e14052c87859cd6b2314d6f50", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920045, "uuid": "cfb0cd6b-abf3-48e5-9635-e943797ad574", "comment": "Malware payload", "value": "f614856c84c6d254864e0cc2742b5d7a13e2351dc711188cecf775a67f6483ae3c3c50cf3bc3eb9f7104507b4bedd3c3", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920045, "uuid": "15bc7d86-d7b7-4b24-92fe-952ebd76dd72", "value": "T16C35021589C86FB9DF9C4D19D0FE161E53F14A8A902671CEEB33BD47AFEB8084207199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920045, "uuid": "b9ce46a1-c121-41aa-8f83-e6f639ce5888", "value": "24576:GTw6AhfhLVsRDG+q68wObsdawBB/1xPo1pnz/eev:G0KDG+q6PlBdpE5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920045, "uuid": "f7fc2c36-d267-4dfa-b6a4-2b277e96bfee", "value": 1104804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920045, "uuid": "f7131a3a-dfad-4591-912f-2b886a9bec3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920045, "uuid": "a8653e8f-72e0-441b-8017-8f781a979314", "value": "53f30f0468657b264bfa73ba1b30c1f50c4fd8b81f868e18439198f8bdd44d42.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28303ed-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958665, "uuid": "38725f0a-35cd-482c-a217-1b4b84335524", "comment": "Malware payload (Mirai)", "value": "4c9835562b7749e4b31ea16ece5781b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958665, "uuid": "fc2b145f-9eb7-4b2c-9e53-465dc2396618", "comment": "Malware payload (Mirai)", "value": "5499849bc10cfabcc10aef14afb01c1dd28462c5d953e0dfe5f48f2a75f00402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958665, "uuid": "4343f685-ea10-4ecb-93b6-9f8c12e70dcd", "comment": "Malware payload (Mirai)", "value": "3a23376298b69d743e1454d780472d50dfcdc01a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958665, "uuid": "e8839ff5-3b51-4458-a55d-7246148cb43e", "comment": "Malware payload (Mirai)", "value": "f15499afed549e5cc784bf9f40fce619712c15d43897c925bc37e2e98c659d8e5ee036aa1911b0e420d4a0289dc7ef57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958665, "uuid": "7300e5f7-95e3-4d16-a3a0-88eb9c83ef59", "value": "T17E431891B8819A23C5D4137AF56E56CD372123E8E2CF7217DE214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958665, "uuid": "9d292fe3-2af7-4e4a-b43b-25e36547346b", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958665, "uuid": "de6c6844-76a7-4206-b346-cceb6bcc5c4a", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958665, "uuid": "2971bed2-20d7-46e6-9959-a05b2d3c15f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958665, "uuid": "90de7db9-f851-4686-a4c9-cadd0a858696", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000668d8-d1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764945910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945910, "uuid": "2a1e693f-b038-4acb-8fd3-46d290f1a7a8", "comment": "Malware payload (PureLogsStealer)", "value": "8d39a88f69ad6f0aa1002ff4c7f30f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945910, "uuid": "50875e81-592b-45ef-abde-193d63c03c7d", "comment": "Malware payload (PureLogsStealer)", "value": "549a2ef27e60dc1550032622ce3c85b5b5b3fdceabdfc318342f1c24e55614bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945910, "uuid": "83d3ab81-f518-4f52-8e65-bff83ad94a65", "comment": "Malware payload (PureLogsStealer)", "value": "7e91b66544d9c37add39d2816106c993b859c953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945910, "uuid": "c9a54c22-9088-405c-ba54-e7546332a4b6", "comment": "Malware payload (PureLogsStealer)", "value": "8fe8f6efd75167b39ed8f6baf1d3df1c70dea9875793b8086eb70a1a262cdad3d3ac0db6017b8f1f1f406be57200a4ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945910, "uuid": "736582e8-0972-404d-8e05-a8d75fe6ea63", "value": "T1663501893250E5AFC953C9328968ED74E7146D6B971BC20790DB0EAFB50DA92CF181F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945910, "uuid": "66073450-ef33-4ef9-8f95-3b2d402584e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945910, "uuid": "27f89983-801f-439c-b118-e2a5b2f551d3", "value": "24576:IfLQQmY3mGF2EhI4sAVsAeNRi4jxc9kFJi0bydffmsnHTs7aG:xQZmGMEhIBLJNRPCKwffmsnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945910, "uuid": "f970d69a-ac0e-4219-8947-fcc1131a7c59", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945910, "uuid": "631a3675-2456-4d88-9844-a1e5b36a57b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945910, "uuid": "4a69e7a1-bc4e-44ee-8525-f0d7692c0a41", "value": "ch\u1ee9ng t\u1eeb v\u1eadn chuy\u1ec3n_8009377622.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17fc153-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959495, "uuid": "0a0cdc9f-59f7-4bd6-a708-ce35712e61ff", "comment": "Malware payload (Mirai)", "value": "6ce25ee901f2b56d27a1c736caf14c24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959495, "uuid": "ed42823d-1ad7-4142-bb66-7949394493ba", "comment": "Malware payload (Mirai)", "value": "54fb2b8e9f4cfde8fa4cb115c2836d2cfaf273f39b9c40a45f557eae0a6f3f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959495, "uuid": "84eef59b-258b-44cc-b00d-a530a0f4c977", "comment": "Malware payload (Mirai)", "value": "f68af39422cef4b1a03c12dc90256ce17d8ebb39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959495, "uuid": "b7ecc1f1-51e6-4d15-a486-a30d112c6882", "comment": "Malware payload (Mirai)", "value": "0a1148ce9b5acdeeb800f451740c8ddd1dd2ccf77a2712c991e0128728ed30e00cfba72c47ddd25cab7be12eea2595e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959495, "uuid": "248ab113-5f43-47a6-9963-ca0a12bd8f68", "value": "T112735C8062A3D5B3D9432B7C11E7D7360932F427677EAA4BE39C6EB36E02644710E319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959495, "uuid": "1cde35a0-36aa-4595-9fa3-26f4bb95f342", "value": "1536:ZOqu4uIRiYbYcE0VZz+VcU2T6u1WLtUFZXImXR2a7zD5Swqm:Mqu4uI8azxYcU2eurfBfDo3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959495, "uuid": "b22be704-e5bf-4ca0-b8d8-fdc50f99da22", "value": 80350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959495, "uuid": "401979db-bc5a-49c0-82e9-f163a70e7ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959495, "uuid": "2ee1bec3-6990-4b83-bf9b-1aeb77cff93b", "value": "Omni.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710e8498-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955978, "uuid": "a928d0b6-5565-41e0-9601-0742b51c53f9", "comment": "Malware payload (Mirai)", "value": "81cd2d1da37a8f298927fdd9f7c2b16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955978, "uuid": "77466de0-d33e-4603-bc08-3832cd4e1f3a", "comment": "Malware payload (Mirai)", "value": "5568bd67ca3028a3c1b395294ddf6664bbc75f74f78b1667b2fbde971a083b87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955978, "uuid": "d71d2531-fbdd-424d-b6ec-8ad8470d9f4b", "comment": "Malware payload (Mirai)", "value": "2abf4d4545e4ca1e18a1945cd3e552fdd08c67dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955978, "uuid": "174d5a0b-33a9-4efe-8b1e-3b0a8aa90df4", "comment": "Malware payload (Mirai)", "value": "c94b27a6d5a0213aead5b56d4270178d210234f8c416f1fd145b12f98d4dcd08a60b4c8782302db474f7774a27c6882e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955978, "uuid": "d145d8a6-699d-4e86-927c-584f5bf42ddc", "value": "T1499312CFA80D395BC39D7D37AD1B0D36CD851E967E01025813668E0ED337A5D6221FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955978, "uuid": "6a571403-88c9-4cec-84c3-6e73b240ac78", "value": "1536:rEhtGlecnldlJyE9lKzdCxb0iGQH9dlK1O368xM/5h3cCtZacZviTiLLp3fFQ8vi:4htGlLXv3K5Cxb0Bo3uT3Xc2vUiLLp3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955978, "uuid": "531f00da-ad8d-469d-a550-665e34e058be", "value": 91536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955978, "uuid": "958c7224-6dc6-4d3b-9d2b-8a7e546f9518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955978, "uuid": "5e5bd1ea-29d4-4635-a858-a734c74c1586", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d353ca5-d1cd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933906, "uuid": "788bc2b2-a3ee-4743-8b46-cb6812f1e63a", "comment": "Malware payload", "value": "866c5e8f9399c29846a29eabfd7133c0", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933906, "uuid": "b382b382-3ea5-49d9-8673-e0ec7f09ad5d", "comment": "Malware payload", "value": "556b5b4b36e15b0511f12b675a1acd66dd6c4552f5769f7661c671d1d2a6300a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933906, "uuid": "21581a38-78e4-47a2-a1a6-e23eca90eb79", "comment": "Malware payload", "value": "ca3c0e77b5b545395262f3b78d46c13131420d11", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933906, "uuid": "2ad2c0f7-c9e1-4041-9d4a-bcc2e432493a", "comment": "Malware payload", "value": "c953e05e203081a32571c0ff256e32a687d606ef79e922434636f8763d2711a1e373a0fd67e4d7a976cdd1b9e606a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933906, "uuid": "08585734-30c9-4c2a-a1c1-5088a3826774", "value": "T1DAF37E7AF6956CDBC42281776C3DD5301E0CA9A003A2D9D174ECB3798E236897B4B6F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933906, "uuid": "f18c0189-fbab-4974-ab79-a3d467a86d9f", "value": "3072:r2t7bsqWFy5qhC6D7bXhZJpHp3gplitx6xLNJFjpbme4nTnjq:re7bTL5U/LhNCplOICe4ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933906, "uuid": "5207f67a-d727-4c5d-a3d0-21bca99f33a7", "value": 168907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933906, "uuid": "b316217d-3098-4157-b399-ddfa81f787b1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933906, "uuid": "ef7ba2ad-f134-4c84-a88c-a3559e9a7ade", "value": "SecuriteInfo.com.ELF.Flooder-ABV.11969419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391c18a5-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "5fc3230f-7c08-4817-b177-3cf51ee9bd98", "comment": "Malware payload (Mirai)", "value": "0c35f57774b505c076496b5d12bbc985", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "b6224ad4-5958-4698-97d9-2495dc825e5c", "comment": "Malware payload (Mirai)", "value": "5676f76cd21bab8c9dc8434469938707e9d8cf2cf0b8ac5ab047f13cb40dc706", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "e81e6b5a-6653-43c0-afa9-ffa67d67f048", "comment": "Malware payload (Mirai)", "value": "5a740814107c1c7f5ab685e5ab71bb392b8ef914", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958461, "uuid": "003872ed-196b-4ea3-935e-0d5e52a57f50", "comment": "Malware payload (Mirai)", "value": "6adc2f44266e7fe2217631cc9abb41cddeac2a29e01ad457a50e8468fecd92c0c41c0cabf987ef01d6fd17cfe353d15f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "d93dbc59-4cba-4ea6-a3ba-332881fc1337", "value": "T1A6E0EDBE08AADF2BC1049E41A0692437A13797DB9772CA04BEC8B52679D89103233E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "af656ab6-675f-4f69-8972-02f5dc30e462", "value": "6:St5/nfiD/Ft5/pFGNIvLKaFt5/laLU+yAFt5/rHGLqFt5/wk2fbFt5/Mj0:Ahf8hSNITNhlaLBfhxhA7hMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958461, "uuid": "0b081282-8b8e-4532-9d0b-b076301e3d06", "value": 421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958461, "uuid": "4a8a12d1-9076-4b20-9f94-1dead921dff4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958461, "uuid": "dfbd5568-4ba3-448c-beac-a41b6d8adcb7", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63005182-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931044, "uuid": "be104c6c-bbb5-4468-b674-b0cf53ac14b5", "comment": "Malware payload (Mirai)", "value": "89676ce4c38087762ee71dbed43fd55f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931044, "uuid": "00cb026b-9090-4b3b-83c2-7c4744c50c7a", "comment": "Malware payload (Mirai)", "value": "56acad3daff8044cc497aacc15b72f292b25dc5a7a0f0fe2b1127468a49d045d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931044, "uuid": "292f47ff-fe42-41f8-9f89-f31ed66e9abc", "comment": "Malware payload (Mirai)", "value": "56a133aaa77db217c299c5fdf241bea7e773be84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931044, "uuid": "26794a7b-abad-43e3-b6c9-08c817f5e7d7", "comment": "Malware payload (Mirai)", "value": "4538e6d1cbaeba1574d4b6c196cc41627cc400ce63fa1d6e4584baaffbe0eabf57d67fef76064cbe8adc7946012e6f51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931044, "uuid": "7d0d6b9b-e70a-4354-a2dd-8072e5065efb", "value": "T12614E95DE4608B3AC7D1217AF795428D33735F28EBEA330989256B343BD76295E3E201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931044, "uuid": "e12636ad-6622-4eec-9f90-14f6af905875", "value": "3072:rqsYZPDmLKJullvgIEEWVWsL1NrUU2dzYsVs17yHcs+7GH:rqsYZPDmibIEEWVWsL1NrUxjG17yv+7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931044, "uuid": "144dd920-415e-4425-a8c6-7f0c13668729", "value": 196352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931044, "uuid": "ec994e99-9795-43b6-a3a6-7abeeb64536e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931044, "uuid": "c926ccfe-c13c-424b-b746-df0ed486cb93", "value": "armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0735132-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951763, "uuid": "7414e2b5-59db-4fee-bce6-2983bba06b35", "comment": "Malware payload", "value": "920e086c3e64832b7a90d09cebacebf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951763, "uuid": "4f18df22-a12a-4780-a240-d9eb202345b6", "comment": "Malware payload", "value": "56eb6afd322ef89de23aac3f5b7247a8d0f0b2db508285967e1de242e6050af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951763, "uuid": "d6e6d6f5-d23a-4270-97fb-85ee1215a1ff", "comment": "Malware payload", "value": "03cc649683d691d981d6bb5e3b48df1fb95aa453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951763, "uuid": "24799b46-dc8b-440a-83e0-456e24eef330", "comment": "Malware payload", "value": "b65abc8700555c8bfd103d0737c7e13ffc6e5cb5c357bbf199ed598d506d3cc03d736af0bec053d18b3ea471f51f1940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951763, "uuid": "dfade2e8-f0ac-4bb8-85c6-49f713cbc1cd", "value": "T1601833397EB8E86AC02BF07E8FFB16B0683B22D76B44F317545B96CDC5986624135132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951763, "uuid": "74db33d3-96d3-4edf-8cd8-c87eb07e3e96", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951763, "uuid": "7de6704b-1cd6-49db-bc41-52d91e264b3b", "value": "1572864:iZ+BWMFDe45kIMvVDC6hDRVOPXO6jGbLieBfPKPER1C3m6MKPdgyrGh7lA:iQBFle456D1hDRVAO6jGHi+PKPk6MKaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951763, "uuid": "c4f65d01-d029-41ab-a07f-a574f062083c", "value": 88070849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951763, "uuid": "216b3b68-967b-4eea-adc0-16d5d3e6fcc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951763, "uuid": "d1882004-0366-4ba1-9f84-2603dffe606d", "value": "Spine Setup 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773fb76f-d1bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926783, "uuid": "1f750aea-da9b-4353-bd0a-1516fc28693a", "comment": "Malware payload", "value": "18609f2813fe85ddc5c6f028b9aff375", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926783, "uuid": "b51f8f16-6315-44c5-9874-bf70b51604ea", "comment": "Malware payload", "value": "56ed655246824728eab0cf6edfda2e75b000e02195b36f3830476a5e5711fff0", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926783, "uuid": "8a25bd28-d139-4530-9877-ca1482f06125", "comment": "Malware payload", "value": "70d9c04151ec93db3b4d13d5cefd99eeca16eeca", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926783, "uuid": "3a2926a3-a7bb-4c50-9e81-a9819e000164", "comment": "Malware payload", "value": "367315e0b7e02828e20280d4053c64609ec1830d7f3612ac45dfc5e046098faea8e1928e6daa41c806105ae5341442bb", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926783, "uuid": "cdc688af-0fb2-40b6-bd5a-a35fbdb2244d", "value": "T10611EB43ED10C975A437117A08A6D90DFC6C15630692DEA2B88C016F1F3DFB588A40C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926783, "uuid": "7130145c-8845-4717-a206-e6516880e03a", "value": "24:5ohXIWoeVMM9VFpLc1pB/pzF9YMW+39YMbY4miMp:04He3V7LGT/RF9p39Cflp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926783, "uuid": "ed9fa235-019e-45d1-afe9-8d4d461b74a8", "value": 953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926783, "uuid": "bc8d525a-0af7-4511-b6ff-79465a6f8474", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926783, "uuid": "1eec25aa-ff44-4abf-9ff4-967b549861da", "value": "roi.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f26e1-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958896, "uuid": "01829381-fad1-43c1-b04f-6bb2aa019d53", "comment": "Malware payload (Mirai)", "value": "17f5054aefa3774d11182c1d0ee4d9df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958896, "uuid": "4fc0eb38-4c56-4f5e-ad82-d1dc7cc9267a", "comment": "Malware payload (Mirai)", "value": "5745815ce0145c5fe6ea287c6f86381ae72ba9d141f64412877f7c3bd4ad0dfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958896, "uuid": "68d8f34d-bb18-468d-8b1e-8eafc817794e", "comment": "Malware payload (Mirai)", "value": "e0c08b2860f8b4f9e4b5f94f839093578e44816b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958896, "uuid": "a5d32ec3-5163-4171-a5ed-93525b6eb892", "comment": "Malware payload (Mirai)", "value": "61344bb70db8d7c6211438169f59f7c55eaa7496fd98e787f9d9f85e8a7ef2bbc345d1032d7ee60d596f948909ab72e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958896, "uuid": "1abf257d-0a0b-4f52-8264-0ac021ecb5bf", "value": "T1E653C61ABF610FB7EC6BCD3B06B91B0524CD510A22E93B357E34D918F25B25B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958896, "uuid": "da8bb2aa-1591-486e-9703-f686261d6241", "value": "1536:IKMZG36PgmiFZngshOSHHhu/w0I+7VyXUsz6u:I7ZGKomiFteghNz6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958896, "uuid": "f42ddcb6-b030-43d5-a898-633456d8add1", "value": 65628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958896, "uuid": "a965333b-db72-45b4-bbda-30d430b60076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958896, "uuid": "33ac10a6-61e0-427f-a650-1485c5734605", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2263b782-d191-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908172, "uuid": "92fb3a44-e3eb-40a9-adb2-bb02fa437254", "comment": "Malware payload (Mirai)", "value": "2215a367d11b22c85e88f9473cc2dbf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908172, "uuid": "0732b870-13bc-4800-8e20-05b393ed838f", "comment": "Malware payload (Mirai)", "value": "574756f3e9e054d464fee7d6f2b0f299159453b7b75823aa30bb576ac10c6419", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908172, "uuid": "c06aee0c-0242-44ba-a638-2a892c1c9fb2", "comment": "Malware payload (Mirai)", "value": "f96500eae2cf2171049e8a30d3b8cbceb15f0191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908172, "uuid": "4dbb4390-22cc-40f8-8fb1-28283784e701", "comment": "Malware payload (Mirai)", "value": "a233044413208bd904efc49cea476365e3a69dd31490e258c48971bbcb27a76b16c0026002e11b65d0097d924fbd1e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908172, "uuid": "64d3470d-26f8-472a-9bb3-eb7c1e52d9e1", "value": "T19FB3FA0ABB614EF7D86FCD3745F90B0635CC9A1622A83BB53574D71CB64714B0AE38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908172, "uuid": "218abf66-a99b-4963-bc0b-1b71d27cedae", "value": "1536:LaSF1bboyw8RiDF04CCPU1lbpmFMFF4LvJptWsBb2jXZYKPNyKRY9Fik0QmSEi:LaSFFMiiJLCCUbpmSssXclAlQ7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908172, "uuid": "e284c120-2ec7-4082-87bb-83798870ca79", "value": 109768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908172, "uuid": "9c10d999-5a60-4252-a143-2be991acb367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908172, "uuid": "bf183385-e47c-4a0c-8a0a-5f7bb8481e5f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b3dcae-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933654, "uuid": "28021a99-5809-4a22-9dff-297f0f045740", "comment": "Malware payload", "value": "f86cfefeceb454316c3a3919aa212532", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933654, "uuid": "6faae2f5-0c1b-4030-a936-96f1c99d3405", "comment": "Malware payload", "value": "5760d35689cb588e11abd49b445e1096fd88369ffa55ab3ee0e7231b3ec4410f", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933654, "uuid": "deaba1c1-eb4b-4e88-9c76-5d1c30cb28fd", "comment": "Malware payload", "value": "5390cb2fe51e8ed2ad70451523ad4e4f2aef8db9", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933654, "uuid": "d6ec3529-0a94-4635-b0d0-ecc25aada7fb", "comment": "Malware payload", "value": "862c0015f7cb92bae4d2d6dfb6b209d3a3626f6e352fea1f9fc1eb5722a15c1111cc473d397805e7653a76a3c2bf0fe0", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933654, "uuid": "3912284f-9473-4964-8528-55c67c1fc269", "value": "T17775337A13594C0BF92D75F20796C5BB6E14AF6332A6EC2E422D503A20D27DD9F2520B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933654, "uuid": "eeebdd80-574a-47a7-b321-79e360083a44", "value": "24576:TzHwOtQx1YqNpfysr/7Tm15zicI5QZfYUjLyiYFRpDdoxdBtHUGBSMogjhhzZ+:PHwNcqNpl7SzBIiZQUiiipZYdPHfB8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933654, "uuid": "da66bebb-f936-472c-ad4f-e6a4a6547839", "value": 1692888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933654, "uuid": "2a9da5cb-7443-43ae-9b74-abf15a696dfc", "value": "application/x-bzip2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933654, "uuid": "c9857ff1-45d2-4931-aaba-b72f0751fe4e", "value": "filmora_setup_full5536.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fb7037-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958966, "uuid": "8f62accd-3a0e-4c8a-98d3-f32eae31486f", "comment": "Malware payload (Mirai)", "value": "c2e4e541f85dd503e5a9cf5f8b785975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958966, "uuid": "7af31b3a-24ee-4e97-84a0-b249232990b7", "comment": "Malware payload (Mirai)", "value": "58047ae1e9f63fefde5845b580d3a98486d34b6d63279d6ae5170c0f02587d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958966, "uuid": "cd675dc7-6cff-434c-9bf1-f85edf213312", "comment": "Malware payload (Mirai)", "value": "1bd11d1b5be0a3579d686187ea9234fdf1222d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958966, "uuid": "cf06d04f-e02c-4614-a462-e8bbdc0c7c51", "comment": "Malware payload (Mirai)", "value": "60c9bae32ebd052b5165447c44b0a9b4d1803f200f95d951bbc438867471c9d72724166fcbf883c4eaf43413abd2cb49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958966, "uuid": "fc6de3aa-b4aa-4de3-a279-e3bc93332904", "value": "T12D334C21B9752E17C4D5B8BE31F34724B2F61B0E26A8C65EBD720E4EFF10940611B6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958966, "uuid": "cb5dc99e-d3fd-4dcd-9f23-0f536a715b30", "value": "768:abmo+q9ATOQmGsL2pVPJkgihVWkUINa27knO+pHnLYUneeb4:OmjSACQmGsL2pVPJMhVWwNaGk7pDee0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958966, "uuid": "125e02d0-4ea3-47a2-8d39-cfde52fc6c20", "value": 52304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958966, "uuid": "232868d0-1354-4b91-8461-442048bf6c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958966, "uuid": "bc32a9c6-8c24-4d0e-90d5-6aa7a3716edd", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa1f6d-d1ca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764932847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764932847, "uuid": "98b2015c-aa58-4cac-959c-6bc0749c44f5", "comment": "Malware payload (Mirai)", "value": "c34172c6ea5f5d5ad2894e291b94cd7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764932847, "uuid": "7fe3d038-f6f4-4793-829b-b913b2a2cf67", "comment": "Malware payload (Mirai)", "value": "587c377656cfe5b817e1969679f02247de6b08a80859c32d77da523075c2a8bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764932847, "uuid": "fd5cbf23-3f94-4d18-9d85-81f22059c5e4", "comment": "Malware payload (Mirai)", "value": "ebc6e048cee15a9baac1624d85ec42663b061184", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764932847, "uuid": "84f9b981-2416-48a0-b4dd-9f73defcca15", "comment": "Malware payload (Mirai)", "value": "3a8bf7fe6aea82f6e4eb6655d14e23395db315f47a7c35df3df85e7ae1d891dd1cb830005190231368c8dfb4e0703d5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764932847, "uuid": "bc77bccc-6402-4e6c-bb3c-a8d299b55eee", "value": "T12211009E3D10ED92BEA8D700F9B7F5A4E144824712F42B1CA1CF8F7280A9E183502F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764932847, "uuid": "252bce4f-302f-418e-a322-de629865bf88", "value": "12:78ZYvsLZpvsLZCvsLZpuvsLZXW6vsLZcvsLZ76vsLZ7RvsLZ7Svs7o:eyWFWgWpEWjWOW7IW5WMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764932847, "uuid": "dbe85c37-98b1-4014-ba6c-61edc874fcb8", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764932847, "uuid": "db48f8ff-e18d-4687-9052-e4f8b9cd9f49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764932847, "uuid": "12ff1e20-585d-41c2-a262-0d27be98a296", "value": "router.dlink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cd4c99-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908547, "uuid": "789b5ef2-3b23-405e-91cb-ffa005052f6f", "comment": "Malware payload (Mirai)", "value": "ddacbdb863ffa3188fcd6926de1e3270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908547, "uuid": "669cfbdf-7707-4ef9-aa1e-19b06e7ec274", "comment": "Malware payload (Mirai)", "value": "59e8d17000d2a54bb2884727a8be8f69e6dc53a3093ad81d71feec4a5b53b906", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908547, "uuid": "20e8e025-6d10-4e36-a8f3-8244b7dd6e04", "comment": "Malware payload (Mirai)", "value": "5629f573f4bc2264ff82302b67ecadc21df1a8e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908547, "uuid": "57be399e-f0eb-43d5-85a1-c04243f98bb2", "comment": "Malware payload (Mirai)", "value": "dcb389bb251e0e9894211d283c81c2346404f674866165fa84a912dd8d8e82543ee1e4110dc54528ee3322baa8c39931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908547, "uuid": "b11217b8-2474-4120-b04e-a942731d7178", "value": "T18BA2D0607137C9B2EE702879FCB8CD4517C768B5A2F3A172650A0379B9DB51B19A4A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908547, "uuid": "511aa509-5f22-410e-86dd-2422d79e722f", "value": "384:64akmpTf44s9cflVACzysEv3ySmBpS5BiavWncfo6CtdAhqy2MhhymdGUop5ha:faPpf444cHA9sm35R5Bi+3atdtus3Uog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908547, "uuid": "828a4bfb-02ba-49c8-a16f-2c515b781501", "value": 22128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908547, "uuid": "330c5135-22a7-4c90-b8a6-124e8f8af791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908547, "uuid": "2d3314ad-c86c-4d05-9c2c-43edc427a714", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9616dd31-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944014, "uuid": "8e9e30d6-ffd3-4922-a66b-c43e2a6a97e1", "comment": "Malware payload (Mirai)", "value": "335a7505bf2e036d792a742c2b0ce087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944014, "uuid": "5bb071b6-ebf9-41d6-90b3-041789663e30", "comment": "Malware payload (Mirai)", "value": "5a161671b03c130df0724b2cb4982c6a19f02dcd6503a1da20abefd506e2be57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944014, "uuid": "82d90eb7-5b9f-4361-bb56-70eae48fabe1", "comment": "Malware payload (Mirai)", "value": "9a4e8fb9e89d56ce440c7ebfb04614bffe78d9e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944014, "uuid": "51e149e2-5d7f-4a26-950f-50a6504c9d89", "comment": "Malware payload (Mirai)", "value": "ddc88603f8741023d3a54bab0aa6d136e052d8b26282e5fb7a02079137cbf712b9bf2d2a4392aa32aa2d5c2ba52e3627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944014, "uuid": "bc0d8d68-7e63-4491-8c67-966163114fd3", "value": "T1AFE44A02FF846FEBC46FCD70492EC35715DCA49752C1A62A71FC4A8DBA5D25A0BE3098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944014, "uuid": "98529977-cafa-4526-baa7-3e19f3de48ed", "value": "12288:RcZpt96C8mBW6DMyv6bzx4e9j9eOMtMWOdGhwVjyxPRBJ3RkfOmQuGiwzdADXEGI:gYDsWpNfUXpd/Xw1vtXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944014, "uuid": "8e4b474d-229f-4f86-8e5e-1ab408dcce52", "value": 695852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944014, "uuid": "a439a2fb-4e4e-44d7-b138-efe6df59e908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944014, "uuid": "9b047aed-a399-4462-9766-91dbb2df3947", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d71a4f-d1fa-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764953466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953466, "uuid": "ec5c6943-4cc7-4180-bc4a-57ddafb9cc49", "comment": "Malware payload (RemcosRAT)", "value": "f1f12ef80d43b146cd7abaea586910d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953466, "uuid": "3ea67968-84ba-48c0-b960-edd93a54f259", "comment": "Malware payload (RemcosRAT)", "value": "5a5829cd3c34ab4495b0796adc335e81e2808833cfe685eede9ff1c9302e751a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953466, "uuid": "c8ef95a2-f571-493f-adcb-a95ede8f18fb", "comment": "Malware payload (RemcosRAT)", "value": "1eb5b2841ec14366359588051fca1e8eb84a3518", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953466, "uuid": "44821aa7-7071-460e-8cfc-6401de2cb631", "comment": "Malware payload (RemcosRAT)", "value": "6b3845a028a6aba8fdaacd87feaf687a103a67b7a122ae7759200cf1d61dfa7206625973921523babf8a9fc5b8136d1e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953466, "uuid": "9f3d6f50-a6b4-4aa6-b8e8-2be26d68407d", "value": "T1263461A023C8747413436FB6370FF0D4FD5B28AE3858485BD175BC69BA72626E6E1A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953466, "uuid": "fb1b6fcf-b096-4221-9c3c-addc3021e019", "value": "3072:x2kEMbJsf+W3quoXEQk7JFkkoqVfXgf3+TX+T+1QLt664Vw1/Tx7pS5bPMh9:xPrWlQUloqVYf3Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953466, "uuid": "53126f0f-670c-4d68-867c-dc408d399ad8", "value": 233134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953466, "uuid": "99918d9b-824b-47e4-bfc0-0fc6c3ebc3cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953466, "uuid": "619a924d-1db7-460e-aeee-eac1b5762b0d", "value": "enquiry- 1- 616195SFMS 2025 RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960cd272-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959047, "uuid": "b6c1d77e-0fb0-4dff-a340-d574ca39acfd", "comment": "Malware payload (Mirai)", "value": "efd84973efcb4acd068006758a2ec5cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959047, "uuid": "b50213b5-ce23-4b26-9a03-21ef856dd00e", "comment": "Malware payload (Mirai)", "value": "5a5994d0b2b7a435c385482cb8359d3996b0f70cac2a48b51b420473999cf031", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959047, "uuid": "7b74c27f-05b9-4897-b8fe-c1a7ecd4012a", "comment": "Malware payload (Mirai)", "value": "ae54be5b9ec129a696cfa7a9cbec91df5410599a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959047, "uuid": "7519ba3e-c78f-42d7-8ad1-8a7821ba540f", "comment": "Malware payload (Mirai)", "value": "c67965a7dcb05b54ea01e78efcb571a4c91f5b9e384f4c7e677443a4059fdf91d56bf8357e0c69ea68c51f6a354f77ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959047, "uuid": "4f72aa5a-3f0f-4030-9157-e580370166cb", "value": "T1FE534C2179792E17C4D4B87A61F34334F6F6170A36A8C66E7D720E4EFF20A442117AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959047, "uuid": "86e30136-5e85-41a7-bf88-1f3e54e61593", "value": "1536:2+SZdS9kGphly10SIEnNoZeOJVWp210dniDOPJb0eeT:2FZMvu14T110Rx0eeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959047, "uuid": "3d7b86b6-5f3b-470b-a373-a1728c185245", "value": 66440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959047, "uuid": "b2d11cb4-66be-46d9-b585-0de51c2185ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959047, "uuid": "1c796db7-7e4e-450e-a861-95ea47db091b", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a681abda-d1fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764953491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953491, "uuid": "01e0a833-1a89-433d-82f5-5aed001678ca", "comment": "Malware payload", "value": "0f91be64cf089a856e82fd9feb74a39d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953491, "uuid": "48a0721d-d13e-4c5c-94cc-0b93f626909a", "comment": "Malware payload", "value": "5a6c484b70f9fc77b68cf63a4e2fd8105d16064412efd07692e8a66a903c1e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953491, "uuid": "727ce98c-c2ed-42f9-9329-fbdacb3385fc", "comment": "Malware payload", "value": "b29042da22e09a2ae715a120b29af678eecbd99c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953491, "uuid": "1f38fdee-ee07-4f35-ac2f-20b716c5163a", "comment": "Malware payload", "value": "82a65d4223bb3a6221c132af543d652b1052b6031d7b2a6f64cbdf70d81addf1a87bf1c2d2a4fcc641856fcd5454eda0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953491, "uuid": "895ab2e1-f11a-40d7-9998-34fb366122a9", "value": "T195664A07ECA554E9C0A9D2358A639263BB717C885B3123D33B90F3292F76BD06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953491, "uuid": "707266f7-0081-4b50-a42e-929ab852f5c2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953491, "uuid": "fc4c8ab9-8679-4ee6-b6c7-2915ea45579c", "value": "49152:kQRS5Q3dDHbN3bBGs5VgDS8p9jEEiu6whBHi6GqjXCe6vwBtiQCvA9pxFyJVdp9h:k5WFPmPijqjyecN+zCY7Q+EL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953491, "uuid": "0e8f0759-7a56-4166-bf0a-ecfe76ce9b2d", "value": 6607872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953491, "uuid": "39d17575-bcc2-492e-8020-b7d624f7c788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953491, "uuid": "6c54b9e1-6ffa-41d7-87a2-bb5821f53b2b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9ab8e6-d21a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764967138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967138, "uuid": "57531935-9d27-40f9-9ffe-85370c281a0c", "comment": "Malware payload", "value": "ad292d5e7ab805d668549095b997bc28", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967138, "uuid": "63faa64c-9d48-4a03-8997-960883dfc843", "comment": "Malware payload", "value": "5ad6826943be17de5d23af0802e7e0074a02141d8350ad4913094dad3a14b039", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967138, "uuid": "f01bc47f-a926-421e-b6dc-d1d909ec7908", "comment": "Malware payload", "value": "77a5325667b83d5b7ddbcddb47947c8bba5e49c1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967138, "uuid": "9b356226-b6e4-4f8c-b78f-696fb7c07e13", "comment": "Malware payload", "value": "457f309bc89d0fa2f5e8bf8c8ce8a1e93c0fa2364967eba686c9332e68b4788c79d7e9d725a9504fae76b3a2646a0638", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967138, "uuid": "fd4b038a-1507-4cf6-891b-f6c7b867e23f", "value": "T1AF553384D3B0C17EC35651F2F771186D889C6A52E3A509FF84E6379E93289C51A2783F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967138, "uuid": "b11a7a11-2566-477f-8b62-2f9fd411a61b", "value": "24576:c7d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS43FIvL2v8fJX:c7d0mm3O6PtsIgxvPY9S4C6v8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764967138, "uuid": "1c108c86-9052-4735-8f2b-d03fbc70a1ea", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764967138, "uuid": "ee4b7b3f-004d-4d81-8615-37f4f9895623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967138, "uuid": "90627e11-3e44-4cdb-b330-12e7948f3757", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63736b51-d20a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764960250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960250, "uuid": "249f36ae-2c52-4ccc-a28e-9ea5c3da4dd9", "comment": "Malware payload", "value": "d319ad17ffa76e415038ab580099c5d4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960250, "uuid": "27d858d6-68f3-487e-818f-95e99282e3a8", "comment": "Malware payload", "value": "5b0af523ec0b00dedbdf078b85ebdf39709a23439126b762479c34da6a0c9eac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960250, "uuid": "f7d35648-5134-4896-8590-a8712931f9cb", "comment": "Malware payload", "value": "4d912403a53dfe1d3adb4ce825151436ad562990", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960250, "uuid": "ea613f36-c764-4b85-9f0e-227f90bd41cf", "comment": "Malware payload", "value": "8fef870dc19e120007886f2fecb3dd04ad56b6a7726fae2891ed4ee911ed9fcf6f6f4d7d174010278a4095e79b8d0b56", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960250, "uuid": "6a3d2e67-e7d5-42b0-a831-38d6c543456d", "value": "T186112E6F244AB9F2C229C705BF67F600BE049251C8E4BF25B2CF97B1CC9A5043612E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960250, "uuid": "878e9578-b867-4ba4-afac-3263405938b2", "value": "24:e7P7y4xCP7y4x1P7y4xpRP7y4xEP7y4xvP7y4x79P7y4x+P7y4xZP7y4C:e7TyCCTyC1TyCpRTyCETyCvTyC79TyCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960250, "uuid": "3888b113-e9ed-4704-81af-81555eaefdd9", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960250, "uuid": "efce70e2-e44e-4f90-9e6c-94377477cdb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960250, "uuid": "d2895e42-3b65-4e14-a9ce-d23b23f0bb01", "value": "router.totolink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e468c8-d1f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764952898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952898, "uuid": "e3c95af7-aab9-468c-878c-5590b3c75f69", "comment": "Malware payload (Mirai)", "value": "dc9387d041e12218b932c16072ce9244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952898, "uuid": "259010f4-78e3-4113-8ef5-9f84fc07ac8c", "comment": "Malware payload (Mirai)", "value": "5b3767d7b50c24090104bb87f43b0585ce49be0b12b2f29c6fb878de2a23ab64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952898, "uuid": "65ceeae4-6eab-42ea-a174-d69fa894e99f", "comment": "Malware payload (Mirai)", "value": "d1a36acc8c9a466ff846452df04e74358672a671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952898, "uuid": "22a7c250-3f56-4547-b3fe-d4b3f0677476", "comment": "Malware payload (Mirai)", "value": "3fe5bb671f70772c8c1199a08d16ed7266dc32ed06b5a7be6f97ff7c679d6296b8e6b7cdc2bbba3288f6c4ec8789bb7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952898, "uuid": "13cbc3e3-bf5e-4186-a287-b8f4300db0de", "value": "T109248C62E832ADDCC2189175B4F4DF395B239440414B6EFAA6A7CB345087E9EF118BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952898, "uuid": "33f9bcda-2378-484b-9ca1-8b5c246fcc81", "value": "3072:vUa4MEpcDwwKuOmSrveahVFCqboxqzcx+I26X9EWrluLiiZW6hh1NAK:vUxrwKuOmS7BrboxqfodrKiipAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952898, "uuid": "881f1913-ec15-4aa5-b18f-139d834a619b", "value": 229984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952898, "uuid": "c530e9a2-fd7c-40ea-b9bd-1630d7b63a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952898, "uuid": "454652bc-5ce9-43cf-a2bc-be783fc1b426", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd78822f-d1d1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764935974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935974, "uuid": "a0b86fb5-0466-41fb-b1a4-aae6d3a00a35", "comment": "Malware payload", "value": "ec0765cfba5061e5365e24ff8beb0d14", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935974, "uuid": "ce444acd-458c-49ce-84b3-c9c3951d6ca0", "comment": "Malware payload", "value": "5b7a754f0f9f068a83654a79d39d7a99c6673b4054d83c5bc38f7a51870432d2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935974, "uuid": "47b10d40-2470-43ce-b1af-f05cc9ec84e2", "comment": "Malware payload", "value": "192f325791b29060a8111d982e33983a15e93041", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935974, "uuid": "8f5b3fc3-0757-4694-9143-073e313ab381", "comment": "Malware payload", "value": "e99163b6f88c1a93c2bafdb3e268596da670bca26186eac5f1b7491604f59ef54a19fa70bd0d6d3a8742a1c913a2022e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935974, "uuid": "b7b24ffe-1062-473d-b9d5-522586cdeae1", "value": "T1067374CC19EF44F8AA17B4A886CF5C16F7E99503C63CC9D5FF4D65A06F21428A1E89D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935974, "uuid": "f1329bfe-cce9-4c43-bb6b-a1688315ff73", "value": "768:xk2R0rkNw9NtEG2GblL4ffOq6kPwB2ZPaFbmbCEfWwtzW013Oiy1f4V+dJODRRoz:qBtoCE/RoSFdvjCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935974, "uuid": "6bd3843a-ab65-4129-a833-457ea15ba106", "value": 76683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935974, "uuid": "7a80d03c-5079-4677-a2d0-8f1a69fee4ed", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935974, "uuid": "e870ccaf-de70-4491-9d8b-869346907e2c", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ed65b5-d17f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764900799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764900799, "uuid": "716de1f0-05e3-4ca8-afa2-0e40a964de54", "comment": "Malware payload", "value": "133f4ef04680540bc08bc8fef919325a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764900799, "uuid": "d93e2c37-9bbe-4986-870e-50f0977fcad3", "comment": "Malware payload", "value": "5c1b78399932eff692c4f05cbc1b27275d843682b264c94a2da6a6aeb86f8323", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764900799, "uuid": "7a245c82-96be-4755-8c2d-1a60cffdaa5a", "comment": "Malware payload", "value": "7c8b48b721acdaf54a24b307505b4afe377ebccd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764900799, "uuid": "6675fc57-ad60-41f2-a4e8-ec226045b889", "comment": "Malware payload", "value": "c9fe95f7576c59a5655febbf5fe73d1abfa141f34fb34efac08eb69e294a5276a0f49ab2847af9b37d1c66675ade6ca7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764900799, "uuid": "8a2fcb17-db38-4463-a387-c9ad5b69c22d", "value": "T15EA65B82B9854AADC6AAF1349063621177317D194B333BD3AFD816651C3ABC8273FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764900799, "uuid": "34f1d644-e08d-4d31-87c4-49d059e213a0", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764900799, "uuid": "5322e5d7-bc72-4426-9404-b558c8202304", "value": "98304:k4y3Rll9fvOLdiE2wuwNHmzeJ3X/sgzzKdve:kTRll1SdLPN/nkgfCve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764900799, "uuid": "a27c71a4-a97e-452c-a9b0-d5c1f12d2306", "value": 10250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764900799, "uuid": "30817f19-10a7-43c7-bd80-fea02352cacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764900799, "uuid": "88fa7425-6f00-4d3e-8f8c-121221e2f842", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82c3606-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917497, "uuid": "eee509ce-a575-4f9d-b6e0-fc729241bafb", "comment": "Malware payload (Mirai)", "value": "f512f0bfd5c2a9ae2b901ea98de1cda4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917497, "uuid": "3e6fead4-e732-4fab-8cf5-1bb5933be987", "comment": "Malware payload (Mirai)", "value": "5c8c36e008ab72d74618d0c2d461c8e53ada896f5863f76ce243cafcf3cac219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917497, "uuid": "ff029c34-314a-467a-848c-e29b8eb9cee3", "comment": "Malware payload (Mirai)", "value": "ab5a1824aba94d6daa27d4572bf11a16e143a99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917497, "uuid": "08d8eb10-1127-4c6f-a0ed-5a3a23f91694", "comment": "Malware payload (Mirai)", "value": "f2e74b6606e756baf12ca6805f7f4e8036b24f0b05d33dcd3f202225c005c7a3c5d1864ea995ff02f8c59ff38f23e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917497, "uuid": "dbef17c8-0492-4aaa-8720-1387b14d9491", "value": "T162C2E1F1E19BB830E27258F2F5FE859337664BB8D0FD363361A816A05B85C0963765C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917497, "uuid": "c2c1cf43-b75c-4eac-a6b8-090f747f57ce", "value": "768:Q7Nfg1Tvi8CV+WMmW8Jn48FNFbeLas3Uozk:Q7q1TMVvlJzNFbeLXzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917497, "uuid": "1729d800-f2e3-4aa3-aae2-60115f465693", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917497, "uuid": "2daa124b-6582-49e1-85c7-ce03711e994b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917497, "uuid": "a44da620-30d3-40a4-97d3-1fe1d2f78850", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fe1480-d16e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764893421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893421, "uuid": "6a34d11b-0edd-468a-b0f0-401a60fa85e8", "comment": "Malware payload (Mirai)", "value": "415159564e09f6d2c802c6c6b50e697d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893421, "uuid": "f4276212-9d5b-468e-8b9d-2f7d59a59263", "comment": "Malware payload (Mirai)", "value": "5cd9b9001b584dd843678fbd8c52f1d341bfaeb6dd498c7754b3f9e33b304bff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893421, "uuid": "7f96dbbe-a9ab-4bea-b9e5-a1f7a9a4b043", "comment": "Malware payload (Mirai)", "value": "fcccf9190d65794c342ae2fd4edaab6025b37619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893421, "uuid": "95e4a708-99fc-4389-a5fc-85c32137360b", "comment": "Malware payload (Mirai)", "value": "7a6223732b56afbe34b7901f985801f8d801e2f806b4763fde20cde0ad5d1c31b497bf11f395d89f7e2ec9e061a270b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893421, "uuid": "3e2f9505-4bf9-4cbc-9ddc-8a43ad6a9656", "value": "T1B3532945BC919A26C6D422BBFA6E41CD332623E8D1EF7217DC215F117B8A82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893421, "uuid": "f8ef3cba-02e4-43d5-b7f4-e4500b066e29", "value": "768:XEFdr1rV96BCu5K7GwQdMX1mUM6s3BWn77vh2H3IMu5rmZ9O2i1NvRaI2ys8/+71:sdVVUwQuFml6s3B2DFr+oRkPq+7Natu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764893421, "uuid": "aeb09c24-02d7-4e61-9f26-57f6b0cd5237", "value": 61432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764893421, "uuid": "8c9d0cd2-4067-456b-8550-4fc1f1aff27c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893421, "uuid": "82c781d3-6bee-426d-8cf8-d49f85073f4b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9f58df-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959034, "uuid": "ef6f8f74-f3b5-497f-9639-99e21cec0840", "comment": "Malware payload (Mirai)", "value": "c4453cf49603bc45ae37386b9fdea9e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959034, "uuid": "d3ccf178-2583-4e30-a056-6d91f7797653", "comment": "Malware payload (Mirai)", "value": "5dff96c034f774a60de742d7d0162b832e34cb4f7e2a0cc341f4d2cb84572574", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959034, "uuid": "67d8dd9d-4cf8-42b7-95ae-4df4264bfc0e", "comment": "Malware payload (Mirai)", "value": "2c752e303286344ed7943d5125a9d1b025911b33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959034, "uuid": "3fd94f8c-6665-477f-bb47-14ed62fedd9a", "comment": "Malware payload (Mirai)", "value": "936d47eaf18484be0320a9294f868324e1569f2b20b4881d0735cfe45f8069d03e3d4370e2b9949b46cf54089a02cb3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959034, "uuid": "6413309b-9cba-45e3-a182-0d8909261daa", "value": "T18B1187FC051979B54414D746B7928108B122DBCF18F78E485F9816396BF92CC3033E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959034, "uuid": "4ac04ba4-9725-414b-b0b8-b000dbdc2361", "value": "24:E4RI4Rl534RC4Rt4RAp4RJ4R84Rn4RD4Ry4RAJh:Ezut3UNYpI8hfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959034, "uuid": "9ed4f025-398c-45b4-84e4-03d72184eed8", "value": 996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959034, "uuid": "fa5aa75f-e495-4bdf-93a7-b22372241eaf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959034, "uuid": "8d9c4b70-aa7f-4dc0-b721-cb4d8aaab088", "value": "tot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b6f579-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943963, "uuid": "8dbde2fa-3ea4-4328-b362-72f7e3440e6a", "comment": "Malware payload (Mirai)", "value": "9f1191d482fed964a604fcb7b9bc5417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943963, "uuid": "36dee05e-b22d-4c79-90d4-85bab419088a", "comment": "Malware payload (Mirai)", "value": "5e63fc81c4bd1f9a445dde009c5ebcbe6f021f2e42dc54f56d3fb1b289ddcdb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943963, "uuid": "1a8c79a3-c41b-4aff-b711-8b522392218b", "comment": "Malware payload (Mirai)", "value": "b355a7971c6288e20aebc8ba5df78dbe7f4e2843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943963, "uuid": "890c3fa6-7c10-42bd-835f-caee8cad5227", "comment": "Malware payload (Mirai)", "value": "53e5c119ddd6789091f24820d07852ee124e874bf723e1371717e116a968983650781058920f0615b543a70fd07d80ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943963, "uuid": "97f1d208-d9dd-4322-b737-66cff9188137", "value": "T16804121724F9E874DC2E3979C90E525534BC1EE4B1723A03BA334749EBA469286D8FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943963, "uuid": "dd08f8bc-9618-4a95-abaf-277e0b429327", "value": "3072:9Wzdu4knRPGqhSnGADL/Q/n6e2+jXfaRwF5FA9E7IvlU0CUBLF2zBJsgS7Zgk8bW:9ReqhSDDL/xgXymF5Fr0CUBB2zBJspBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943963, "uuid": "d1e458a3-685d-4d68-911c-69a10b48835e", "value": 186240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943963, "uuid": "bc681be1-5a34-402a-bea0-28d7eb46b95f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943963, "uuid": "ffcd3c7b-1d08-4b56-96b8-88c0ad8e77c1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5bf448-d206-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958385, "uuid": "0fe5a6be-a8b3-4ce1-adee-13b4ba1b6448", "comment": "Malware payload", "value": "fd1a28e7e305edb31ba0a31c09b0cf8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958385, "uuid": "b619de13-8b7a-4fe1-99bc-73c8af5717bc", "comment": "Malware payload", "value": "5f70a8f252f5f1bfca585e166b40a861831ac1c48d8a2e115ba8448e7225bc38", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958385, "uuid": "8abb2eb1-0805-4806-9853-82e623eaa00a", "comment": "Malware payload", "value": "e1c22ffb423231a845cb519cf4a0d2b12a043578", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958385, "uuid": "a92d067d-1a69-48d3-b396-4970ff9bb4ad", "comment": "Malware payload", "value": "ae24e98ea74ca924060ab514e55de67f2ac1b863841423eeba40c069c925f42971d8021c7b9f6c34f3897c1ca9231f25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958385, "uuid": "39218f22-ce8a-45f4-91cc-b0f03b3e4a1b", "value": "T1FFB0128F00380000C004BBF46973CF1122955FD129640F8801F60624CC6823534B0D2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958385, "uuid": "7684074e-008f-402e-8ca9-e7894ab4774c", "value": "3:L6FTH6K0NUCtgqLXKTaGaKzSE/LwWAAqvn:L6FTHMF3usv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958385, "uuid": "a24cf85f-8f2e-49be-bd8e-f703e948f914", "value": 99, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958385, "uuid": "a2dd6f3d-348a-4fe7-a4f8-d6d62bc4252e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958385, "uuid": "ca6374dd-5a3b-44d4-a700-d36659ace7d9", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29befbaa-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "3dba76b5-e0d0-43ce-b269-4c247c006983", "comment": "Malware payload (Mirai)", "value": "d03eb59d876942ed1bf393b8109115ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "0908b257-d2b5-4286-a732-eb87dd82dfc0", "comment": "Malware payload (Mirai)", "value": "5fe7abe94230b5c00aee54420a51d70c81418bcd2c8e9f241f792cc2151555f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "7e73f5e6-6086-4cfc-a4a9-639202322742", "comment": "Malware payload (Mirai)", "value": "a7911e934d5860fd3b1dc2017fb01afdeb73c692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "8047a4fd-e41f-40d7-9d69-43d04dbd1d6b", "comment": "Malware payload (Mirai)", "value": "3dd45227d9f3c3cb58db42edb898b4f654f457e54caf860584ede8c48de7c6babdefaf958a8505f7e4645f03bf100e3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "e0e88ca8-a800-4154-a66d-8313d8f20187", "value": "T1C7334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "d3aabe19-00c1-487b-b4cd-2c7c8e84fa6a", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwZ:ivW3jdQGqt7Y+Z+zN9cGgI6bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958436, "uuid": "67c46708-d225-4550-8cab-3c8a2f47ef8a", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958436, "uuid": "d58ee60a-6ff8-4e94-b65d-8d5efe4adbdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "9320ecaa-c3b9-412a-b5b4-72117f395eb7", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee45b257-d1e3-11f0-a129-42010a9c0007", "comment": "Malware payload (XenoRAT)", "timestamp": 1764943733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943733, "uuid": "8557fa38-c16b-419f-83f7-fb3aeea24074", "comment": "Malware payload (XenoRAT)", "value": "3da36aaa5e43ddc653fdca70ac36c2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943733, "uuid": "0d9831a6-f45f-4427-a83a-aec7e40c5182", "comment": "Malware payload (XenoRAT)", "value": "60143ebe7e289b139850c52380249e45c0c2452a2c068af94580de3bf5c0608d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943733, "uuid": "13b52f44-cc8b-41e8-88fc-454b95cd84c8", "comment": "Malware payload (XenoRAT)", "value": "c93c57ef404c9efa15b03ba809d0b2f1f74bab94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943733, "uuid": "fc1eb935-0d35-4ab8-b966-43c701a336ae", "comment": "Malware payload (XenoRAT)", "value": "7f7c9db3a29d600fff178024f4c59b513ce8f90a98af577d367397a062f8f61e047bdd97378e0d3ce056e8fecc6c2e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943733, "uuid": "6f6c44d8-cd36-4240-b85e-83d5c15bbc25", "value": "T15823F84C57AC8923E6AF5ABD98324263C7B3E3669532E38F08CCD4E9379338555053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943733, "uuid": "bcc47ca2-b309-4df2-bb75-2d7f98215acf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943733, "uuid": "be738ab4-7071-4820-b50f-611d324c2c97", "value": "768:RdhO/poiiUcjlJInEvH9Xqk5nWEZ5SbTDaJWI7CPW5R:Pw+jjgneH9XqcnW85SbTAWIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943733, "uuid": "c98ee834-59c6-4f28-9d87-fa17ced9a1ca", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943733, "uuid": "5a998e2c-c668-4dd3-993e-1e41142226cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943733, "uuid": "36f15cde-cb33-4f36-a228-5c39180f4d23", "value": "Banking_info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0119d9b3-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917136, "uuid": "49e9af80-6673-4dfb-9d30-2068b261d55d", "comment": "Malware payload", "value": "c851e849c8442727eac69225203ee7f7", "object_relation": "md5", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917136, "uuid": "0afde05c-29e6-4182-b825-2271bc25d4fd", "comment": "Malware payload", "value": "6020ea571ee6e09a0500421823fd5292858bd763acc4089a56af414cfb0c82ae", "object_relation": "sha256", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917136, "uuid": "72017354-200e-4d18-82a3-9765794ee2ec", "comment": "Malware payload", "value": "a9747a3f58f8f408fecefc48db0a18a1cb6dacae", "object_relation": "sha1", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917136, "uuid": "1f062cdf-a6f9-4f53-9bd6-0ed04141a6c0", "comment": "Malware payload", "value": "e09ea7571ae4073651f4ac1961d670e126ff34c684f83d4100add6a54470b9edab38418063141482344a1a16c8448db2", "object_relation": "sha3-384", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917136, "uuid": "d412bca4-98f8-4096-9f9b-ba393885f792", "value": "T1AA163A07EC9145E5C0AFD23589669252BE71BC485B3023D72F90F7382FB6BD0AAB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917136, "uuid": "090e0cf1-4ab6-4133-956b-7c711f168cdf", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917136, "uuid": "22fe0d42-bba5-46dd-ba2f-2cdbbe4cddc9", "value": "49152:Ajp0psoGPl0tL1Kf7QplJG6EZnkc56FjS5E7JlqDlYc23w:6c8fbxE7y5Yrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917136, "uuid": "d78f7aad-471d-4edd-a25f-e5a2df6fa510", "value": 4272800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917136, "uuid": "6964b61f-a70e-419b-a94a-5064799bb8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917136, "uuid": "6c7b90d7-c1d4-4874-8213-6f128aac76c5", "value": "6020ea571ee6e09a0500421823fd5292858bd763acc4089a56af414cfb0c82ae(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871bc128-d1d9-11f0-a129-42010a9c0007", "comment": "Malware payload (SVCStealer)", "timestamp": 1764939265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939265, "uuid": "41518ba5-4227-4ff5-b505-08f369093393", "comment": "Malware payload (SVCStealer)", "value": "38107ccdee7b9adbbfa2c936edda32d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939265, "uuid": "d7f286b7-74c2-48a8-a55e-9bac79d69f52", "comment": "Malware payload (SVCStealer)", "value": "60acc48765bbe492e56f8e1665bf041973f23501422a73fd87dd2b79922246b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939265, "uuid": "6cc78153-e927-4a31-845f-d68cb325a599", "comment": "Malware payload (SVCStealer)", "value": "6e447c0fc8b76f1c2125d17b6d36e7a5817b6d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939265, "uuid": "4715d50a-afb4-4580-bc3f-0e0f5ffbe389", "comment": "Malware payload (SVCStealer)", "value": "9962df34c5bc90cd0637a90170c10210dd18fa54c0a68bf92e265db5adffe57dc876da4b8ebebbf96612fd4cf369fe9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939265, "uuid": "58175eed-151d-4045-89c1-57cca3fc8acd", "value": "T132148C243680C072E4B7027145FC9B32597DBE620BB11ADBB3E80F9D8AB45D26B31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939265, "uuid": "a6445233-fe77-475b-bc6d-4c49ccb74d53", "value": "9d20241135260a6283527b95f11fc551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939265, "uuid": "694810c6-1c8d-4b82-96b1-5b41c7528784", "value": "3072:CLkiHgZn7CNFBneOI7Aeq63oNZErKypSiDX9I24+lgNd+F0PWMelS:CLkiHC7JOI7+5ZErWk9IHDd+FUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764939265, "uuid": "891a2cbd-bb1e-4681-8eeb-7c322acf43b7", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764939265, "uuid": "3e27b4c0-3cdb-40db-a5c4-01194857bdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939265, "uuid": "adea2817-7261-4098-acec-49001edaa4f9", "value": "SecuriteInfo.com.Trojan.Dridex.1505.13150.5456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ed1f78-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920040, "uuid": "fc351d9c-b182-4059-a20b-81398ff0aa8e", "comment": "Malware payload", "value": "cf2a11f088d5ff24bd13e9f2264d0843", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920040, "uuid": "ae8003ba-ce67-40fd-b775-2b5cb8d9a5ca", "comment": "Malware payload", "value": "6266d87b93e8129b0b606971f0c9e00214abadbc758769bd9cf456c6e0ad8b6e", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920040, "uuid": "7ce13dbf-88b3-4380-adc2-82e237cbf203", "comment": "Malware payload", "value": "3776c0df00a24f9152b6cb44c0fa05ef410f747b", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920040, "uuid": "d9c62aec-3fd7-45c9-87c3-bbeacd6f4629", "comment": "Malware payload", "value": "e7c1addccdf878ceec86465d04f60e6720cb99c51bd4896096030ad65829200b89fdf2625ab99852160bf97a84fb8ac3", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920040, "uuid": "1ccfddd7-0f5b-41f9-b770-1dc6450142db", "value": "T1AA0833ECB944DD0CEE0C453F65F9D19A8362A4CDE338E94D7A2B26BCD411A91237672C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920040, "uuid": "d9cceea9-5f9d-40b6-9212-f06cbb1d25a2", "value": "1572864:9YZsiqkn+TDbFXQNbrkKydq8xSA+/Si+g2yO8OlZ0epFqd3KcUun6cVKna:mZQXbFXQxJydvdbbyOl2eb8aLu6cVKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920040, "uuid": "570f2201-5fa6-4421-9b27-4a0bef23b425", "value": 78118902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920040, "uuid": "99470530-9fe7-445c-b345-208bfe0d3049", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920040, "uuid": "ffb1fe85-95bc-45a1-9170-ac95dbf68aa5", "value": "6266d87b93e8129b0b606971f0c9e00214abadbc758769bd9cf456c6e0ad8b6e.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffbf8e4-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898290, "uuid": "6f00f619-e689-4dc3-9c3e-345d6b094d77", "comment": "Malware payload (Mirai)", "value": "c246e1319c549dc925e79e4fc4fb8214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898290, "uuid": "ead68d47-c890-46b0-b6f5-c685cebc5ef3", "comment": "Malware payload (Mirai)", "value": "63fd6b7bd30a9e17036a83d6bdb85deae1a5fe838a1b8e8b57a88bce3463570b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898290, "uuid": "930ef747-d6a1-465d-a7b9-236b8c1bc796", "comment": "Malware payload (Mirai)", "value": "71a41a7cdc9431851f3f13bdf31c638dc6cda859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898290, "uuid": "e41ba935-e7d9-49be-a86f-c7772448dec8", "comment": "Malware payload (Mirai)", "value": "529d4f4aeb4c06c140c6b286c61695401b2ca725c9176ee086f1961cc6aa0229dcc7e74e86e810427b4a53e6b4d47bd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898290, "uuid": "a35cc910-a5bf-494d-88d1-f4261d9421e0", "value": "T1B6C3D80D3F219FBCF7A8923507B78E269259338637E1D181E15CDA016EA038E645FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898290, "uuid": "7809b69c-85bb-40e6-94cc-a82790e98f3a", "value": "3072:qlxLIzz7CkDvBigUlL76OWO+hapKiSwwZBGq:qlxLIzzukDvBxWSOh+Ix9Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898290, "uuid": "9c174ebd-4c10-454e-a6d3-c6380712acf1", "value": 126144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898290, "uuid": "e136fd64-5b36-4412-bc36-47e19d43eaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898290, "uuid": "3d19537e-fbab-40fc-94ee-04456e3f2eb3", "value": "UnHAnaAW.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfbcdae-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898283, "uuid": "4713eb20-6958-4869-9812-f2a6968f6b6a", "comment": "Malware payload (Mirai)", "value": "11bf9e4f13d6dd1baec6be42686f5f65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898283, "uuid": "1696a350-f15f-4629-996d-e606bec2353f", "comment": "Malware payload (Mirai)", "value": "641444ac96c5113dd94e36b759d67a9e5213e557244fd3a051cd47ee251e1abb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898283, "uuid": "cc12ec13-450f-416e-a6c9-64b459523dad", "comment": "Malware payload (Mirai)", "value": "3a59f3b59c3f6dc68fee0abed05c65e0b2a24e45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898283, "uuid": "9ad4d087-b122-4e14-b80c-21c9d2455192", "comment": "Malware payload (Mirai)", "value": "6536b04b502f08362befded1ed0f4cb6e47d2e851d4b85586889c50b574ba2947d303b8974b6e2ca05d7eed7843e89a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898283, "uuid": "cab3f128-d995-4018-b1a9-1ada4a1eb9af", "value": "T1BAB32A81AC818A25C9D516BFF92E018E3323577CE3DF72229D246F2537CA92B0E77645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898283, "uuid": "791254f4-6d5c-41c6-9dc3-b19cf8079f3d", "value": "1536:mknUMrC+MfbmIiWsdjq4E0Tzyc16r1ROFaE5WW95xXTbag6STot8Mliv4wioN5nL:O1FL2zDQrDkdxvTbaZZRoN5n3uHONb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898283, "uuid": "3c36dadf-a147-4daa-8174-aeff72ca7664", "value": 109080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898283, "uuid": "07eb1b91-eac7-4abb-8228-15e60b1a0edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898283, "uuid": "de9f4dd7-86b7-4e02-b67c-a0528d3a8dd0", "value": "UnHAnaAW.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c727f22-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958870, "uuid": "e319535d-eb42-4d3b-95b3-b4b85fab0c90", "comment": "Malware payload (Mirai)", "value": "1b23c9b53e52a879e0de37533ca1cc31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958870, "uuid": "ed71bdea-fc7c-41b9-a75b-43da634c19d0", "comment": "Malware payload (Mirai)", "value": "641fa2d3da1bbd288a0d43e00be4d5f68ad3e61c6039a2f1adcd0be5df0aa188", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958870, "uuid": "d53a950f-a0fe-4bb3-b604-f251b348a974", "comment": "Malware payload (Mirai)", "value": "187316fbdc905c4db5f0f597b3d24cb37e78206a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958870, "uuid": "662c4454-90ba-40f3-9d6d-79373d204d6d", "comment": "Malware payload (Mirai)", "value": "3a3d2578eb0635dd3f13902856991417f90ba4921b00ef52d51c03bdaf12a7a0b261c26a3967d187abaad0132cacba3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958870, "uuid": "02aec8c3-4953-4236-9cfc-cfd93cabf75c", "value": "T1F5E04CFD406BDF57C1055D09B07AE873B033D7DAA2A1DE07AFC8A43AA198930B132E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958870, "uuid": "ab557ae5-6a9f-4d8a-a96e-33fc525c5a04", "value": "6:LMFt5/XjzbgMFt5/laLaNgp4CgMFt5/pFGNIvF+69gMFt5/nfiAK6isr:othXjzLthlaLaNgpvthSNIE6xthfLK6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958870, "uuid": "408b8871-70cc-4418-8ccd-3cedcdc5c0fc", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958870, "uuid": "a5e9499c-1ec2-4aa1-b9fc-0fd49bbab16d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958870, "uuid": "6750ebf2-9ef7-4162-93fc-6a7fed33c7da", "value": "smc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02267454-d1e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764944196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944196, "uuid": "c5b01bf3-643c-456b-9fbb-8c7cb7afc059", "comment": "Malware payload", "value": "0ec9043faa8145090443b3cc49e66276", "object_relation": "md5", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944196, "uuid": "7fd19e1c-7177-4579-99ce-be6f312864cc", "comment": "Malware payload", "value": "64932c34f2a4169f3443dc163386a41c98a0d8f7f070af59f42f0e6e87726df5", "object_relation": "sha256", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944196, "uuid": "103f149c-3b81-4c59-9cae-f3148b9b92c0", "comment": "Malware payload", "value": "71c4190eaf95feb3419a76c3e23d205596bb3e7e", "object_relation": "sha1", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944196, "uuid": "1d533a86-3a8d-40e4-bc75-2dd186cb83b4", "comment": "Malware payload", "value": "98f9e631572bc183256fb468f46be75f92bf8697014366bd880e6368cda8c272fd6f7f7a96157c9f98f68dbe9da3204a", "object_relation": "sha3-384", "Tag": [ { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944196, "uuid": "2745ffae-a041-4f02-9268-b5804c092ea7", "value": "T1F6C4F10C7F97BD0981A4A7D9A14386C79D808C90B0B4DD7ED6E0E69B0C3DF77D88A865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944196, "uuid": "dfc5a803-1759-45ee-948b-cc38e71e81b8", "value": "12288:42FpLBlK4CN4WyDC7rpPfKg3f43GsGvYEn+772oAHJTFuH4N:42FpLPjsH63GlvYEJoApTFua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944196, "uuid": "1b8fb031-f3f4-4079-abe8-679bdf6dba57", "value": 586320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944196, "uuid": "d13a1367-b9ae-442b-8a91-507bdbc213b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944196, "uuid": "0a82748f-cf48-4626-b585-0cba56f5da06", "value": "654e8689cc2ba948.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6505ab47-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958964, "uuid": "8395d77a-9fd2-492a-b010-0609338a24b2", "comment": "Malware payload", "value": "1c7ebba6dced0b2396288bb4c37a9bf6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958964, "uuid": "a6126e1c-ad4e-4497-8fdd-9b214927f171", "comment": "Malware payload", "value": "64fbf948a9eacacee8199940ad7390539f230be625deb910e95fc3c7bb9f940b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958964, "uuid": "9e149b9e-d35e-4869-be8e-cdc43acb0439", "comment": "Malware payload", "value": "9778a3aaa25d61e312b401357a83109a8312e49e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958964, "uuid": "93f830d7-8571-414e-946d-9552d9ab8fb6", "comment": "Malware payload", "value": "9ac945c30deac5d304b3e010f1db2361ce59f4b50a2c25f84a83f7b06917cdeae88167d70047a657e25bb6e8cc675af5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958964, "uuid": "63b817e6-64f4-4a34-82e3-e958b478087e", "value": "T192E012BE412BCF0B8158DC25712A207B3031CB9985679D48BEC4503D9594924F171E5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958964, "uuid": "1bca9864-8137-44d8-94fc-3264f475b00d", "value": "6:LA5/raumRBVA5/lcUSRBVA5/pjLKzRBVA5/nefRwzS+zSevoSvSScvv:sh+PRUhlcfRUhNSRUhERwhwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958964, "uuid": "2bd03223-0b6c-4e92-9faf-5f9d909dcc73", "value": 386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958964, "uuid": "38f545c2-be90-43ab-9ea1-bc6ea98169fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958964, "uuid": "4ec60d09-4a08-4262-a534-53580073006f", "value": "cam.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9875e3-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958360, "uuid": "b6a92d35-1bf5-446c-8119-597e3cfaf518", "comment": "Malware payload (Mirai)", "value": "ec3c8da5bcc3fc30846242a6de83d3ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958360, "uuid": "ebf31820-c925-4f9d-88ee-376c12a1f0c8", "comment": "Malware payload (Mirai)", "value": "6503a59deb5e69086ac60676ae158772eb10de00181d141bdcd635363deffc36", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958360, "uuid": "6ab17d75-9710-4dd3-89d6-c571543c3b21", "comment": "Malware payload (Mirai)", "value": "77234aaf30a919bcd2a9c6e3c9f591e0cbe29f9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958360, "uuid": "cb3bb981-c673-4a3f-b7b7-c34d007a9beb", "comment": "Malware payload (Mirai)", "value": "f22d806e43d28e87c8188645ce80586c530db1146587fd1ebb1af8b75522ecee05fde4552648ce06ce0a55e08cd22f46", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958360, "uuid": "63df7205-e4ea-411e-b975-85e5f74443ce", "value": "T1D511638F6E209466C600E544B877FB9473D5C34B51E0772F84CE65318299E28F501DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958360, "uuid": "36089e3f-d7c4-4889-94d9-f2dda5b2c204", "value": "24:eZ0n4fM0n4fj0n4fp/0n4f20n4fN0n4f7r0n4fI0n4fn0n4Lu:eO4f94fg4fpc4ff4fS4f7Y4f54f04Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958360, "uuid": "9246a1b9-81b2-43a1-b486-b466fc5db0e6", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958360, "uuid": "554027b7-19dc-4311-83c1-8531c91ac752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958360, "uuid": "1555716b-6070-4453-9731-8f2deb08e41e", "value": "misc.ictbroadcast.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77295e39-d19c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764913039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764913039, "uuid": "d086dc12-b162-4cb3-897d-06f00ae481ed", "comment": "Malware payload (Mirai)", "value": "2f83b34e1aaa1cd69afc2da6b32ef320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764913039, "uuid": "3b29d1b1-8372-4c47-9681-be33dd6657f1", "comment": "Malware payload (Mirai)", "value": "656082eb8cfb7285165d7805cf1773948a5c1989567c4f118e0c58fd65eeca86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764913039, "uuid": "868306b5-756a-4aa3-87db-69031c227176", "comment": "Malware payload (Mirai)", "value": "a6b1302c4650bb2b793c5d452eb98535ffa170d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764913039, "uuid": "7716f7f5-e884-4c22-92e3-e8c4fc87c6cd", "comment": "Malware payload (Mirai)", "value": "df59d4e912b6763ee58d69c28af4e8baf602e8532c0c5bc35dd40e9c53ec2e5021ab9449863bc361cc583f6b26738f17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764913039, "uuid": "cf5b2ffa-0034-4945-a3fc-cd9221f94c6b", "value": "T1E1535C0273A84E0BFAE61DF4253F1BD583AEED4021E5F185694FD7464235F33494AE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764913039, "uuid": "c22ed1c8-a67f-4fa7-9ca8-5a31af7013e9", "value": "1536:fp3/tcoPzVx57hown8b4ksgEZXB4kv9IZB:ptcEVD1ownq9XSXB39In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764913039, "uuid": "6bae41c6-4782-41e6-b00f-ad829bca821d", "value": 63736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764913039, "uuid": "4472337e-35a4-43d7-952b-ed215e7657bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764913039, "uuid": "a577bace-1d36-4894-a803-10306f7cfa61", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842247d6-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917356, "uuid": "e1458f3a-e60d-48d2-8d4f-904c2a30a2dc", "comment": "Malware payload", "value": "b309f1652dd93e68a2183a070aa670b7", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917356, "uuid": "8d3c9a8b-8759-42d9-94d4-b98a5056d36b", "comment": "Malware payload", "value": "6583a9def99be80d7d4be6df47c0ed268498264f415dba6810ea0ee33d251be3", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917356, "uuid": "1f20b9be-ba45-437f-b9e0-64ae87f0dbeb", "comment": "Malware payload", "value": "4e63f027f6dbc626f416e2753799a2256e4e04dc", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917356, "uuid": "093b2fac-14cb-4843-b530-35fb213f8097", "comment": "Malware payload", "value": "c13205b332fb964c1be7354bf631d841524ad3f799055bf7a9791f0c7a006154de47b72d936c91771cff200a3ab149ca", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917356, "uuid": "e864f597-3cb0-4f7e-8678-c0fb0570a919", "value": "T186B113283E9FD1BA430354AFEE16CF489A70A507A50C1810FAECD5D1AFC6539EBE1259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917356, "uuid": "ffbcc2ef-1a4f-4dc3-89cd-eeee576147e4", "value": "96:KCkzCo7kCeNS3yGPPWmxecyQuTyL++DF5QABuH7cd3W9kFKeNSCThvJvCi:KCkzCOe2yWPWmxecyQuya+DF94bctPK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917356, "uuid": "242d3311-af5c-446c-a2eb-f86a909497f0", "value": 5268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917356, "uuid": "4d628bc5-000e-4b60-9fa5-2a140aeefbe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917356, "uuid": "5e304004-5e49-4bac-bd15-9f235ccac5e8", "value": "6583a9def99be80d7d4be6df47c0ed268498264f415dba6810ea0ee33d251be3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cbdfad-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959068, "uuid": "f85d377e-db2f-4da0-b24a-cfd24f8ef012", "comment": "Malware payload (Mirai)", "value": "10d63e6ca1f526b5e521b2d418a8388a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959068, "uuid": "fd9e24c3-a0f3-4b9b-b4a5-a0d51bd3ca90", "comment": "Malware payload (Mirai)", "value": "665bd878a7b031708f346cce51d41b7b27c0858eea825b0246a76615715f9117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959068, "uuid": "45e9e21a-00de-4719-8d8b-ae4572c60f4f", "comment": "Malware payload (Mirai)", "value": "4d6c9d06b4a00b72739fc390cb4e252dd2e005e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959068, "uuid": "4d3d89bf-7abf-4f7d-ba78-361cc263d8be", "comment": "Malware payload (Mirai)", "value": "20a51fb993a7c4fd25f59be0b11fc6cb74ae0118b0d01b91829cdd4ecfae25303b690ce6ed0f10ab496a613e70235734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959068, "uuid": "947cd1b1-1d8f-4dad-a011-ec3afb56f594", "value": "T1D573D609BB650FB7DC5FCD3B09A91B0529CC950B21A97B393D34D818F24B25F59E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959068, "uuid": "ae564007-145a-4d5e-88c7-4ec4e00b151b", "value": "1536:H8nMU8zCHODAYCzl8hP9UYMkfcy04TT9RNIkDh+yuv:H8MU8kODbCuVMHDLyuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959068, "uuid": "33d3edb6-9054-4230-9fee-0bfd547e95e4", "value": 80404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959068, "uuid": "52d46e4c-4a2d-404a-bfe1-b17d070e1ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959068, "uuid": "50a9b2fe-aecb-4a74-a9b1-147c96606401", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5580efd-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951878, "uuid": "15e6d319-5e66-4f1e-ad32-57e093e52e3f", "comment": "Malware payload", "value": "b265c060f8cbaa34c2711112ead1663d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951878, "uuid": "5254f37b-e4fe-4763-aa7d-eb14618b1410", "comment": "Malware payload", "value": "6686d4baa9d483da27ba84dab85e96e42b790b608571de7bcb07a1fd7c975fe3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951878, "uuid": "67ebf700-0abc-40c6-b8aa-cb247b790fc1", "comment": "Malware payload", "value": "cdc8472732cd7419fad4ba36d0d7657158bd0634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951878, "uuid": "088a87f3-de92-46c7-be12-6fe47b297de6", "comment": "Malware payload", "value": "adb2ffe77db5bea961aa9e121ce03342d7472a9c499bfb963de973dbda9af1914943a7931b0ab57a390e80cba7168bc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951878, "uuid": "826ac6ff-ffa4-4ee7-b2d6-fae971df2fc3", "value": "T1FF967D07FAA204ACC59AC574871FD273EB65B45942217A2B2BC49F313F26F206F5E712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951878, "uuid": "a8450f7f-a1e7-47be-857b-562456eb55c4", "value": "98304:FxtFx6UbL/yCpvxgqUl67buJjyHEyab1Uz6wAgX+7Ch1MqmRhGmtYsEU8eZ/6eD3:iQLAe83fp9mpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951878, "uuid": "4d788d0b-dfc9-47ac-b68d-70f6355310d4", "value": 8841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951878, "uuid": "6bfce5cf-4910-45a1-ab47-22d3e20c1218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951878, "uuid": "4469f934-3b73-45ea-b4b3-dff7bdf14026", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10c230c-d1bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926907, "uuid": "46f1679f-232e-457d-a724-b0b4a431116c", "comment": "Malware payload", "value": "4e6a56eb80a9ea0d372f13f1585b6a47", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926907, "uuid": "0d100dcd-3535-409f-b77b-94c04aca586e", "comment": "Malware payload", "value": "66ab56be453ff9106d03bff920db7037a7ff4c9bda1930f566c6b6731a787f78", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926907, "uuid": "0565cf3f-c0ff-484e-a327-c1594cd2d4b1", "comment": "Malware payload", "value": "b74b8c4b77a573ccdae2b4e34162acff7f1b18c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926907, "uuid": "fcdc8dfb-3e34-4fdd-953f-ccce8435451b", "comment": "Malware payload", "value": "38dd8a70e4c3d41dc8cfb884349434755f1c953c2bc189d96e178c05efe57ea2209f62d8b904b8debee961e9e336dec8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926907, "uuid": "b5a59818-bbf1-428b-85e1-285aace34b79", "value": "T127E312D72BCF30B3E8D6127A3799875DA18443B2C9F9C46D0AF9014BADB94624CED4D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926907, "uuid": "e48db471-ee45-4a7c-933a-8177f98e7566", "value": "3072:+Aa6eBBDnUvF2/9GqR6CDwOhcBXofnzKbFmxmLg/YhZ6RqdzS7:OvB1nUd23AUBWBXuzKYxmLgK+sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926907, "uuid": "c6aecc34-c121-4950-8366-5584e503f262", "value": 143987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926907, "uuid": "ab437542-18e7-4872-9721-19f491025f34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926907, "uuid": "615fee88-2f49-46a0-9483-1f567e6a9368", "value": "koa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d80396-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958999, "uuid": "cfb9a37f-fa8e-4dca-b9bc-ed06b0ce8cab", "comment": "Malware payload (Mirai)", "value": "1246c230014e39e26a87a80c23cf93d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958999, "uuid": "72ff1994-3e19-41f5-9116-cc65cf990442", "comment": "Malware payload (Mirai)", "value": "675456c78cb4e8f94b9635cea6e2bb74a488fb6fdd906209e2dd7bcaea50d247", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958999, "uuid": "f8cffdfa-1ac2-4a16-9bf6-9c6b1cd83e8a", "comment": "Malware payload (Mirai)", "value": "955b9f402496d2dc59be3a178dd14ad4262815e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958999, "uuid": "99946670-3a3f-4c53-92b3-0acd3db50e93", "comment": "Malware payload (Mirai)", "value": "414a734a1718674aa528c8541dffc4455890d445106b0d25e5f7234ed0ffbf8ea889e7ef87af0581d3ba78b4551f33cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958999, "uuid": "dde30c72-259c-40da-a318-a061cebef7fe", "value": "T11BF0316E0307752B422F9D39757557C57032BB4EB007EE8DBC40A63AE2C8DA86052D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958999, "uuid": "a75766b2-3782-4bd4-b829-e3fb2f4556d1", "value": "12:sh2AMqFKOhoTwAewRWmOh/nAW1COh/4AJKOh/6NIlABLOh/SaqAXF:enM6c1xWPoW1blJDiNIaBoKuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958999, "uuid": "22a93b6b-3f41-47dc-928c-268f34b4c386", "value": 605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958999, "uuid": "2afced60-ceb3-427e-b702-fbe49abab659", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958999, "uuid": "840ecb28-d918-4171-bdd2-087a3bca5e64", "value": "ze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1ed9a5-d22c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764974972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974972, "uuid": "1442b517-3753-4adb-9c87-3a707b72b26e", "comment": "Malware payload", "value": "146abf0251cc97175c327cce6b4660d8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974972, "uuid": "acf184d8-a0d0-4011-a3fb-d11a570b5572", "comment": "Malware payload", "value": "67b5060df30286270b8946f8199c44f5138b5779cf58f9c86fd52b3759bbd017", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974972, "uuid": "6e944b40-372e-4346-8c00-ef09d669ad62", "comment": "Malware payload", "value": "e92cd374078e2644dd4ce3ab84d6d9756bb8db23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764974972, "uuid": "7d3f3827-4c22-4033-adec-5ab5692da9c0", "comment": "Malware payload", "value": "1173353c9c066bba7812d73471dc0220afff1714241b8c028ef4180097c605213f05e7ce4694be5d84b3bb900efa1f80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974972, "uuid": "17b57581-afa3-4b85-b7ab-b8656c16ee94", "value": "T17F11585F29031572D628DA0934BBF9056127834DC0C2BB16BADF1E76C0D9A4C3D95DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974972, "uuid": "62953b74-f605-4a59-b43b-34d7cbed1a2d", "value": "12:78ZjLeZ2LeZ9LeZpBLeZXWFLeZvLeZ7FLeZ7OLeZ7NC:eP0A0V0pR0O0T07d0M0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764974972, "uuid": "47494856-2d4e-4681-acfb-ab8a7cf5c15e", "value": 940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764974972, "uuid": "da342e46-3cb4-4b8c-a72d-7249ea93215c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764974972, "uuid": "8ccaf785-a48b-4f5f-8d88-bc77b35c6b5f", "value": "dvr.lilin-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcb6e23-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944004, "uuid": "7e6ba7b4-cd59-4af8-b1ef-9ea5ce7756fd", "comment": "Malware payload (Mirai)", "value": "252d49683e1431a6dfa1cf6d5ad21fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944004, "uuid": "3b683136-0269-473f-b6b0-39d6876b284e", "comment": "Malware payload (Mirai)", "value": "6821efebadcfcc92f14923358cb17b05b982fb011c0e0947957facdf719f84c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944004, "uuid": "6a6d1e40-5a2c-4811-b084-96b675798ea2", "comment": "Malware payload (Mirai)", "value": "a22c34b4cf2ce74f4bb46fec24560241987176c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944004, "uuid": "35777972-dea7-4705-9786-0fa8e39a368e", "comment": "Malware payload (Mirai)", "value": "7a5c40db660e231fcb8791ba34c5bf6dd1f92cc30b57adaac68e51c933e49b58ec3d4b57996c0b3b99c849f99e3f1e94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944004, "uuid": "6b4e8107-e1a4-4f6e-8ce0-807deee787a6", "value": "T176F48E2AB2B2B1BCD01BC03047DBCAB25531F47526312D7B26C4DA353E66DE1176EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944004, "uuid": "2f5ec81c-df30-4906-93f7-b564cea3bf68", "value": "12288:JateP/JZPyYlrDI4rl7ZC2KzDdNgs8B05cdwHQQHWQBchzhALiAsvayUmtTgHX:0teP/JZPll/I4rPCfzDdNgs8OhWfOLid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944004, "uuid": "f695f05b-a518-4e53-ace7-7a93bf8cfbc4", "value": 772400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944004, "uuid": "f733fa83-9c24-413a-a27f-a3f3a593c622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944004, "uuid": "347d0d69-6865-4919-8a4c-c0b4db44bbcf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0567a7c9-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908553, "uuid": "cfe1ef8d-b037-4632-be1a-349fad783e35", "comment": "Malware payload (Mirai)", "value": "99e5a4bf61de8453911680eacc55d748", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908553, "uuid": "c1f97194-d31e-4006-b2d1-96eff082eca0", "comment": "Malware payload (Mirai)", "value": "685bb17b94bc688e494aba2a2e6cd659103a226050b404c7f270dc3a8de513e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908553, "uuid": "9e6b52f5-d633-4e02-89ea-b3ef5f756080", "comment": "Malware payload (Mirai)", "value": "ce2fe2984b0f73e792f16657db85d980827b513d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908553, "uuid": "c0176919-6852-4066-b66d-d5c4ea9793ac", "comment": "Malware payload (Mirai)", "value": "b28148c78bcdda0b19359e28290e335f3f3f697e0a635e3fd9db1ab1f7ade1afd346ceabe303bdd906964cc85a08b4df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908553, "uuid": "35c01860-4fc8-4ec4-8c4c-f3be3a00d08a", "value": "T1E2B2DFAC124435D4E906C1B107DA4B903FB9076BED929C46B288BF97DE434917F97BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908553, "uuid": "fd047516-4d68-49cc-923b-d77d67c31d46", "value": "384:C5LbZYebQW7tSI6RPB19oWRqVhEhlSfXIu0nGchi87hIC/NtfGYgCuJgGlzDpH7F:CQmDx56f19zRiKTyMi8KiYYruJgGlzDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908553, "uuid": "0d21047a-0b90-43b4-81f0-53ca39a0403e", "value": 23720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908553, "uuid": "fa5cfec8-5144-4bb5-8920-642a552a6f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908553, "uuid": "6438e1bb-6712-46d3-971b-47e39cec7482", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12895175-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958397, "uuid": "2d06dcb7-ea6f-469c-8d09-4f63727456d8", "comment": "Malware payload (Mirai)", "value": "a1232bba1fc9c53d93509a94b6491963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958397, "uuid": "e09fda6b-d4b8-4ff9-9a3a-89e699f4cba9", "comment": "Malware payload (Mirai)", "value": "69d3ce28f0bab781e76756f3fa64275955a05da9a4e49fbe70c504b0953d2fc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958397, "uuid": "c9812e6e-ea83-4a3d-8701-d7acb40cb40b", "comment": "Malware payload (Mirai)", "value": "a3b5111467422bf4ef48b8e25682b6f56aad5b5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958397, "uuid": "71350576-6f4b-45f0-9e45-6b9a17c93ad5", "comment": "Malware payload (Mirai)", "value": "168142350331b21a65c40a808716b5f96a009896a2ecee36aebaa596801091ba13dd79680dc0e373c63feaed33cbe483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958397, "uuid": "4f8bedf7-caa2-4a73-b5ef-f0f4dd55c49f", "value": "T189432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958397, "uuid": "67c988a3-dc0e-441b-8dcb-f3de58a469eb", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwC:RqtmZPuutfbltZFBSJsBcfDSTFI+BEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958397, "uuid": "ebd23307-8ec9-4c45-9261-ef48ff959e4d", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958397, "uuid": "26ca074b-aab1-40bf-b693-ae356688ab11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958397, "uuid": "9d2d037f-6df8-4ff2-b207-61f062c09ae9", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f670b681-d1f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764950619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950619, "uuid": "f5593082-73f6-44fa-afb3-c45e49b73e47", "comment": "Malware payload (Formbook)", "value": "c394bd80317235a96d2cbe8040bf2399", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950619, "uuid": "30e13c88-1bbf-4666-a07e-9bb92c29eb46", "comment": "Malware payload (Formbook)", "value": "69da38d35bb21a461c9162ef5f01769e09d88da821d73906215123941013a8bc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950619, "uuid": "538f4c6b-be98-4426-9ac6-ae7179a08bed", "comment": "Malware payload (Formbook)", "value": "4f46aa0ff3afd494d195950b6cfd0affc933cade", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950619, "uuid": "aea37143-a4b7-44dc-89e3-919616482c7f", "comment": "Malware payload (Formbook)", "value": "3e48ca5285e6da6d718a654e2a9a6b841cc0e8915b60aafb9110eb1437a1e06289d14c0abc5c74267cccd2c9505cb753", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950619, "uuid": "6becec9e-810b-44c6-aae8-6d1d829e33f0", "value": "T12135338949C59F4747F5426483F7AC0E1B8FC4EDA58D1F5A618807DA630FD0BAE82CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950619, "uuid": "44bd63f5-bcb6-4676-b395-4e84418fe3f1", "value": "24576:UFvzIVXybwnwePOkOSsw2iTlmACr7tg0j9yJBAMQZ59IB:0vPwnwugiTlfC7yJBAM659IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764950619, "uuid": "2e756b5a-6157-402f-8e12-28a706442f0a", "value": 1078018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764950619, "uuid": "c1628044-7fd5-4781-8847-86e8bdf7e46a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950619, "uuid": "e2ea4a74-8a7c-47f1-849e-bf50297fa981", "value": "Remittance Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4999a29c-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931001, "uuid": "44ab3651-d15c-4287-ac6a-2ce9f9c3bd6a", "comment": "Malware payload (Mirai)", "value": "e508349f44e47442fabfeb9413e15529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931001, "uuid": "9ea89824-3e3d-4d28-9146-5a0fd54a5d65", "comment": "Malware payload (Mirai)", "value": "6a0e24c1e7b62b4bbd50119f7ae9adeb0ddb0320cdb7db967d854fbf0c05023e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931001, "uuid": "e9697c3a-0fb9-44b3-84cf-0c2e2a83e7c6", "comment": "Malware payload (Mirai)", "value": "828df3dd275ba00d8a706eba4f92ee628c9ff282", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931001, "uuid": "e24e610b-ed50-4bf5-aa5d-85a1c5855460", "comment": "Malware payload (Mirai)", "value": "6135a4232e47c707946512f21b60212d723468308fa0c0244d7b0a1a3785c4fad57fef23d695d0c9791f140e892234be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931001, "uuid": "647cdf2f-7129-4cb4-9fb2-cd2af4e9b480", "value": "T1DC331899F480CB66C6E0227BFB5D114C33135B7CD6DA72068E106F346BFB95A0E2B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931001, "uuid": "a5d56de9-8579-405b-af44-f6e36f02aaf8", "value": "1536:pWxbHoCv1MVX6eWHc113stwEUOtOc0SPJpsgnOHpB6xekt2I9M:pWfIUNWER8HpB49FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931001, "uuid": "42bee247-ad6c-46db-87cb-c094b0a3ebf5", "value": 50424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931001, "uuid": "acdbc070-aa2d-444f-8c8c-9e1e3948a358", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931001, "uuid": "24d459e7-5697-4c0f-aa47-b5c3b978c202", "value": "VRarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b634a82-d180-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764901020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901020, "uuid": "04973dce-f861-4963-92b2-866e9c486f84", "comment": "Malware payload", "value": "0b5c8f608368a888a5751858bbf361a0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901020, "uuid": "004e30e5-e47e-4b28-84c0-476739f159b3", "comment": "Malware payload", "value": "6a1c9f0f30abded1a5ee6b53f0551a7cf7599adf34f1cb6f0d5d62dc5d81a8dc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901020, "uuid": "0fe24d09-5f14-40e2-b5e0-ac793dfed723", "comment": "Malware payload", "value": "7f89e3c7aecba8e10be58394c6584d52561486a8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901020, "uuid": "20000d71-9160-48a7-8632-109a561eb5d0", "comment": "Malware payload", "value": "ebe2c99f3a39da389754bcbba686fff663e3ea5cb02be685a2c80a0edc8ebc181e2e1c271503695cfa3ebe0169e71ce1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901020, "uuid": "a50af06e-bd63-470a-a031-4cf23260cb4e", "value": "T183183323198E9C4BF50A1438402E993FE66FE9B5A92130BF667D3C281773775B608E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901020, "uuid": "c9a3f546-9cd7-4fe1-9650-04743a5dcebd", "value": "1572864:1QxWkwW+Qqu3dEVtImgJYnCyTonffkgihojaFojZi9nH7JfORThDpB:WWk8u3drtUKjWH9nH7RORtlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764901020, "uuid": "c91c4129-bc4f-40ff-8c05-47755a0ae959", "value": 87334912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764901020, "uuid": "fcd82af3-cb1d-4cf4-88c2-d21696789a95", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901020, "uuid": "df1f6309-7023-406e-ba5b-71fde1b20d60", "value": "SecretCryptos-26.2.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b72223-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908850, "uuid": "f7cd1957-04cc-4f92-87ea-dd50530188ec", "comment": "Malware payload (Mirai)", "value": "5d350fda9c3b70de0e7f07aab9aea512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908850, "uuid": "4e92a21e-c4f7-44ee-a3d9-3c69f7e30b92", "comment": "Malware payload (Mirai)", "value": "6a4df13e64060465aa3e8361065ae6f92c74789d1f34fac9858016d1fdac7cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908850, "uuid": "2514d788-32c3-49cd-ba21-175d29c7339b", "comment": "Malware payload (Mirai)", "value": "c7bd0c6808e9611087a9b203c69039a4be671e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908850, "uuid": "36166cd0-f77b-4f67-8abc-2b3682447028", "comment": "Malware payload (Mirai)", "value": "f0a84a1e4d1593bfac2778d1dcbb1b2923968861a3d33022ea2f323148fd6523fb8147276759c7af99efa627e50cd9eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908850, "uuid": "2586b1ef-251c-42ae-b621-df7b913caa89", "value": "T1D473A549BF650FB3DCABCC3706AA2B0129DD561722B97B35B930D928B50B24F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908850, "uuid": "ad5871fe-0543-4eee-8ee5-058213f5f1a9", "value": "768:NHp2vspHpVhzzQ05Tm84tqYsUVNdaV064AWe8Ge+elgeNTCpMNZhGIXi3r7vtOf+:NHcvsF/hvQ0SvMDggeTCpiZhGpHttB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908850, "uuid": "fb6af06e-5613-454f-be0e-803184694281", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908850, "uuid": "2ade9826-8097-4a2b-9196-1acead4c4fc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908850, "uuid": "a9d14f7a-aa20-40ba-a0d9-a9fc9f46e63f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca37bb5-d1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764945904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945904, "uuid": "2a935ecc-2818-419e-9ba2-ca75ac0a4e4a", "comment": "Malware payload (PureLogsStealer)", "value": "8b8fe44737c5a7d5e52b038aab4f4891", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945904, "uuid": "fb5f8509-3cdf-4b27-81fe-e0c38ac2cade", "comment": "Malware payload (PureLogsStealer)", "value": "6b07ab113fff683bf9ee68a55861ccccbb90ed42b0dd6e25976a01db96cc1953", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945904, "uuid": "abd7498f-b4f4-453c-b9d0-d41f047dc1e3", "comment": "Malware payload (PureLogsStealer)", "value": "94bc25d96b7f46b4cd69563cf6af8a044b02a448", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945904, "uuid": "d6266fd8-d081-4a0b-9347-18f4c87468b0", "comment": "Malware payload (PureLogsStealer)", "value": "f6c600f155d796a169f0e2d8fb96ca845022854f1231d1208d4e5269fa2d13cf9e2e589cb5b30309f20a4b702ff49408", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945904, "uuid": "d5d40a3a-3fd3-444d-a1f4-4a94f6a76dd9", "value": "T15E2533C28BA5CEF97750B409A53C5D67D20A8386DD7F0AB4821FD7136213E907A6E42F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945904, "uuid": "ad11b49f-e2a8-42e1-a64f-1be26b8beca9", "value": "24576:f1j95AeV+sUE7saU1Bi4pvI3Y9teWbGfNrw3ED:fXOeV+bbX1BtQAeNrw3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945904, "uuid": "8756fee2-51df-4b6b-bbb1-a6fa6d9eb0c1", "value": 1034565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945904, "uuid": "5141de41-bdad-468d-a056-7288ac9b5c78", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945904, "uuid": "0b4f92ff-cc6c-47c4-9c6b-84ff07f00ea0", "value": "ch\u1ee9ng t\u1eeb v\u1eadn chuy\u1ec3n_8009377622.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0808ccd9-d232-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764977277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977277, "uuid": "6dd3ab54-aa14-42c4-8ce7-2ac85c771252", "comment": "Malware payload", "value": "0bb911e92d3a113ca5d626745d42ef72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977277, "uuid": "59050e2d-50e0-4349-a2b5-f966e55fdab2", "comment": "Malware payload", "value": "6c2d95cd77f2f6f73e81abddcd2c53b198b9b0b7175e4a60bf0ecf25915d6cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977277, "uuid": "ff3c3693-6779-474f-98c5-9be2c5b2102a", "comment": "Malware payload", "value": "adb14469e23b9936319f1b13c8cb7c875ffe03a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977277, "uuid": "b7689973-54a6-4fc4-a121-4cdba8efa0f8", "comment": "Malware payload", "value": "c6eeee3d08ae9ca0163305bde85453814618a715b71e1e0f2ebd6383354328e6c68126b34dce48c664f8b77ea8df952a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977277, "uuid": "2b6bf79c-510b-4b74-9ad4-f0c5edcc9e03", "value": "T148665A42B9A255A5C5EFE134D462665073B07C1A43303FDB9FD81A691E3ABC4273FB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977277, "uuid": "7429e006-af66-4d4e-91a2-e5b88c53aeef", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977277, "uuid": "be8da886-0041-48d6-b9f7-404e173dd608", "value": "49152:lJjo3Kp1hXSIkfQO+h7Hzffjgld/Rk5wv/LRFn8Z3xK16CE:Do3r27TfLB2F8cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764977277, "uuid": "6bf0ab77-15bd-4902-a6d3-88d0eba3a46e", "value": 7036544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764977277, "uuid": "b29023fe-8274-47ee-885a-08209cad1da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977277, "uuid": "27461098-856f-4cc5-adb9-11b34895d685", "value": "SecuriteInfo.com.Win64.Malware-gen.11142533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25de4cd4-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908607, "uuid": "e32b9002-0b75-4440-87ad-c1a8bb866957", "comment": "Malware payload (Mirai)", "value": "5d0c27592bc9f62f40afea36283323f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908607, "uuid": "245f013a-4ab3-4b07-9a33-534f47e8bd00", "comment": "Malware payload (Mirai)", "value": "6d0077cce21b68c9fb1c1935d1c18f85957391a8fd1142d20a8be8235fd7d14c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908607, "uuid": "8b29fbbe-7bb2-42dc-8d56-d403b8011e1b", "comment": "Malware payload (Mirai)", "value": "d74a39b7bd42b787615f6e0ac8968e4607fc0e94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908607, "uuid": "1c18f70a-29c0-451a-827d-e45521c1a07f", "comment": "Malware payload (Mirai)", "value": "0839b3b7c4c1cf9af8496675ff06709df868b2d64e1728361ff7cac3ae8040387f250b3e364d4dcfa1e8cd88e93c95cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908607, "uuid": "bc6a30cd-363c-4352-8b05-8a283e1bcde8", "value": "T1AE63A41E7E229FBCFAEA863447B78E16565933DA37D1C181E16CD6112D6024E340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908607, "uuid": "2bde0266-35ba-4107-b5b3-51b7e654ccb9", "value": "768:/oTXXcvJv674Hw74H7TugCD4qYZtVekcvq4y5Eqv5ytQETInsdfd2VygIZrXZOn5:MX4vqpsXeAe2UTInsZZrXZsIRwAYPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908607, "uuid": "5989c0df-9bad-42d3-a970-2410cc686cca", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908607, "uuid": "07b57f12-ad30-4fb5-ab44-387379253d02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908607, "uuid": "b785f8a5-d569-4b02-8b96-3ecc435724ac", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e85880-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764956006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956006, "uuid": "9b7df533-5df0-4942-9ebe-4f2b799c8ab1", "comment": "Malware payload (Mirai)", "value": "63e13e3e049320e1d8b8f362b160bfa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956006, "uuid": "664de87f-4f48-46f4-b26a-eb4ed29ae4eb", "comment": "Malware payload (Mirai)", "value": "6d120feec271153712f68ac4eed94348d62d041165e2c522a8592feb5db25368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956006, "uuid": "88865718-bfbc-432b-8390-f0095cca5a12", "comment": "Malware payload (Mirai)", "value": "94414d336a187aecab06b4fd9c6a5ad18da84384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956006, "uuid": "e4e57840-03df-4382-836d-b8977a22a4a7", "comment": "Malware payload (Mirai)", "value": "caae294d9fc0eec9781d9761c5a2f97d32442d963db6b429d90ef8d99e89dfb979bce7a15d09e5e9cf0393c2c68ae941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956006, "uuid": "387bafbc-372b-4d1e-8f5b-2892a913c40d", "value": "T1EE64F60AAB210EFBE8ABDD3702E91B4129CC540B21A82B757674D958F54F54F1AF3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956006, "uuid": "0d1554d6-f54e-4039-a7ba-5ce563fed036", "value": "6144:Gq6qdNOQu4uDdBV4eX9kJ+P8OEO+JY9xXrVJp6M++N2jW:Gq6qzz+P89Gxvp6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956006, "uuid": "d79ebb81-dc65-4cf9-b38c-bedb35b99de8", "value": 333920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956006, "uuid": "8e6c1a1f-24af-4f03-9960-fb983d0caf85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956006, "uuid": "030758d9-2726-4b09-b082-e685a83e8fba", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376b877a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958888, "uuid": "33e3d4ce-5e90-448f-8038-477ed52c2e08", "comment": "Malware payload (Mirai)", "value": "eea7c44276ceaa65af6dadc7b0d3c395", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958888, "uuid": "bcba6d02-07db-4ab9-8a68-c53a8dc7fe52", "comment": "Malware payload (Mirai)", "value": "6d3f52e60c34ab860794f3341ea45b821b70b314640e29dc70ccbc24e88a2dbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958888, "uuid": "779ac96d-2a65-476f-be1e-3b3634c7d740", "comment": "Malware payload (Mirai)", "value": "828e338008a265296558ecfb0ba2400c910d5d3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958888, "uuid": "cf72592e-9d82-4d6f-b446-0a660403d9aa", "comment": "Malware payload (Mirai)", "value": "971e04c2ea7188324bcae3db9d23b6665662d7b06fb895d46501d784c3d4fe180472964ae0d54597ee47151256f26861", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958888, "uuid": "11f83233-64e7-4a39-9ddf-53e2d3aa0160", "value": "T19C531745BC919A26C6D422BBFA6E41CD332623E8E1EF7207DC215F15778A82B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958888, "uuid": "8392b03b-7385-4792-9978-6c71220aa84f", "value": "1536:R1Y1Uwojt9mmyjSvnR0TTpmipgoLOeJStu:R1Y1UmenWTTpmcdZStu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958888, "uuid": "0fc23401-e3bb-48ac-a1d9-bee4536445a0", "value": 61400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958888, "uuid": "cdbbc118-53dd-466a-bce9-ffd589093e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958888, "uuid": "89488348-511a-4bce-af9f-79e430dc3792", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347b0c21-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958883, "uuid": "2806c75c-581b-4831-bd6d-4d00b0609823", "comment": "Malware payload (Mirai)", "value": "09ac18798d46d1c107e9700a787f589f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958883, "uuid": "d0ccefd9-be6d-4276-a2ef-4aef67fda3fe", "comment": "Malware payload (Mirai)", "value": "6d4b447aed77888df8f355adbc592f76062b2e600d2ae8816134c0ebe0ac600a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958883, "uuid": "0acf46ff-8eec-4fbe-a4a1-6893923d4e87", "comment": "Malware payload (Mirai)", "value": "9b43170a59474e249a6b8460efff463e041e85d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958883, "uuid": "d73018d2-ee59-4aa2-ab3a-0c571457b6ee", "comment": "Malware payload (Mirai)", "value": "d6bee5d286f3d5f76529db8bfe6fa2b2e9c1392c1c42a3e44dd8f1c509f4c5a038ebdd7becd93c0ae40f9cbbc1d13896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958883, "uuid": "9bdde8fe-24f9-4328-890f-50588ac5ef8f", "value": "T18343F846B8818B25C5D413BEF92E118E33276778E3DFB212DD105F25778A92B0E77942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958883, "uuid": "7d5811d6-bb7d-41ad-be82-b74278058e81", "value": "1536:X9nbt2GLpNQ9e5b030/qXYVVNb+PMriUGqhMxUu:NVNBbmXYvGqhMxUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958883, "uuid": "f979e888-112d-4211-b11d-6fa376cd4323", "value": 60344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958883, "uuid": "62375a4a-45d6-4406-bb37-9f0b3c9d31d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958883, "uuid": "9baedfed-3adb-4a44-8893-80e4793314bd", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b75fd94-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958465, "uuid": "a19c1aca-14f1-4870-a4b6-397c82c848d3", "comment": "Malware payload (Mirai)", "value": "10d37f0b9c9eb7451168bc9e5f9dc002", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958465, "uuid": "cf291241-8a18-4378-9ecc-2d9f644adfbe", "comment": "Malware payload (Mirai)", "value": "6d82996ebe0f175dc316d38e0b57eb0ae45bc0f88802c06a185321b62d0e01c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958465, "uuid": "eb45955f-a2e6-41ac-aa11-7fb365ffdc1e", "comment": "Malware payload (Mirai)", "value": "1a361135344c5e617e0e7c3a80cedfd66a8f75f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958465, "uuid": "eb6e007a-8582-4295-99e1-83cb1e52a54f", "comment": "Malware payload (Mirai)", "value": "00091f7926adf29a5018a15b330bac81641a2f876bb522316fdac406499cf77d34d87e524fa3f5cab95bfa07ed24b312", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958465, "uuid": "086ca942-60a6-4f50-8982-1ac02eb7fd29", "value": "T187E012BD002FDF1781209D15A07A6873B037EBDA9161CE09AEC4A436A1989207132E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958465, "uuid": "6a23132a-767a-4093-8e51-dd5327842e55", "value": "6:LA5/rHJDA5/laLaNgdhA5/pFGNIvLK2LA5/nfiAK6ifn:shVUhlaLaNgMhSNITKhfLK6on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958465, "uuid": "a9d7d04c-0c53-4e1d-b6d1-e43049362311", "value": 306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958465, "uuid": "e638127f-74e5-4166-9f69-b8ffa0c0cd82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958465, "uuid": "c313520d-f9ca-4e06-8b05-1ac0d19ea295", "value": "tplink", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c4dff8-d1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764935018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935018, "uuid": "952dd663-d79e-4725-b927-031af059ca35", "comment": "Malware payload (a310Logger)", "value": "06baee2694e56bd3a278f01f3e1b7a52", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935018, "uuid": "23b05368-6ab6-4ee6-8118-80516e8c0aa9", "comment": "Malware payload (a310Logger)", "value": "6db5f79910e4bebca9ae697218a61af897911e094fb4d8c557edf593286b5ed4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935018, "uuid": "88019c3a-6acd-4255-9bb1-f643d8ddb9e7", "comment": "Malware payload (a310Logger)", "value": "dd7621eb36ba8d70381996d0e62b1f446584f883", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935018, "uuid": "db622e68-cde8-458e-8786-52d7a2152288", "comment": "Malware payload (a310Logger)", "value": "543cf96957b00cdf3999fa59290eb8fefa748e34671cbaa80d94c053d5f02876a6a6388038938802cad62c9a126da730", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935018, "uuid": "e7576534-aefb-4d68-9d97-f606116e81b0", "value": "T13B65E067A1F18432E153DAF19C06979E542DBFB43EA1A8053ADC3FAC8F356292D16073", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935018, "uuid": "0a6cfb23-5518-49c8-8cfd-7cd6c64e515c", "value": "13bc6d32cd3b7cb8c8ca43a1341f4a8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935018, "uuid": "5f823e86-f4ca-48f1-bd97-17692996f363", "value": "24576:DC9jhfJNTIi6GB7FqyJ52Kf4pA1iuDgm0URj3rOVEXP8Sb+rC:DY0GPqyJ5Lf4poL0UV7OVcPx+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935018, "uuid": "eb50dfab-24ba-4a99-ab1b-442b0a58d1c2", "value": 1490944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935018, "uuid": "29cf3df6-638f-4f1a-accf-2e7136931261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935018, "uuid": "1a03aabe-edd8-4d2a-8970-2b58245e8509", "value": "Payment_Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efd318b-d226-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764972188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972188, "uuid": "0c854e02-702e-409d-b8df-13384c370ef8", "comment": "Malware payload (ConnectWise)", "value": "26834626b401cfc6582528a1c9c450e8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972188, "uuid": "b6657445-0717-45ba-bddc-e23d443a4787", "comment": "Malware payload (ConnectWise)", "value": "6e36b1b3d3ebc0144c0dbe34355fc0c2d232ad1b08358558ec8f41154ec91cc0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972188, "uuid": "2a26f975-4319-46ea-a678-be6cd3395683", "comment": "Malware payload (ConnectWise)", "value": "17f26bff4892aad59c7f798ea3552f97fe3f23e3", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764972188, "uuid": "d8019902-495d-4ff6-b68e-c6f3d36ab362", "comment": "Malware payload (ConnectWise)", "value": "377aca353fc91432dc904d5672dc737682437cbf98195f11f4eeddcca67192cd4efc7c2111140c01ae2bada30ab8e097", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972188, "uuid": "5b8a8583-bcd3-4d5c-8c9d-52c69dca5864", "value": "T102A623362BFA8418E0F26F35ED3A91B1493A7D259A22D02F13A57C1E7DB5E448173732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972188, "uuid": "b74887ee-fb3a-40ff-9948-4fadc587b942", "value": "196608:KQtw06rYIU0nj/LQtw06rYYQtw06rYSQtw06rY5Qtw06rY:KQm068VSQm068YQm068SQm0685Qm068", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764972188, "uuid": "07051279-17ac-4a54-b10b-cbd58d3c4e17", "value": 9973760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764972188, "uuid": "55b4d725-91c2-46b1-84bd-2a0806a8fcbd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764972188, "uuid": "5af7e3d6-fa8f-4b69-9ce0-5b0559fc632e", "value": "ssm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ff3dbf-d229-11f0-a129-42010a9c0007", "comment": "Malware payload (CobaltStrike)", "timestamp": 1764973512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973512, "uuid": "4183daae-8f0e-45ff-8bfa-770c5804f297", "comment": "Malware payload (CobaltStrike)", "value": "51ca905934a490adae498eb8a29a292a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973512, "uuid": "4a6b370f-4a01-4b1c-8200-92502a1419a3", "comment": "Malware payload (CobaltStrike)", "value": "6f0c0284719b3d4eb15f796f04d806171118fa5c4b42e5cb38433c68d6f919ec", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973512, "uuid": "8fc8e424-5f74-4b04-a153-85c80de424c6", "comment": "Malware payload (CobaltStrike)", "value": "b8bbf9977c7987e1c754d9f2c0f59ee8d2ee7fb6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973512, "uuid": "88268756-ef80-47da-87a2-ca408985f569", "comment": "Malware payload (CobaltStrike)", "value": "e161cc83054e25abd2be3c536da6b257b8e889f18ee1fbf2cffa85400d4ab25a07fb89e3adab885af487dc4cefc92194", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973512, "uuid": "e5adea01-5e0c-4f86-ab96-d3eb6181479a", "value": "T11A92EA3FE7136CE9C106D5B845FF2733DCB13DB385A6A72A1724D2B42E106A46E6E510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973512, "uuid": "56ae4746-5189-4cca-94d5-2b2e5f76672e", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973512, "uuid": "61de9ea5-af01-4341-aaf5-c618a225b084", "value": "192:zV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2VPdps65DwWF8qa1Dojjgi:dqaCF31cix+Dc4zjKPdpJFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973512, "uuid": "b2ef4621-8cf0-4683-aefc-eb9d99ddcbf0", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973512, "uuid": "532f09f4-bfce-4fee-826d-74aa221ed556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973512, "uuid": "c97efe54-e814-4062-b1e0-b2be6ac840bd", "value": "RD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1180bf93-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958395, "uuid": "f2c61fac-902f-42fb-bfeb-3494937f7c7a", "comment": "Malware payload (Mirai)", "value": "aa0cc285ebfd587a499c58ea6f3dc0e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958395, "uuid": "c4736708-b71c-45f5-a4bd-03de8fc329b0", "comment": "Malware payload (Mirai)", "value": "6ffeee27593bd8c454907f3b99bdf29645ca05cf746b4f0bb060c9492071c325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958395, "uuid": "5a917c9e-af22-409c-b0cc-a72e7e59b35d", "comment": "Malware payload (Mirai)", "value": "24570b38dd58c22352deaa78f7a41db70f6a9019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958395, "uuid": "8ea63db4-b5a7-4702-aa2b-9a6368867a72", "comment": "Malware payload (Mirai)", "value": "292e98515dd821a0fb1d784c016390c07027ece80c7247c7806fe0aeb5b0b356b84107a7a62684fb0dcccaf522aa21ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958395, "uuid": "5ebbd6f8-9a70-4ba3-bc6a-20703be6e943", "value": "T19CB2C0CC61943484CA8D7C7C678D4A664F6CA090BAED9B25E354CD98B3BAA8B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958395, "uuid": "783cb5d9-d2f9-4d91-80e8-bbce9b72b690", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpxmZqSWvK:4QlS07FUXqIYSXQKquxqqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958395, "uuid": "9be09609-9301-4327-9f0b-a04b23e4a3ff", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958395, "uuid": "91e66258-ed10-4e81-9610-b2073babdf55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958395, "uuid": "b4b616a8-4ea9-43ea-aa03-7ed639ae8d77", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367f6ba1-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958457, "uuid": "aefe863c-faca-4286-a7a5-0531e65369ca", "comment": "Malware payload (Mirai)", "value": "9445fcea697d16504f4a4b10a411df2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958457, "uuid": "f55b9c0c-8a28-4eea-85aa-0cf2090f583b", "comment": "Malware payload (Mirai)", "value": "70227f75450bcc2e6dae62b7e9260f1eadb9d3d678aa3346e1c7b12e2f5574f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958457, "uuid": "fd3ffc75-8848-45cc-b9d8-bbec4d26b68f", "comment": "Malware payload (Mirai)", "value": "2aab5cf258ed783a88e85bffd9b69d288d4aabb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958457, "uuid": "97e35c64-feb0-4b97-bfff-9b2c4faa3f4d", "comment": "Malware payload (Mirai)", "value": "4a10d94cf4f3e1eaaf72fcbf075e1c2f5f88599d5432bafef5a3c79bd074576979ad241fe9468eeaf1d588a02ae257a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958457, "uuid": "e29cdd30-14f1-4d67-947e-bf571dda8ae9", "value": "T1FAB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958457, "uuid": "9a0eaa25-7312-48b4-8b61-e0e4d6f190fa", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1V/LWy:c9sSyzz36YaWWgg1Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958457, "uuid": "b2a887c5-f4b2-4a97-8216-a97ddfc17f11", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958457, "uuid": "71fd5f40-effc-4604-a5a6-09f3b22eae5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958457, "uuid": "c93f5333-da8a-47ae-a8d7-56829eb69380", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6d169f-d1d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764937024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937024, "uuid": "a15d75f7-5bc9-4313-8e8d-2d24023e44b3", "comment": "Malware payload (Mirai)", "value": "1a17db9d3a55c176c310eb4b6ec6ce64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937024, "uuid": "70fdef06-9073-4f29-be2f-3c45bfc85cad", "comment": "Malware payload (Mirai)", "value": "7024642d5bdb4739e2552874852e6fe1ae69d85dac8ffd2008cfeb120c6ea0aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937024, "uuid": "c932bc21-f8f0-40c2-91fa-d74739f1acd9", "comment": "Malware payload (Mirai)", "value": "15bcbaabffe413fc2ca4b1e416f19a758617a80f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937024, "uuid": "29cbf86c-8ad4-4811-b3f7-e39aa7f04b66", "comment": "Malware payload (Mirai)", "value": "daf876656426261cde71a3afb3533610cd7a048b2a2f489c0aaefe84f6cf0526687b55075c4f6e35c499dab38e11a220", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937024, "uuid": "9e1dc8a3-e578-4741-a071-a4aeed6e9b5c", "value": "T10C11467E64C1E6C5DA94DA047476F6017758ABF111C03F1871DFCABAC09A9043B15D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937024, "uuid": "e9cad6be-9c35-46da-8edf-21e879fca2c4", "value": "24:eUYISPYIS+YISp6YIS5YISYYIS7GYISbYISiYU:eUYZPYZ+YZp6YZ5YZYYZ7GYZbYZiYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764937024, "uuid": "81c5d28b-5144-4845-8026-53136a0ef17b", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764937024, "uuid": "c3027ac7-4ef4-498e-b0af-a3556322d58a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937024, "uuid": "b628ace4-983e-4e91-989d-7447f6bd2933", "value": "router.draytek-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccf7720-d21e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764969071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969071, "uuid": "e834cc9b-9835-4345-bbeb-524309334bf6", "comment": "Malware payload", "value": "e6695926b0252dc4bd8d94953364cd2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969071, "uuid": "4793b857-8efc-4852-9100-6df9069c5935", "comment": "Malware payload", "value": "70357cbe6e3eccca3792fe17a0c8a2976a4bc16e851ee04dcc2cf8da553b504f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969071, "uuid": "19308bb4-ce4b-48a1-ba43-a42bbdfef293", "comment": "Malware payload", "value": "ef6ae9d1486c386afe6bdc4ea83fc7328dff4e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969071, "uuid": "9ca45c05-f816-4b20-bc41-0e423c0618c6", "comment": "Malware payload", "value": "4b3df39c12e8f1f2fcd89b646ac6e9030eabc81455a0f46e51ccc3c3e7d464611c4b5554e1469ed2b8260b5c532ed794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969071, "uuid": "e996d5b7-3724-4419-b636-e0b118f256ad", "value": "T11F864952F9864966C59AF234DCB1A21077717C1803337BD76FAB06651CEABC42B3EB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969071, "uuid": "7d83358d-5564-4779-aefe-acede51b73aa", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969071, "uuid": "65fb47e1-a8b7-43b5-ae15-770f987e2418", "value": "49152:W72KZ13nrqG+VK1/9Bs0uLZsftDuBR5/ZKdnMmYQBFmQdUuBoL2b:Y131Ts0uLGFSr5/ZKdOQCQdUuiKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764969071, "uuid": "c033f347-1c70-4ce3-9ee9-32e83165e35c", "value": 8309648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764969071, "uuid": "1cd26494-eee3-4041-ac69-209e44f7bd26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969071, "uuid": "bde92ecd-4d52-4f19-b446-2b419e86d114", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dbb313-d1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764951312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951312, "uuid": "571c81e2-3371-45ad-ad6a-9949185ac258", "comment": "Malware payload (RemcosRAT)", "value": "0f2163ec01c64b52f314b0562b61786d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951312, "uuid": "74ea27ec-1465-4080-995b-26680c83fc2e", "comment": "Malware payload (RemcosRAT)", "value": "70d1c832e97bcc3a1c2d4803b9dfcce4b67e3bd422f93848a7bb0884c9e3cabe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951312, "uuid": "4eade559-1e2c-4033-a462-b744617fc855", "comment": "Malware payload (RemcosRAT)", "value": "ee8b55562b3baa5f0b953957b603836438dd9dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951312, "uuid": "5472d347-7067-4f47-b73c-594fd4799a98", "comment": "Malware payload (RemcosRAT)", "value": "639c9b8fcef92c2c209e41c1d3f4330c4c6007d8bd151e724ccf65967db67fd002ab3aad4d9623216550324787bad9ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951312, "uuid": "195f7ecd-2472-4867-9f44-51e6c57c6aee", "value": "T1DA65DF6AA1F18436D223DBF98C16938A14397EF43EB56C0537DC3F5C8BB5574282A1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951312, "uuid": "06492981-0113-43e4-b715-402315ac5849", "value": "9c4555569e4cd0e05606fabc204201b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951312, "uuid": "7ea9b8d5-d776-4971-8a84-0a2e5d0f9a7f", "value": "24576:GEkPEEYUY5OM1jHmB7FqyJHc6p3Dp+GTJSSfp9jTGzkATCpxch3+NVS:GZMJEPqyJ8u33TJSSR9nuJTuY3SVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951312, "uuid": "c4bde0ba-ca54-4722-93a7-79d378de6a4a", "value": 1481728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951312, "uuid": "9e387bfe-8c55-4a79-bb4c-b495d4831283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951312, "uuid": "512e6016-e7b9-49c8-b13a-e05f2770383d", "value": "0f2163ec01c64b52f314b0562b61786d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5010208-d1e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764942402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942402, "uuid": "4bcc1f51-c303-4382-9e8b-8fec2dca9dce", "comment": "Malware payload (Formbook)", "value": "2ce7e0dc7c6db5198b34eb5349f9d997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942402, "uuid": "0a6871d9-6169-4fb6-adf7-6051b11c5cb2", "comment": "Malware payload (Formbook)", "value": "71a9e83b84c4264633aa8c851dd8111382c7f9302356d4150c0f0a443569a309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942402, "uuid": "1b7fe80e-2b6f-44df-9ce8-2e8710b8a888", "comment": "Malware payload (Formbook)", "value": "9fde2cc57269c0a4ec604833df647b1778cf1dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942402, "uuid": "37db7600-24b1-4747-9ed5-37ae9d56d52a", "comment": "Malware payload (Formbook)", "value": "b31e74b9571ea47715d5fd66699f36b89d3f7f7985fff575eb07bbd0ce40857bc96e871fcc309d30ed1aadf5a9dc5899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942402, "uuid": "fdea1eee-8763-4564-ad38-caf95738d249", "value": "T12D45BF0273C1D062FFAB92734F56F6115ABC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942402, "uuid": "b1b19359-0843-4cc8-8403-a1c4d487f303", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942402, "uuid": "efdff916-a854-4b06-8d01-f314d5664648", "value": "24576:85EmXFtKaL4/oFe5T9yyXYfP1ijXdaMpIMNfXBSb:8PVt/LZeJbInQRaMpImfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764942402, "uuid": "cd5d07d2-d7fa-4938-b21a-48ae336f17b3", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764942402, "uuid": "14ac68d1-f8d5-45e6-8135-d656cdc2a05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942402, "uuid": "eaa6214d-8cae-48aa-81fb-ffe244822dcc", "value": "71a9e83b84c4264633aa8c851dd8111382c7f9302356d4150c0f0a443569a309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2332d637-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958854, "uuid": "91592fe2-b89f-4739-91a0-3a577a9c3720", "comment": "Malware payload (Mirai)", "value": "d523ebf593e9ce5a60652a9fe5b8236b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958854, "uuid": "416551a0-41fc-4b7a-9691-2a9d7d92ec3d", "comment": "Malware payload (Mirai)", "value": "7246273ae61d34fc1d5666ee66dc6c83ebef35cb9c0b8f993e26ba952addee4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958854, "uuid": "b1231145-5b42-43da-bf17-155ab2fff35f", "comment": "Malware payload (Mirai)", "value": "9ea686ab4c623b99636a94b685db43a636043ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958854, "uuid": "4f311ab6-6a89-417c-891a-9fdf1febe083", "comment": "Malware payload (Mirai)", "value": "3331a492125f8a17f051fca2458a0c5c439b4ea65ade2074b0a59ffd59ebb7f160c13f56d1c2d41a2a2bc33addc753d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958854, "uuid": "aef16981-7aa8-4e3c-8ff9-54351e5ddc08", "value": "T12F63D80A6E269FBCF769C73547B78E319688339627E1C641E11CE9005E6074E742FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958854, "uuid": "5cbf1430-7657-4b98-9189-1069eb8a8243", "value": "1536:c4GEFKG2LAz6Xn/TM4vMKB1qtPjEnjytnjje6QP1kJur:xrFKHLAz6XnfMKB1qNQPaJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958854, "uuid": "6c1156a4-e909-422e-b27d-3df08fd342db", "value": 69772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958854, "uuid": "41660c3e-c395-4b51-b2c3-283b86664c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958854, "uuid": "bd767652-7fb1-4796-a68e-d67669d87dfb", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc00b1e-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933635, "uuid": "0a2ec4a8-5726-44fc-9564-16429bd80cb5", "comment": "Malware payload", "value": "dd7544441324590c0478612f9b55a496", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933635, "uuid": "751ced26-46ad-4ee4-aa9e-e92b40121a35", "comment": "Malware payload", "value": "738af55a70d7fcc258944162bfdb49a6972435f972c0101f3de953a3c91ce3af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933635, "uuid": "2265dc07-552e-4ef4-8218-c1d8b453fd97", "comment": "Malware payload", "value": "664cde76b34e9b6a4408f753356c1b129614e705", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933635, "uuid": "b35475f3-f71d-4353-8fd6-ab30624afed8", "comment": "Malware payload", "value": "5708fba2ec9a119cb34a92c39a41b4565e2b039ba794c175ceb95e88e458523bfd3f6d20c3953ea96ce47f0387fe21e9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933635, "uuid": "23ffeccc-7d02-4171-b3d2-8015e24666bc", "value": "T12F942349B02EC3D7C31F7A2AEAA4A3413FBE20F712D99D6B4752653B8DD55BC49A0301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933635, "uuid": "bc8913fa-6c31-42a6-a5e3-b24c177709bc", "value": "12288:+p5UgyRBgrvDqdt7rdcLddbYXP0iZNnTtCs:05UNgyd3kW0aNn5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933635, "uuid": "12be255c-8b51-4d11-b8bc-1deb4191a2e9", "value": 429561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933635, "uuid": "ee4493bd-1a26-411a-85f0-c61dcfe5c016", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933635, "uuid": "3c8126dd-7328-4643-bbeb-68440e4ec29d", "value": "5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004c0e54-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917134, "uuid": "ff9886bd-01cc-4ed0-bc65-04958576d557", "comment": "Malware payload (Mirai)", "value": "48e24945d7e4beb9023be31a1ac7389c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917134, "uuid": "67f3878c-83f4-44fd-a8cd-4a8d8e311a58", "comment": "Malware payload (Mirai)", "value": "744fd4925023bb27ae18de554ef34367871e9ceaea7883b38aadbecad70a15c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917134, "uuid": "ed94621c-fae3-427b-832c-ca97a7af1372", "comment": "Malware payload (Mirai)", "value": "a936c87f749556da181bac68b227d9c44f76522b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917134, "uuid": "a37b77d2-b56f-4d3f-a102-1605fe425933", "comment": "Malware payload (Mirai)", "value": "bd8057887b3b76f2f1957d7e687c578fd88180e056776cc53cad14831fd486499eab97eb4a8a730c3070f1780466d065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917134, "uuid": "8432a54d-b7c5-411d-90a0-f1e273fd5664", "value": "T1333301B02B9BFBF1E231A237B02D0615F19BD78400EA30A284E59F0D7DDF50619A60D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917134, "uuid": "b59fcfcc-3cbd-4d0f-af64-494d657c1087", "value": "1536:Gul4c4o/mUm5+Q2QIidnk8HMtLcPqF1aBexo4opKZZaXKZ:l/obwidnkHtLGqFUFraZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917134, "uuid": "8c7b7087-ac56-4854-923d-ae6871f181de", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917134, "uuid": "dbbfc59f-68c5-417f-a4b0-e77805aaa1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917134, "uuid": "12219c0e-61e5-43d5-9fbc-3d4721285d0a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955ac435-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908794, "uuid": "4209a9a9-cf0f-45d1-bd96-a713e8ab8c8d", "comment": "Malware payload (Mirai)", "value": "a9ec57ec953ae26552a4150f159076ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908794, "uuid": "3526d4bc-e45c-412b-93db-49ea681bd987", "comment": "Malware payload (Mirai)", "value": "7486768248bdfa83ac92ef9bdb8817e1192f1b8c31cd2bf036acad71673a7100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908794, "uuid": "40474859-8a44-4bde-a6dc-12c769a92c6b", "comment": "Malware payload (Mirai)", "value": "0b4215ab2c78ee559c6b474f3d6a9a73b4e80f3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908794, "uuid": "9f9bde7c-beef-441b-bcdd-c2f4ff4dba27", "comment": "Malware payload (Mirai)", "value": "b87929b9ae3e18ce760b0844fc184175b09ad94ad0178b5e02cdc11f38eaf664591f77ecb553b0a810a13981dc5fa519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908794, "uuid": "15ad3982-36e1-4985-bc7c-a53bb8064967", "value": "T184E2F16383729452DE783BF1F9AD81C62BBD4BACC57770A3261557282D9B0435E3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908794, "uuid": "4922d0b0-995b-4b12-af96-44c7a1d4f9d6", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XRot9q3UEL5Iv:Porm1vpALgUJRoALg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908794, "uuid": "f614d831-701e-46f0-a5b7-b09af82594bb", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908794, "uuid": "34bc6d22-694c-4ce2-a20f-88058e08602d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908794, "uuid": "1a179b55-61de-41c2-bc96-38b4af5fde2a", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7705c17-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917495, "uuid": "5c49b5bf-cd1f-4621-9207-bacb72a633fa", "comment": "Malware payload (Mirai)", "value": "08fdbf78e51c8141b57d2618d3a9124f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917495, "uuid": "2cf59214-58be-4586-80b7-4b544530fae0", "comment": "Malware payload (Mirai)", "value": "749530dab7eecafd4f1f7d3b63bf1c0ccf2c0ed95ae73cc6702794f640c0116a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917495, "uuid": "2ed2624b-86c1-4bfb-8a61-0c26f6c0864c", "comment": "Malware payload (Mirai)", "value": "8b59a1dffe4e4c82f3a5d2762f83729307e3ccf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917495, "uuid": "b133a88b-4a38-4f3f-bf83-714316de7a4f", "comment": "Malware payload (Mirai)", "value": "cd06d8262fe2c7070bb609c6b95ac8e006ed07f618c35ce9a10281666a30c335534ce19072eb33ba3adc0e54a6dce623", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917495, "uuid": "db230e02-df7a-4087-96e3-51ef274c8bf7", "value": "T18A93395BBC919A11D5C102BAFE1E118E331307FCD2DE7213AE24AB2D778796B0E7A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917495, "uuid": "770e993d-71b7-484d-83c1-591a520cfc8f", "value": "1536:yIn40elMAsu95IbNX2OnJ8XbaMniZCS6PbaXwpgKx5IYLk0YmSY1h:Wb195aLCS6PbaXmHx6QlY7ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917495, "uuid": "5ba61a04-a1a4-4804-bd8d-61d21e00e5ab", "value": 95668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917495, "uuid": "83d859f6-4b00-4fbc-ad3c-ab1fb5111343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917495, "uuid": "26dc422f-e0e2-4bbc-b310-8f62f9212598", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f087022-d190-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764907817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764907817, "uuid": "8cd25614-0cda-436a-8df1-215da5aba346", "comment": "Malware payload (PureLogsStealer)", "value": "79a836955879f3f29f6bb9aeb55b100a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764907817, "uuid": "f63c6b3c-db76-4d0b-a559-a3f7acc7b6ca", "comment": "Malware payload (PureLogsStealer)", "value": "76ac49791efa0c83937856dae3613c404cb470573263e82590b5c22b2e519f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764907817, "uuid": "95614a35-0ed6-4e70-82fb-aa41bf190327", "comment": "Malware payload (PureLogsStealer)", "value": "b0082cbd16cd958f3bc1337a62f9ce1bcb8b9e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764907817, "uuid": "3dcae1d0-73db-4cbc-a290-cee45d30d430", "comment": "Malware payload (PureLogsStealer)", "value": "8530cced9edfdbddb57faeae271766e1aa4b1ef90d98707b3bb2335449bea307da01f084424aeecc2f0305110b9a42c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764907817, "uuid": "f8872005-038e-4aef-9fef-0327a3e6e29c", "value": "T1C2C4CEE0FDD2D155CED116F6C82DD99D8969AD2817801C0122833B3E69F724DEACD2FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764907817, "uuid": "921cfbde-c2b1-470c-a6f1-3061faa7e9ca", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764907817, "uuid": "55b1c632-8d62-44f7-bfd3-920323146ccb", "value": "6144:elHX5aC6IIhOwj2N6u/OT3owyYBDRL4G6rY7vO6d0/sZf:eaCd2a6u2T3BDRcnrYzP00Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764907817, "uuid": "d4416eac-7d5f-4e12-8f98-af485b82de62", "value": 550137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764907817, "uuid": "f9b85ecb-51aa-4a01-a12a-280dd0fef67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764907817, "uuid": "d190d473-506d-40f1-b4a8-94caf5c093f0", "value": "12thDecpayment-Details-3c49390CJ3-C93029-SL39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a2e092-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959479, "uuid": "a6484619-b255-4e7a-ac99-e4cce95417d6", "comment": "Malware payload (Mirai)", "value": "ef45ccd74f75921749dfefcd2eb6fdd5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959479, "uuid": "9667ba20-ad9b-45c7-9a14-240d15ea004a", "comment": "Malware payload (Mirai)", "value": "76e03928bed41113dc9d69f0ae1ebd61eac01749a01d050dc9edcda8e7d9b4b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959479, "uuid": "64073333-6a4b-4ba5-a9ba-ff79571aa7f5", "comment": "Malware payload (Mirai)", "value": "3c2553cff37d8c492c0f6acfe9b912f5bce4b5b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959479, "uuid": "f397d6d2-1df2-4266-afc5-d59474bea800", "comment": "Malware payload (Mirai)", "value": "b5e4fb2455aa88ff40ba49171377fe80caa056a7e3c5048f43620b97f704778fb3a16efec7af32c626b9c06662a23b5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959479, "uuid": "4c64a9f8-cde3-4cbe-b317-454ba45041c3", "value": "T1E5111FAF2440A841EDD4DF00BC63F659E984C263C1C03E979DFE473380A99283AC1F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959479, "uuid": "349170be-ef7d-4753-8b93-27077131f12c", "value": "12:78Z/a7QCUZia7QCUZ1a7QCUZpRa7QCUZXWta7QCUZja7QCUZ7ta7QCUZ7Ka7QCUc:e/aiiai1aipRaiQaijai7taieaiJamE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959479, "uuid": "7d873d6b-69aa-4654-808e-34459af3e0f4", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959479, "uuid": "5b7e4325-ce98-4c4c-8fea-d7fd5634a8ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959479, "uuid": "a719b04a-3b99-4f90-a03c-26fae698b0ec", "value": "router.lblink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b0965c-d1f1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764949592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764949592, "uuid": "4002559b-bd1f-4a2c-be26-b9c85929f18e", "comment": "Malware payload", "value": "aefb098408e904dfdbd501aa9b76f0de", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764949592, "uuid": "dd0668ed-9238-4be4-b06e-b8e60e94f241", "comment": "Malware payload", "value": "774a65ce32ed90abb4066068a2ef92f6effed6f91cb6de5eae546bee50b8fa7e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764949592, "uuid": "42f12293-b7e5-43fe-a666-80e43f7a0b00", "comment": "Malware payload", "value": "adc5bb5df2ac8466ae4f584fb5a94615a5c7bff7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764949592, "uuid": "ef27e34b-3b8b-47c1-a222-a7886e7fc7c7", "comment": "Malware payload", "value": "24f0ee04bad580bf438bca0deac57ac0b2c2609c4ddecc9d7555e044bc152244385e80c198f156ec82c71c202b32e898", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764949592, "uuid": "b8498e3a-8fa7-4f24-b547-17bbf856b8f3", "value": "T178858D5566B880F4D47AD238C961850BE6B2B8915730D7CF229E162BAF337D14D3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764949592, "uuid": "8944ea85-f9c9-4cfd-adc2-8fcf2a86c105", "value": "e533d9e7f29d470ed54b0646560ce61c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764949592, "uuid": "dc5130f8-69e0-4829-92e6-cc1f56f89d2d", "value": "24576:zEW4Hbx4QIxSsAQXeBWOE7if/GMnwL9gD50kY7AT8G2DaKGPbu2WWFfoLElkJUrz:zyR/GswL9gD50kY7Ar2TCbNX9GJpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764949592, "uuid": "afb7cc56-ab91-464a-b856-be2c3a874c09", "value": 1822816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764949592, "uuid": "095f33b2-1738-4436-b7d1-fceb06a83e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764949592, "uuid": "ac0d3df9-fabb-48e2-8178-20814aa293c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e271d412-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951873, "uuid": "3cc81374-cf33-400f-b532-1b1981354e32", "comment": "Malware payload (Mirai)", "value": "12f9024fd46c82064eb19dd3337f2a90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951873, "uuid": "6ddd73c9-dde1-439b-84f2-5779f44664bc", "comment": "Malware payload (Mirai)", "value": "775fa5215d712d9d50ebb3bfe5eac8984b48700f6f5d44c0250166cbb3e1656d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951873, "uuid": "8c428e92-587d-48d1-a5b5-143f9eaf011e", "comment": "Malware payload (Mirai)", "value": "73ec05245c4c3fc812d299091844e829edd7ed5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951873, "uuid": "14576311-4d65-429a-9eed-8fe664d8f437", "comment": "Malware payload (Mirai)", "value": "6769d762b564ef5ae69c426f295f711a7069e91625fcc8b0f82be9ac187a97cd87df07d2e5f76bb38ba351d52280f91a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951873, "uuid": "4b386b67-dd34-45d8-836e-ebbbb67e141d", "value": "T1A7B44A56F8809FA2C6C12976F64D42AC33134779D3EB720699245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951873, "uuid": "bfaa7d56-5c40-4ae8-996a-7b9b0495f45b", "value": "12288:JieQIyqdCFWbfae12LKlBSq5/UKeWgpjjyj:seQbq0Fhe12cFsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951873, "uuid": "29d121c7-945e-49c4-a66d-29f4ad47960b", "value": 517480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951873, "uuid": "854d24d0-b0b3-44a5-ab94-36fc10e397c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951873, "uuid": "30e19b56-e67a-48cd-997d-ea26ace34c0c", "value": "SecuriteInfo.com.Linux.Siggen.9999.32484.26000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebba5770-d1b0-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764921824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921824, "uuid": "0d9e2a8e-dee0-4d6b-8ba0-ffeace34451c", "comment": "Malware payload (QuasarRAT)", "value": "c2bf79a673562ff44cf8e217a6d256c8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921824, "uuid": "369b3eaf-d911-430c-b4ab-8f4d7998db28", "comment": "Malware payload (QuasarRAT)", "value": "77b7589e4d284ae6a2808d5b7572889cb578a9cbe9ed1c1732d7dcca87274573", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921824, "uuid": "302fc8a7-a5d9-436a-a574-ab79ff3fd5e9", "comment": "Malware payload (QuasarRAT)", "value": "f74f22449dd2b9c3c70eb0baadc22c4aaca5dbf0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921824, "uuid": "93518ad0-7d12-42d3-803a-25fae104b109", "comment": "Malware payload (QuasarRAT)", "value": "38525216c8b47d5730a84d0d87381cd3ed6b1780396c7892098088bd6319a490ce3f8c149996a54b8b02c466774eee85", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921824, "uuid": "53e5802b-cafd-4a6b-a740-05902e383c0c", "value": "T18BE54A1477F85E22E1AAD373D5F1541763F0FC2AF3A3EB0B2191667A1C93B5088426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921824, "uuid": "dd6c35f7-5534-450d-b9c7-06d807aa2d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921824, "uuid": "839f2c6c-ff84-4b4e-b46e-7cd489a653b5", "value": "49152:HveG42pda6D+/PjlLOlg6yQipVx8ccDmZULoJdG3THHB72eh2NT:Hv542pda6D+/PjlLOlZyQipVaccT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764921824, "uuid": "f9774ee7-95c4-4ce1-a61c-b795bd3c099d", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764921824, "uuid": "291d4485-9fe9-49b8-ac97-08a6dae0934b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921824, "uuid": "41eaa017-3c4e-486a-9cd9-65f123a7f610", "value": "WindowsUpdate_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc08cbde-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1764958735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958735, "uuid": "4e4747be-9d9c-4ff1-8361-61b93afd08d1", "comment": "Malware payload (RemcosRAT)", "value": "6ac932e3d03370628042d5d672843160", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958735, "uuid": "4d8d694a-53f0-4f31-8f77-7dcf5d068817", "comment": "Malware payload (RemcosRAT)", "value": "77c1d0751cebaa15074b84ae860ac17111b966e50b647a6d2677fa9a6b341040", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958735, "uuid": "ec8cd05b-a4eb-493a-b7b9-6c69e40ebbfc", "comment": "Malware payload (RemcosRAT)", "value": "bf6f796c95802283b8acb7f2d27b524efecb3682", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958735, "uuid": "55417656-5ec1-4f1a-9f99-df12b7732822", "comment": "Malware payload (RemcosRAT)", "value": "6c94a30fa1cbc76bf2e9cfcec2d5c203429655b4eb733cbc670ea234c22c34ab648cbb97cb08b778f9e163d4afca70ab", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958735, "uuid": "1b6ea1dd-f94f-45ee-87c5-94cff9b03325", "value": "T103B3DAAAD431A1C11B07FF385E165EA0405124A88D221E7D1AFDC3AF982397ECDF975E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958735, "uuid": "1ebb9ea6-449c-4a66-9bba-a37ef67f4580", "value": "192:Oerg4OA6pWaXv352V5NFXJBPZxYmwDRVqx8FXJBqGtiKGOi6z6ahzWaq7hYmwWQn:SCX0+f6aL/OehUSiAHOVVU5XW5x1BRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958735, "uuid": "5eb3bf4b-f926-4ca4-8381-43896a081343", "value": 112499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958735, "uuid": "0a01c272-7853-4f5f-9583-dcab8b03c327", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958735, "uuid": "2efafc9a-0e28-4d60-a000-0e24cf4b1138", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2911be38-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958864, "uuid": "2f700a40-fcda-4549-9ccb-d6d928c4dbff", "comment": "Malware payload (Mirai)", "value": "d93fe720a450335beaf3167022e39a48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958864, "uuid": "7774516e-3aa7-4dff-aa56-f03660689490", "comment": "Malware payload (Mirai)", "value": "7841647492a6fd193a9dc01a2095d3649a1defe0d631293a02c5e01042352e81", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958864, "uuid": "894910a4-b98e-453d-ba9e-d5cb903b9596", "comment": "Malware payload (Mirai)", "value": "6e7e8f4aed45ca0d84b52a31360a9e75de3137c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958864, "uuid": "fe2d99cf-efaa-4778-af9a-8fc52d339d1e", "comment": "Malware payload (Mirai)", "value": "6b633461ce9fd7f2586ab59a81c729b4adfc7d1cd0759e7a4e1c6c8acd67eccc4304b7f31d8184ac9cda22ec5ec0ef43", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958864, "uuid": "f5ebd035-ae4b-451d-8ddb-90fd1b484a41", "value": "T1211154BD0826BA04803C5936B02BC41EB43387DA64B79B55BDC5A53EB1C45607033FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958864, "uuid": "4baa9d5f-a7f0-4855-810f-ce3b83b042d0", "value": "12:shdryhaAyhJ/yh+6jyhlOBQyhn1yhO2dyhwDCyh5/yhcDRcg:eVwZwpwFwlYQw1wdwXwNw/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958864, "uuid": "2053dfd4-aaac-43c4-84ed-47e7410aa5e1", "value": 870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958864, "uuid": "069808d3-d7f5-430e-a925-4fb68eb762e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958864, "uuid": "6a474f06-b46f-44dd-a3dc-71466d8d2860", "value": "sdt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c24783e-d20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764960641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960641, "uuid": "187bde6c-8e60-42d3-96ec-7f4468e8d696", "comment": "Malware payload (Mirai)", "value": "8ab46ffd16b50898eee7cb5b06a82144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960641, "uuid": "35c81547-4f4b-4687-aff6-1242c1dec546", "comment": "Malware payload (Mirai)", "value": "78805be06061728828049251a786529460c6cfed9678778d1688a71a403fdf67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960641, "uuid": "817659c3-27ab-4c09-9cff-62f79af0f666", "comment": "Malware payload (Mirai)", "value": "4a5d66889a91c40cfd0427dd59298f9033be2d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960641, "uuid": "2338e4cd-704d-482c-896e-6bd84eac60c5", "comment": "Malware payload (Mirai)", "value": "6c3f3a7de871f51e2877a979bfed13a0b4d33f6e3f57755817d99d24bc69a0b173b4f132d9fab54c3d962f246d40ad1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960641, "uuid": "2f796848-95f4-4dca-bf82-ce8ffebc07fb", "value": "T1412423B8CC552277C43219BE937D79233C12E327F473A3459AA94C29272AE5473FA493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960641, "uuid": "02f3d774-394c-4167-8bbe-86a4c9e1299f", "value": "6144:WHvwDcyrOyPN+yFZdILRxa0jJ7nnmhA17Dh:wvSdrf+yFZornnGcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960641, "uuid": "cce22758-57c0-4ca5-a7b3-504678b72e7d", "value": 226324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960641, "uuid": "9f97c102-755e-4b8f-b7ab-63934240acae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960641, "uuid": "b7e45a6e-6cf0-414f-8b44-54d6ae8f11b3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d6e1b6-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917511, "uuid": "b66ee65b-63eb-4e1e-b833-6ae3f517497d", "comment": "Malware payload", "value": "1593cf15a4641ff09aeb71c3f6f2f6b9", "object_relation": "md5", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917511, "uuid": "75078819-fb0a-4577-accd-843209962bc7", "comment": "Malware payload", "value": "78ad7b62ff7e1e1411f1cb7e5fa343be3fe89a75a29e9b2848ba916df53ec5c6", "object_relation": "sha256", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917511, "uuid": "008e1399-8843-4147-a529-56654e976a1c", "comment": "Malware payload", "value": "a997a7aae727d2c12cce80fe3607317775a4df3e", "object_relation": "sha1", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917511, "uuid": "75041263-ca08-4b2a-9001-8674c1369766", "comment": "Malware payload", "value": "d79a0541dfcd6b7688097c0a8300ed7cb818574ac77fd8003bcdb45fccc9bcf2b0aef969a4bd52e436153847189e9a46", "object_relation": "sha3-384", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917511, "uuid": "d7165fb9-bd2e-4bce-908f-1b921b2d2f86", "value": "T12175335B32DFAE76C527B2787A95B04820B6D737F8B1A0130719B3C2063FB525B86917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917511, "uuid": "f2b734fa-04c7-4f6c-90fe-5d6a330c1f1a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917511, "uuid": "828acf93-650a-49bb-8c6c-54e9f23b474b", "value": "24576:WXLRHehffN2+RN1dfNy0ES0CvxdYyhs1+fWbTxO2ZwBRHLjdml+az7nA4HetOP:omN2cXY0ES0Cvth4dbTYbLVml+KHetOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917511, "uuid": "3ff95bbd-2a65-45c2-97b4-7c5a5970497f", "value": 1606304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917511, "uuid": "d96f4821-5b4e-4474-8583-ea04230f4537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917511, "uuid": "ed56d691-aa8c-4f79-9bbd-d0dfa86332c4", "value": "78ad7b62ff7e1e1411f1cb7e5fa343be3fe89a75a29e9b2848ba916df53ec5c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da693f78-d1f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764952719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952719, "uuid": "9f5edb5a-f06b-49ec-89c6-fff898a7306b", "comment": "Malware payload (Mirai)", "value": "01b84be0f73ad7297e15e695ec296c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952719, "uuid": "ad525f5b-625f-43dc-97cb-45889c7b0718", "comment": "Malware payload (Mirai)", "value": "7922aa83a2a7b8f122625f4f7677d75850614dee14868cbff97bf2619ee10711", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952719, "uuid": "bbd59eee-8120-4319-8a67-ddf63844e039", "comment": "Malware payload (Mirai)", "value": "e822ef17492219dae22c5ce0ce168625de204571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952719, "uuid": "209c49d1-f7d2-47dd-b950-a825a2fc4627", "comment": "Malware payload (Mirai)", "value": "e85650e254a6c6d29566e0e7e1d826e4c45513221ef3faec8c3e741c112f6ed29e3bbad86516dbec476ed8036d4ccb74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952719, "uuid": "1f1b5180-e665-4e15-ad63-0a58a018e266", "value": "T16E830242CB6569A659735B36E02ECC48319E83ECD2F8674B297D5C14E093E1E9ECF483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952719, "uuid": "7b5e64de-e42d-4ec4-b24e-91dbb968851d", "value": "1536:6recN36csjbgM7wLakWmuDRVTN1wD2ck6KPmyvkTewLg:6rVTsEGkWNDvkD2l6KPmRLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952719, "uuid": "187cc4f3-0ca5-4595-8c6e-7fdf5fde666b", "value": 87716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952719, "uuid": "6e5a23f5-2517-4cba-8c58-4b6ed9e57b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952719, "uuid": "9017cb99-7268-4949-a3ec-36f594a8e0ea", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bb24ad-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958476, "uuid": "773511d7-24ce-4177-8436-eeb97d0bca4b", "comment": "Malware payload (Mirai)", "value": "be7c8162a90b391080f7e63e2c96a765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958476, "uuid": "4f288d83-5b5c-48f9-b6ba-482a14cef2aa", "comment": "Malware payload (Mirai)", "value": "79dfd1b2fcec6ae0d1c5ec7a9a11cc87209a9adeb91fc2ea96b82da85a1e74e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958476, "uuid": "b8cb3b7c-f212-4d57-b814-305a8b9bf69a", "comment": "Malware payload (Mirai)", "value": "bddcdf9aff480c4940eea8f7a2f45226c50b0b6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958476, "uuid": "b0181bf9-40d4-43a5-9987-cab38dd56255", "comment": "Malware payload (Mirai)", "value": "4abc2273d0d494c81dd64ee8889c8df55edcd352556b5d4cd63add679bc46e83411ccd6ae010bdefa41fbcdb0472478e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958476, "uuid": "aace43ec-de66-4c77-bfce-6b0d4ca0a2ce", "value": "T1B683F84AF8819B11D5D926BAFE1E118D335357A8E3EF7202DD105F2477CA92B0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958476, "uuid": "2f4b66b2-0810-4b68-bb9a-bc07c596bec7", "value": "1536:N5nlc0WOmQlxATkfpZ4qgrn0mdAOp8/O0XdWfJklyq533QNlyBiEeVbfvuybVR2:XWBQukfpZhgr0DvOo8fJklyq5LjeV7v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958476, "uuid": "32e67fed-358c-442f-979c-5cac3cbf27f2", "value": 87384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958476, "uuid": "4163ff59-823a-40e6-990b-6bf20a431a85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958476, "uuid": "a4419467-4cf3-489b-865d-5b8135e4086f", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20aa3c1c-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764951978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951978, "uuid": "102ebb5a-18ab-414e-8f10-c29b308e8c6c", "comment": "Malware payload (PureLogsStealer)", "value": "0254a7e0582b2be5443eadcc8bdf6806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951978, "uuid": "074a5f7b-86a3-4a8f-97c1-50bc5322cf30", "comment": "Malware payload (PureLogsStealer)", "value": "7a020ca579b3ef573ceaaf0ab51c6c38e27f15dde073053e2772b0656de370f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951978, "uuid": "aca27bd4-3f14-473c-ae4c-c8b166e37596", "comment": "Malware payload (PureLogsStealer)", "value": "1de39e20fa3babfd586f5edc08a9ae3625d4cf2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951978, "uuid": "9d246634-8823-4e91-bf83-ca513d9d6f7d", "comment": "Malware payload (PureLogsStealer)", "value": "4b05e704f0a2e478527641b8a2e7cc22b9687346788ff543928e8c5a8c19f4dd2e189fb42849fdca346d9b7c1bb013af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951978, "uuid": "d67c2cc6-ac1c-4354-a0b2-df347b847556", "value": "T19A3522A4B419EA53CEAA46F44C22F3B047769CBA7417C7D98EDE6FCB75E0B501000A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951978, "uuid": "d8323452-2f8e-4443-99d4-78b99fd8e877", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951978, "uuid": "cf1f505a-522b-4b86-b0f8-5a9a2593dad2", "value": "24576:ZPdiLzYmGFJ5YB/M537YZGl5f5Wey7YZ5mI8RNpjxTn7QbZ:O8mGD5Y+5YEddy7XI8RVkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951978, "uuid": "a3a37da3-0e09-4fab-8feb-ee9d579a0f7a", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951978, "uuid": "d8b17b4b-ac73-4d4b-86d9-ff1dfe9e293c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951978, "uuid": "9a69d9cb-9539-4b5f-bf8f-6b69aa314bb3", "value": "Bill of Lading_ 514863409.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b3c08-d1d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764937181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937181, "uuid": "4cc41431-b98e-48f2-927f-4f456f112b91", "comment": "Malware payload (Mirai)", "value": "de3643c51c6f2080ebce3a97b1f4afe1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937181, "uuid": "26fd51f0-630a-40fa-af48-1dd26b04d0aa", "comment": "Malware payload (Mirai)", "value": "7a192064b89ad4367915960b1219d964607e62fc9f6e6e6ca47f5f36d64b04ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937181, "uuid": "05c6aede-632e-4d6d-a32b-d99b11b3c45e", "comment": "Malware payload (Mirai)", "value": "3906cb14ff6789f1df9b2b71ffebdc31fd4a188b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937181, "uuid": "f4dc5746-0909-4c6a-949c-b54fa00bc545", "comment": "Malware payload (Mirai)", "value": "e03498624c5946c60a4450b8c88d1b9d2a63419a72d0e24d2f11e3a395a35f315c671cdb4aa8af71ed1b402b8ef6685e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937181, "uuid": "29c3b3c6-7859-4fe0-953e-cc56da306e60", "value": "T1D211166E2C53A5C6DE54EA027673B50365CC938151C47F2551FD47B280A9E843612E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937181, "uuid": "087315cf-5190-4597-b742-dbbd1c32c72e", "value": "12:78ZBPOdZqPOdZLPOdZpvPOdZXWTPOdZNPOdZ7TPOdZ7CPOdZ7bPOtwK:eEHRHiHp+HPHoH7aHNH2twK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764937181, "uuid": "8bbcbbb3-cf19-410b-8d29-e1af354416f2", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764937181, "uuid": "f624c967-c6e3-407a-973c-3ecf7d814ecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937181, "uuid": "4e1242d6-9957-4ee5-b04a-60c5d6df1e1a", "value": "router.aitemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e19646-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958942, "uuid": "fbb70fb6-1f1e-474e-baf0-152360270c8a", "comment": "Malware payload (Mirai)", "value": "dbe8bd6d21bb00f7439b649620c54d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958942, "uuid": "beea0d54-81a9-4f04-83a3-ef2e51e44d76", "comment": "Malware payload (Mirai)", "value": "7a2e0f0f128c8a2e18272067776c823ab92ffab845442f6d9fed98b2481c2cbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958942, "uuid": "b0ada899-53fb-438d-a3cc-74614f8abfb6", "comment": "Malware payload (Mirai)", "value": "2dd64d283e450291105c10ea6903dc16239a0c25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958942, "uuid": "3af7f374-09b1-491c-8273-2676df71a56a", "comment": "Malware payload (Mirai)", "value": "b6644aa78dfbae63afedebdb836e08a289ae6bc3adbccf51e08ab18202348271d3117773772e25bf80a1684da0c67cff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958942, "uuid": "d424fb56-2749-440e-ba0d-ed75f65e55fa", "value": "T18B03F789B891CA16C9D5517BFF0F829D772A13A8E2EE7303D9196F11764F42B0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958942, "uuid": "524ab024-0479-4ac8-a149-05b3c88bc98d", "value": "768:VuBfbHnO8nrt3jMav65NT1NGj5/778ncuWb6rvtu:Ifblr38Mj57dFWbtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958942, "uuid": "144fa871-03dd-4ed2-bb42-fff9e987a9ff", "value": 38472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958942, "uuid": "32a32a35-382e-42c6-8553-e2387e2287bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958942, "uuid": "1f61782a-3ca9-4e47-918b-ca669574a67a", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f553255c-d1fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764953623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953623, "uuid": "131b5ea9-7f9a-483b-8342-db27c7f56708", "comment": "Malware payload (Mirai)", "value": "02333425cd39b82f6e2fd86c0a2b2784", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953623, "uuid": "9b3d5945-cd6c-47b5-b92d-dc4de6aa59fe", "comment": "Malware payload (Mirai)", "value": "7ab88d3d00291640d1a3fe29e4f0aa5185d2427594fd5e784f7c54339ae9de36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953623, "uuid": "55ebf6c9-0cbc-4bc5-b796-c54c948a86d3", "comment": "Malware payload (Mirai)", "value": "9987ce085044c6140a0e048fbf268a5eae21a928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953623, "uuid": "09ac2c2a-bdb5-47e2-a83e-8dfd29e7a356", "comment": "Malware payload (Mirai)", "value": "e2ca20f866a1e1d2562ac2a8b316238578e3df5b9e48ef867d78d720e4fbe90a6a6d6b6f9067fb4f108386094e58c215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953623, "uuid": "46ab8396-fcf2-4b87-b055-8989b2b40764", "value": "T14223F1537A4E070DE9F014B4DA25F202B75B85FE90F0BE5B95A217C5AB62343E25F20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953623, "uuid": "fd2c27fc-0b00-4ee5-bf1c-3fcc3da67da1", "value": "768:RyUeBWZLvd2Ts4++AIv36WALo2cGrgTwGmHyVCE9QchvvFJd5+q41g9ZAUtHkrhC:RySdyw+AYr2crErHyVPdNvFJzS1yE9ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953623, "uuid": "d92a5b60-533a-460b-b19f-fa598a15ede4", "value": 48124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953623, "uuid": "9ddd4c36-c8de-4536-89ed-77bb579ecfb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953623, "uuid": "5e4d95b4-8c14-44ae-9d68-013cdd9b7d92", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65310687-d22e-11f0-a129-42010a9c0007", "comment": "Malware payload (Heodo)", "timestamp": 1764975715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975715, "uuid": "675dbf6b-fb01-4a61-a2ca-418abd7a1a20", "comment": "Malware payload (Heodo)", "value": "639eda757fba3aa818f602bab5805002", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975715, "uuid": "5d8aecad-ceb7-4ab4-9e40-451542154100", "comment": "Malware payload (Heodo)", "value": "7ac1ba70373c520485ea3a32bbb21a5d296720c7b9bce41b42a6c663254cd464", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975715, "uuid": "6272d6aa-c529-488a-bcfa-1d139be0f711", "comment": "Malware payload (Heodo)", "value": "bfa7629c14397a6b6fd77cf7aeaae065738cdef3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975715, "uuid": "2a5fad28-5857-435f-84c5-ddf64e962846", "comment": "Malware payload (Heodo)", "value": "deab54f7504ca1e0588766b3053cf0af17f3e228473b8e26f32cb40f5fbe1ede360110cbbfcaf7774ec96b14255710d2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975715, "uuid": "59366aad-4eaf-4cb2-809f-8615474a77eb", "value": "T1AD4633943A5404FBFCA7953E88549416E6B1B8321374E2CF47A096B21F3BBC16D39F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975715, "uuid": "0090ced8-f64f-4720-9763-ae54b5f0784d", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975715, "uuid": "fcdb76cd-d523-4610-ba3e-f8d177c2046e", "value": "98304:g9Q8XNDGMRHtJQi9UWvGfFnhxUanoOgj1vGJIgu/FVEhJOSpF3AXuJVTpTYlTCF:gX9GMRHvUWvo9hxzno/w3iFCxpAXuNTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764975715, "uuid": "0238e026-0969-408b-8173-69f04aeab307", "value": 5562633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764975715, "uuid": "37e091d1-2509-4c75-a7d3-ff90bc4e879c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975715, "uuid": "8ab230f0-ca88-4fd5-b9eb-0a20e9582caa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724fdd6b-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764933646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933646, "uuid": "3579cd5f-743d-4efc-ae5e-53bac72786b3", "comment": "Malware payload (ConnectWise)", "value": "392ae012a9083bb754ab1bbce58cf8db", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933646, "uuid": "893d3b77-ba36-4136-9937-6fd9aa235326", "comment": "Malware payload (ConnectWise)", "value": "7b2cf251cd203a11168dc979c84406b17c8941d0d7f9a69af08bf2264576f3b6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933646, "uuid": "1ff0cc94-e954-4c9b-ad3f-1308672feeee", "comment": "Malware payload (ConnectWise)", "value": "45a1d35cc69699f50550806cb817fd398d79f65f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933646, "uuid": "2a5d4a13-417d-4e60-8e3b-0aa37acc949c", "comment": "Malware payload (ConnectWise)", "value": "a6c3c63019dddfce297e46e6cec9eb279c738f9d2f2263eb37e3d62d0f41a36fa6041b780266e4e3828f06d4b8137da6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933646, "uuid": "fc9859fd-5bba-4f1f-8a3a-58556c6c8659", "value": "T1C7A6233662E4C026E2B71E39E9794AF25939BC468913C15F533C794E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933646, "uuid": "76e7443d-cb10-482c-9a9e-c141b2386a57", "value": "196608:7+kLGB1X+Z3/v+kLGB13+kLGB18+kLGB1:6kqBtnkqB4kqBPkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933646, "uuid": "8d005128-6d04-44d5-839c-709eb96274f5", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933646, "uuid": "041faac5-d9b3-44b0-869a-d97512949cee", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933646, "uuid": "66b6e7b7-4d70-4160-9d5c-b43a775b7b9a", "value": "INVITE0000.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddc7f33-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764952000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952000, "uuid": "5a4c0b6c-7bfe-4702-904f-0f0201b59880", "comment": "Malware payload (a310Logger)", "value": "deec8a9f04003a81e51d1fda11519b48", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952000, "uuid": "339cac0c-7bf2-4c51-9e9d-883bf7cf2f03", "comment": "Malware payload (a310Logger)", "value": "7b864e7b7512afd0c9de93c82dbee0ed201c2bd573beeaf1b27ff6acf9426249", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952000, "uuid": "84c92360-c2aa-4efa-9796-2a083f36bf46", "comment": "Malware payload (a310Logger)", "value": "e4e880f24320b02fd189bcd123a7c12a0f0169d0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952000, "uuid": "23700d79-56e8-4787-b237-e42b94959ee9", "comment": "Malware payload (a310Logger)", "value": "21aa3fd33dbe688fb2cd7a23feec9d9b32f6f14ac1c60b897611d86a761b7fece553b55cbc4d8412473746d1a7ac6bf8", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952000, "uuid": "5b66f0d5-6e40-49c5-a593-b89324807925", "value": "T172F4333E0744AA753C8FB0011DA8AB0D89B7A334A3F526E780DD1A1FF79E85D75A3115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952000, "uuid": "7d345b03-8593-42d2-8bd7-391c123e13a3", "value": "12288:rE2etMKoQnaYgEo4PgA8Ohe+JjCZqME6Z3ax8z5RCna0R3cjn4sNgh7qb:rE2KKQnarEoZ4e+5CZF0x8z5Ina0Rxub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952000, "uuid": "41e00a26-3f61-430b-bf88-fd1eb84db69c", "value": 746393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952000, "uuid": "14c6c680-b0de-4b82-b3e8-da4908b0f8ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952000, "uuid": "69901551-4acd-457b-9467-09b9eb8e07a6", "value": "Pre PPC order 1201.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f1638-d1d0-11f0-a129-42010a9c0007", "comment": "Malware payload (MilleniumRAT)", "timestamp": 1764935359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935359, "uuid": "a87fa79a-b473-423a-84d0-7b2bf1459787", "comment": "Malware payload (MilleniumRAT)", "value": "128e26f2bf15758e2f6bfd8e25aa802a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935359, "uuid": "f1b962f3-de58-400a-a77d-4d06268d8657", "comment": "Malware payload (MilleniumRAT)", "value": "7b9302f68ce7a4310ca57e755320e9aab1d9991a29b1f2988f94b51e08489048", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935359, "uuid": "cdf5ea8d-a8a2-4512-aa47-d14cef704515", "comment": "Malware payload (MilleniumRAT)", "value": "9780d194a721c9c90c15aefb77f726f47a314c34", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935359, "uuid": "5ea3bb97-205f-4021-9c65-42ce805b5266", "comment": "Malware payload (MilleniumRAT)", "value": "e9f52594821ed709b8ce43a8ff57b45f5adb8cd027b62e816ea679e49fb1d9c16185f39778242b26bcc054a02a390f5a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MilleniumRAT", "colour": "#A7A47A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935359, "uuid": "8257f7f0-ba18-40bf-a00e-337c4ce91ae2", "value": "T191D53345B36220FCF1B25234C6625A11FBB7781A0B41ABEB03E54A3AAF17194DD3DB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935359, "uuid": "cb968ccc-4003-4bea-adbb-9955f84e8bae", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935359, "uuid": "6926c76f-7cdd-4d49-9f1f-e7dff55c4b23", "value": "49152:eWBQvza9SaZduiW4WGL50maDrQGwKo2d+uEAjgtLpCKl+U1VD4VWvHVYO+sNgFu3:e3za56iWDGamanQG1IAjGLpCFU1qVWqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935359, "uuid": "ef4b9c8f-0f80-401f-827d-640c59440bcb", "value": 2914022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935359, "uuid": "6585f571-d572-43c6-9890-9946034ee7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935359, "uuid": "145b9252-1429-4339-8f38-103cd546b645", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a0f704-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959494, "uuid": "cfeb2ed3-f52f-4327-84ef-17116b20dcd9", "comment": "Malware payload (Mirai)", "value": "d92b3a5c32f32e00206088a4d3add88c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959494, "uuid": "49a45005-a740-4f43-826b-4de2a7b55410", "comment": "Malware payload (Mirai)", "value": "7bbac0793815037c1b8d6431da613d5f30c68ae17c0873524d38ca4ada701c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959494, "uuid": "ea9482ba-cb79-4e66-952a-c826997b126a", "comment": "Malware payload (Mirai)", "value": "15d7830eb8698a14caccdd174da5f6219601cde6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959494, "uuid": "495b9ca7-a15e-475e-b503-144709e5e8b9", "comment": "Malware payload (Mirai)", "value": "ca07be2079b2d7046f532acdf547fd8592d79976b3ea5cd60d044166e21d1812e21b38523d2a4e47c7fecd4e9e39e18f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959494, "uuid": "8bce3e5e-8084-419d-9bbd-d44edf65d87b", "value": "T186635CC6F401DD7EF8CAE67B4C560E0C7231B5A44A530F266797FEB7EEA1158280AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959494, "uuid": "065a08ae-53e9-461d-8803-b8846e38b129", "value": "1536:cQn44iLvjKUdgzhfvqOKWQeuacWjcW0JcWcB4cTXZN81fYUQTx886Y:cEJirjKUKzhUWQeuacWjcW0JcWcBpTXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959494, "uuid": "d6ab6358-0beb-4fd2-98a0-0bdb096b6559", "value": 71376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959494, "uuid": "b4033a68-99f9-4b21-ab61-43ed4eba40c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959494, "uuid": "939b5f95-f0c0-44c5-a0e5-494a362453ed", "value": "Omni.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2740831-d1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764945834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945834, "uuid": "42515de1-d760-42b2-913a-0504b0cb79e0", "comment": "Malware payload (Formbook)", "value": "56774abdefab4b633f2fa794c4bcf072", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945834, "uuid": "cf4f27b3-d95d-4eca-bff8-fd8ffae6ef29", "comment": "Malware payload (Formbook)", "value": "7bef7a5db544eac582182aad26bc337e2e4afda9d1995e3b4e45f7371b719be1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945834, "uuid": "d5147e20-a642-4f0b-99cd-b90c5836732d", "comment": "Malware payload (Formbook)", "value": "5046fdad1d0338c99c6d773836b3495d58db780d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945834, "uuid": "37f8b0e4-a371-4744-9556-632fc92ed5d5", "comment": "Malware payload (Formbook)", "value": "5589b540bb7a399670045de179df6e8f123cc41efddcbcd410fbab032c3e64b4c3da058238c7557190ad21c1dde2ee68", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945834, "uuid": "f6d0379b-aca4-4c0e-ac3a-f3305f2541df", "value": "T1C5E423887DAFF05D113EEBD81D3BA68E7F25323E45287492B5624B016DE9E30C2185CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945834, "uuid": "05bc8236-121c-415b-bb43-99448a35ac87", "value": "12288:qkqbi5pjUDpC8qk+4dvPjiF2fp+tEcOHLzJn5+AAON9samOsvnmi9gLSudWt9Y:qkqbi5Sw8BvrattEJrzJ5+Ad1kPm2f/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945834, "uuid": "d793e616-bb17-4e0f-86c8-851faf8e8de7", "value": 692830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945834, "uuid": "698db865-3e29-4a48-afcb-cda615a7f55b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945834, "uuid": "b0f3150f-f846-405b-961e-445ea0b9ff95", "value": "STATEMENT OF ACCOUNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de2f783-d1a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764915976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915976, "uuid": "304a7295-0431-4438-bd9c-d6f69e924974", "comment": "Malware payload (Mirai)", "value": "062cef6b845f3d8a4008ee36092796fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915976, "uuid": "678e7661-d1f8-471d-b9c3-6d9c0da6b3f9", "comment": "Malware payload (Mirai)", "value": "7c0c2f89a524a6c2520970b05365ecdce66141fe12bcd2129a20f27ec73177f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915976, "uuid": "82dfb779-a3f8-4f88-8085-e2b27684a79c", "comment": "Malware payload (Mirai)", "value": "1c13dbfd7694f2d0a0d3a4f90a6ace2448c0dc03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915976, "uuid": "24a104f8-0854-4980-9d26-f9aa77f6d092", "comment": "Malware payload (Mirai)", "value": "0220ebbdc827fbb42655081c64cb60ea550c968c30be3b750320af88c2b4fb569ca9e50412d05bef88280ad591302e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915976, "uuid": "836893d9-dbbd-4435-92ee-705c77c260ca", "value": "T10B630AC4F5C785F5C81B893860ABF73FCA32E57A80719BADEF8A5E32D6277015201259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915976, "uuid": "3550aff8-7b0b-46ae-93e8-a91ec1170a89", "value": "1536:uYIxpE5HVjXLbHZbVCzpKXwY49cuPVYAeWky81:+xpE5HVjXfHHIKhEcu99bkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915976, "uuid": "4e6af7b1-d45a-4ec1-bc98-925e6e69b773", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915976, "uuid": "2934a49a-5523-4de6-9b40-f1c864f2de01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915976, "uuid": "2c23fc31-8c76-4a1a-a0ea-806adc5fcf9f", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f0dcd8-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959070, "uuid": "ae1cb8fd-9415-41bd-a8b7-61e0c910312e", "comment": "Malware payload (Mirai)", "value": "b85d23a95e7c4492c29228149f5b61d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959070, "uuid": "be09bd2b-48fe-4d3e-a87f-9f9928f21cb4", "comment": "Malware payload (Mirai)", "value": "7c5be69c192f65a2f08cfdcde398e6da887014de3ae48f04cb7986b96d45e2f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959070, "uuid": "de17e3f1-1922-49fc-9a09-3b9da89cf13c", "comment": "Malware payload (Mirai)", "value": "0e902ba250468b3812e6088a79b8bae71fd3e750", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959070, "uuid": "8db604c2-e656-4210-8f74-f5170aba5355", "comment": "Malware payload (Mirai)", "value": "b5aa1486d4edc021f5c879b4c4dd1f587b29fd2bc4be3d60dd89ed902b91429fd9e0c22e65b5ca1ea2295c54786c73d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959070, "uuid": "d5636ff2-c3c9-4da8-935e-2a61d59ee976", "value": "T18C01A1BD4435BE7781345D5AF21A4455B132979A70FB8B48FF88693A77C04603022F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959070, "uuid": "227a9e00-3511-4602-aac8-3631cb5e35fa", "value": "12:AhdE0had9hJSvGXh+6XjhlOB35hnlhOOAhwDJ5h5v5hcS:6DoTltFlY3nr8OnFnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959070, "uuid": "a704a68e-3419-4483-9d28-9c53ebe9bc20", "value": 789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959070, "uuid": "6ea4f667-cd78-47b8-b4af-21fe428f1280", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959070, "uuid": "b70c3e2d-c32e-4427-9c25-1e3797f6056f", "value": "wert", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0dd3a7-d1fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764953660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953660, "uuid": "aa2ea53a-6ff0-4b75-9e5b-19306422f5d9", "comment": "Malware payload (Mirai)", "value": "b234cb00c19ce885580100c8e9f238d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953660, "uuid": "1f906cbc-1d04-4a93-aab9-638aa91d5f39", "comment": "Malware payload (Mirai)", "value": "7d161acdc801325092c2c5a0a4860dff0ed68ba14937e9ae863083e2a1235642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953660, "uuid": "996484bd-068e-4962-bd47-7e74200f29cd", "comment": "Malware payload (Mirai)", "value": "5eb3ff3d0b60536e842114c840159558261918df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953660, "uuid": "bd9d4358-c296-4bfe-a1a2-2b05a38c0da0", "comment": "Malware payload (Mirai)", "value": "f37471c19e36acd4d779d27f14291aa5f5c28f7369ed1bcde4e86346ce55e8b33c4d79acc109ce4f8dedd30756f907dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953660, "uuid": "5800f29b-36da-40ff-b78e-7563c1419e0b", "value": "T114E32982FC829A6EC2C71BB6EA6F228D335163F5D3DA7152C81407A577CA50F0D27B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953660, "uuid": "2a053756-3c52-4eaf-8f55-4b74338365fa", "value": "3072:Mz6V8rNv9QzFYDqTsq0/SdEAwcjdi66hh1r0:O6V8rNF2YDqT83AVUl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953660, "uuid": "b7506853-d8fd-4a66-abdb-4f82827082cd", "value": 149324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953660, "uuid": "20367c40-c987-4539-b1cb-ad72468b9ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953660, "uuid": "fe5c9d50-7521-4d84-b23c-ddbd8b964334", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c81c1-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958937, "uuid": "bd5658a8-b839-4873-a68f-14444e56a90e", "comment": "Malware payload (Mirai)", "value": "cf8772aa74bd9997a9d84529a58fb7d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958937, "uuid": "63a95292-c5d6-4a46-9cd4-52422da0d6c8", "comment": "Malware payload (Mirai)", "value": "7deb20112eecf14b49e3aa3117e44a6d6d4d4420472f9d95e6abff783598d060", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958937, "uuid": "c2e5cd46-f93c-46da-a8c6-0f99ea5ce771", "comment": "Malware payload (Mirai)", "value": "eac5bdc7a57bbb7c9a7626700596bbf9510667a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958937, "uuid": "0ff39f2e-adfa-4b94-b235-92f8e7a36121", "comment": "Malware payload (Mirai)", "value": "b01ec2e6bffb984fbfd82df6048c9d3345e9e79dad8171197adf83352ed8c0516c693cd57bfd24c5c3c1739afc56b615", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958937, "uuid": "f754ab95-09bd-4c0a-a4a5-6d8f0acc4f27", "value": "T15EE0487D002BAB02C4189E15B5353C6AB133C7CA64738B4BFDDC3036B149D207322D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958937, "uuid": "bb287180-84ee-4d0b-8bef-9b5e1036e1ae", "value": "6:LA5/wkPjkxVocA5/My1VocA5/rHz2cocA5/nfiAK6iTLVp:shRksxhMy1qxhf2bxhfLK68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958937, "uuid": "17dfce41-6be9-4e53-8b3a-1d855a13a08b", "value": 353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958937, "uuid": "c6c8132f-03c3-4950-9a2b-9beb76abcf19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958937, "uuid": "c7a8ef80-a147-47e8-9311-feaf16ca29fd", "value": "gp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c0439d-d1ad-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920450, "uuid": "5a74179e-a741-46fa-bdfa-fa24cc4f31f1", "comment": "Malware payload", "value": "a9235540208fa6a25614c24a59e19199", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "UDPGangster", "colour": "#3AC7D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920450, "uuid": "2e24c81f-9447-4d2f-b4f7-1cbb1804f80f", "comment": "Malware payload", "value": "7ea4b307e84c8b32c0220eca13155a4cf66617241f96b8af26ce2db8115e3d53", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "UDPGangster", "colour": "#3AC7D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920450, "uuid": "27ce1ed6-0a71-4294-82a7-bb95d3bf0c7e", "comment": "Malware payload", "value": "7bb0d162bbaa462c516502d1db56818d24ad825f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "UDPGangster", "colour": "#3AC7D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920450, "uuid": "01876128-d9b9-4f20-a3fc-77623a8f7d59", "comment": "Malware payload", "value": "b317918eb2e5bd7795049578d200624eb0ef3ffbb5a0ef99051d46fbbd3b86ba5552afcff6affbba01414c53dd7d7ffb", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "UDPGangster", "colour": "#3AC7D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920450, "uuid": "4c952329-6cb7-465b-971a-322fa8060a33", "value": "T12A65BF7BCEABADBDFDAC3CB498002DC81E5C2D4705548016AF8835BEA7F8964CD19971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920450, "uuid": "652ca116-ff4f-4213-a101-92547c5b5eba", "value": "12288:t+8kLgmTS9halC5HxXnSBRUnm9vbOTNEIM0Uy5bR1MAES3ip1aSuF6nxv9gpeFn6:BmTS9SCTAf9vbOpEr2hF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920450, "uuid": "26967efb-b33c-4e03-8195-9200a9e4d226", "value": 1439232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920450, "uuid": "08bd2f02-fb64-412a-a449-c7e794593646", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920450, "uuid": "b810cbb6-ec40-405f-bdaf-373cb1029366", "value": "Scheduled_Internet_Outages.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89587d39-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959025, "uuid": "ef9c9712-f68d-4f19-9cd1-adbe3c37807d", "comment": "Malware payload", "value": "48a6d8eadd026b9e0aaeffea683de84f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959025, "uuid": "a08c932a-5b44-43fa-8e75-bae1a3b8e5e0", "comment": "Malware payload", "value": "7eab12e00f03fdb226d583fc473e00f3a63d3dadfa1421817a41ec5adb53d5c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959025, "uuid": "fe6b672f-bf4d-4347-af87-e1558df16a18", "comment": "Malware payload", "value": "25b30e74f2a100a1112d6af01ee65367f7309fc5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959025, "uuid": "160e4b32-c41f-4747-a690-276aac1526bc", "comment": "Malware payload", "value": "bf3b4b92cbe0e679f5eb3b1476eaabcc3e3d625377988a4b984ae2e0c294a54794bae51a65add38542d6bd59d27239b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959025, "uuid": "7953b297-c902-430f-a480-fe16f3ff763d", "value": "T14EE0E51EC20986FFA816889F6EFC3ACC710FA34D5ACA2E05AC399D16B580C1C91C1026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959025, "uuid": "c34da99f-6f48-435d-ad80-319afc4d845b", "value": "12:/bwgVaVXUy4gZesFrFBEGgbu+yfuT+JF8EpASLye:jwgVeaWrTBEGjTuyLpvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959025, "uuid": "7f14e86d-74fe-4f35-9498-dfa83fad8936", "value": 419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959025, "uuid": "39a78a47-dc0a-4122-814d-83512ca382aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959025, "uuid": "5d35f592-d5f5-4ddb-b860-bbd7edcdb06c", "value": "lol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf4e5eb-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931005, "uuid": "ff3d3c56-a2c0-4af7-83cf-07a44122943d", "comment": "Malware payload (Mirai)", "value": "300ccccd29cd203226014e445f05c07e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931005, "uuid": "988aab10-f928-4fb2-afa0-4cf61b24b28c", "comment": "Malware payload (Mirai)", "value": "7ef2cece2bc573b05c879fe829985cdcbf1aa4aefc8e5ac93baf481ff371e917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931005, "uuid": "df95ce19-58e9-4b1a-9606-80f9d6c51976", "comment": "Malware payload (Mirai)", "value": "a36fd39d62475df78e874980232a0a328a783e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931005, "uuid": "90cdcb88-8a9a-47db-931b-89410115e3dc", "comment": "Malware payload (Mirai)", "value": "ee74e8ee3c03d9edac2d4b5485fc7cf417ba7f6e57b910782b8a339ad7a838fe8fe75cac0dfcc4db9b4a9c3b22bbaf99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931005, "uuid": "7ca19b0f-aa8a-4a30-8ede-4d2ad642d0cf", "value": "T15833FA99F490CE52C6E42179FA5E119C33534B78C5DA32068E106F3577FF9AA0E3BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931005, "uuid": "9ca2de18-239d-4a92-b6e9-e893a1a39a22", "value": "1536:9WXbAmaVFt6IOe0kJRwkHOOpFrqIoMt8:9WsVWZQM4pQy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931005, "uuid": "d3018332-b379-4368-be90-51135e04e51c", "value": 50428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931005, "uuid": "b3fbf96a-619e-4889-9584-13cc593eb14b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931005, "uuid": "6acfc79f-ec3b-4513-8c5b-13e3fe22981b", "value": "VRarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe7c248-d1f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951198, "uuid": "508b0819-91b8-42fe-9615-86df583ee03d", "comment": "Malware payload", "value": "6787561d36d1934f4e6319305ad9bfea", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951198, "uuid": "7af84eca-edcd-44f8-b039-6a1e9486a2e8", "comment": "Malware payload", "value": "7f4e339c0504b55466cf4e0b9828ef18550d4dbb218904e8cde9c47aa0a5a577", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951198, "uuid": "7d623da3-b202-46d0-b316-5db06e41ab53", "comment": "Malware payload", "value": "e7e5da7f6b5ad347424c950187216867955bd48c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951198, "uuid": "fd2ee1b1-a067-4b91-8f19-4b3bbec0cb1a", "comment": "Malware payload", "value": "05b55c70c1cfbcdc2e52b391105749b57926d50278480185591ef39ff79195e38835f8b5b139d80a091a4734f40275f7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951198, "uuid": "9b645bbe-c65c-4cf1-8e72-26f0eed101f2", "value": "T15AE07D671F152D43C2CB603706408630D20CC2815594B12B1CB7D3056D0E2954E661CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951198, "uuid": "e6e4ae28-5234-424c-a100-e2ddb5ab07ac", "value": "6:5jBFhFsiAcrbuoAPYVk7Gh0RJMveeR/ySoCYZhXi1uajBFhF7iAcr0t+l2:5jVYcrbHAPYKS0R46bZZhyBhtcr0ta2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951198, "uuid": "50f83909-f16f-48b2-bd4a-fbd41810def4", "value": 332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951198, "uuid": "7a7b78c3-8ffd-4c92-bc11-282156353c5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951198, "uuid": "d5172dba-2426-4a4b-9de3-f1f3b981e2a6", "value": "Invoice #8765455.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb2ad1-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958379, "uuid": "dc79a4c9-b004-4d17-9303-5c1be5546f44", "comment": "Malware payload (Mirai)", "value": "6090d130085e004b410086744c810c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958379, "uuid": "cf380513-2eb1-4147-96cd-1d3d2cc95be1", "comment": "Malware payload (Mirai)", "value": "7f6a9174b66224efbb1cd7e842795937ad5a14e973adf12a826095143c13ceaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958379, "uuid": "176a2e3b-58c2-49fb-b7ab-315b3cdf5f53", "comment": "Malware payload (Mirai)", "value": "6190f914eeaa93dd2416c81dc10c8cdd722de949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958379, "uuid": "8d1d2378-c6ab-48c8-85c3-426bf957d673", "comment": "Malware payload (Mirai)", "value": "efd8463cd8d96301bf1f8e39e07f0ed116da238798978af7ed05a973ff32b772fc29c2a6f05ea882bedda2685a88d265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958379, "uuid": "573f0c7a-23d4-4210-ac55-3db2433d643d", "value": "T1A782DF30619B34E4CBF14430FAAECEC6975A0BF8D1FD36D21648AF78C94110221F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958379, "uuid": "437155f8-82c5-4439-8665-5dce07c02792", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaZYhymdGUop5h5lel:6/V0P6+kom0tVAoNvm+to1ZYs3Uoznl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958379, "uuid": "8e1c1ae2-c818-4512-b766-b5ac5f332056", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958379, "uuid": "644591e9-c84f-41e9-a230-93a4610cab3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958379, "uuid": "c95d228f-c48e-4836-88df-5aa76e5e9276", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b785869-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959056, "uuid": "bee8b039-2634-4ead-9c23-d05df982b8bb", "comment": "Malware payload", "value": "151a1b600fe69c1fdcd10f1c2b323114", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959056, "uuid": "58ef606a-5bb5-41d7-bff8-12ec2560fef0", "comment": "Malware payload", "value": "7fed6044892acc99612f923fe428a3d131d323057babac53fa7625d06810adb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959056, "uuid": "8c2ae3a8-884d-43e0-93b1-814266fe689c", "comment": "Malware payload", "value": "39cf3bf680a0e329c0b4ac317f37e6243d41ceb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959056, "uuid": "2c92c497-72ff-4094-905a-ea1aa2145f3f", "comment": "Malware payload", "value": "9233723a53935e420e6a905f280c2d12368ea2b0a18fe3445cf8eccf0eacf477fc2dd6ed492d5827af12d90d32b9b8bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959056, "uuid": "a3d72491-ec46-4b6f-87bf-6e1c656a8441", "value": "T1BF1133FC4306E9948888D43AB295800DB0A38FDF94BB8BA56D45357D70F05DE7232E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959056, "uuid": "153ea077-923f-4ae8-adc0-48266795cab0", "value": "24:kFGJOaFl5tJOaF8JOaFfJOaFADJOaFjJOaFiJOaFdJOaFxJOaFsJOaFAjJOf:kfafkaFaKa7aKavaAaUaRa3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959056, "uuid": "c054e5fe-291c-44f5-8db8-f1e0c0274b4a", "value": 1039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959056, "uuid": "6d865b57-088c-4623-a9d2-9c82c765a4f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959056, "uuid": "c2fe1ddf-fdc6-40ea-a3c3-5d352cce58f3", "value": "weed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a15b75-d185-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764903017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903017, "uuid": "04cce716-f200-4264-b84a-7800ab50378c", "comment": "Malware payload (PureLogsStealer)", "value": "67b4abdb708c8460e5d53476be5a8546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903017, "uuid": "8bfb0c52-685a-4549-9fec-27535818e0a5", "comment": "Malware payload (PureLogsStealer)", "value": "7fef427b27a7c8f894418bca3de3a29d75d0f992cb8d3068d94bc18aa1f0f34f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903017, "uuid": "6fbf7c72-d63b-44a5-989c-db1b185b7e68", "comment": "Malware payload (PureLogsStealer)", "value": "6fc178e8f1b5e989e68e3e26c7212d74a486ddf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903017, "uuid": "268ec7dd-68f6-4816-832b-9b9f28244e5d", "comment": "Malware payload (PureLogsStealer)", "value": "71de6048cdc7d886c2cfc88e0aecd753285f2f78f1f8e0a62a032747c4c79fb2d8ecb8ef7c8595642c364e3b986405bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903017, "uuid": "7491690e-738f-40f0-a24a-5f9ffdbd73c1", "value": "T1D6C4CFC0FE9AE425C8C159F3C96ED12AC826A91957E42C83B7C52B2D15E11CDDEFC1E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903017, "uuid": "e07d7f60-0a31-4fc2-bedf-ef2bc8624db4", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903017, "uuid": "d17e85f8-27bd-4adb-bab0-c0fe141acfde", "value": "12288:sEnSUG3oynTZE9OOn+RTpBfD1Oj0nrYzP00ZT:hnDcoynTZE8s+RN40nsz1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764903017, "uuid": "58541edf-a170-48de-9bb4-57dd7e233b41", "value": 580048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764903017, "uuid": "f37604bd-7a15-4ac8-9de9-bb446385a06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903017, "uuid": "5e982bd1-36ae-4e13-8456-f90dda35c7e6", "value": "CD93-SwIft-SEO20-CM8493-LOS903-CJNF93-20394-8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193b33a4-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958408, "uuid": "4fb42f90-ca7f-434b-ab3c-313f1732afd7", "comment": "Malware payload (Mirai)", "value": "e4d4ab5369dad7df008e4479fdd5443f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958408, "uuid": "7ad59a21-49d1-4e99-b48d-09425dc224c7", "comment": "Malware payload (Mirai)", "value": "8003f2ee7c7dda9e23a5ac9194a17f31e81643dc8a90b92d941d3354813b775a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958408, "uuid": "7d98f0c7-aa01-4583-b32a-bd8d23f68103", "comment": "Malware payload (Mirai)", "value": "d6a540ff323f0ffb7d4253c0200f6d7cd29a3011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958408, "uuid": "aa41ec56-8e7b-4df3-a838-0974fc71908d", "comment": "Malware payload (Mirai)", "value": "d36bd5a3db65d42f7c5237b8413ffb3c19a1cddcaf358759a7b4b319fd3db03e7b5d6b436e0d2b236c7f7add1a50c569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958408, "uuid": "27199da2-883f-48c0-ade5-15e6fa0b5f99", "value": "T1D2930885BC82452ACAE403BEF57D12CE332173E6D2CE7213D8514B657B8661B0CA7F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958408, "uuid": "6c3b049e-c762-4f7d-bf9a-85ba872e57c3", "value": "1536:nGgDoK/AfjAmvLdMirMU7BnhMRkPLG2S0K5ILyv8nM6VDoe:rANHd6Fv8nM6We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958408, "uuid": "678b8b2c-1dd4-4a05-9eb0-88cdaaa9c8ed", "value": 91996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958408, "uuid": "e02030c4-cf0b-404c-91f8-d02321df220a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958408, "uuid": "070d96c9-d65a-4276-80c8-63661731d57e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1ac133-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959488, "uuid": "0284aaed-963b-4f6b-9455-d1f880450f5b", "comment": "Malware payload (Mirai)", "value": "0f055800967c5addebb7a04f921499c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959488, "uuid": "b08ffd23-f846-407e-80a4-4320e0124b2c", "comment": "Malware payload (Mirai)", "value": "808a0343d10472b66f50a009929bf03e43b6837e3cc01f731a62669b68adfb11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959488, "uuid": "470ecebc-7cec-476e-982c-30e4488f7ce5", "comment": "Malware payload (Mirai)", "value": "18f4332fa0a47f8ca58d20102492240c42234502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959488, "uuid": "47166ee0-1514-482d-a572-88ab9a11d11f", "comment": "Malware payload (Mirai)", "value": "c062661021e3cb8beda02e5122b3e93324a0f10b872e7c988460d19acaa51840d4af1dabae761d6b21f9857db615d003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959488, "uuid": "9455f168-a24b-4765-8246-45f15c6404c5", "value": "T10903C551F8425B27C2E1137AB6BE5A8E372073E982CBB617DD214B107BD651F0C62F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959488, "uuid": "5e8247c7-d530-42ea-8a02-41c0a795370f", "value": "768:ZqgfBxlxPhCROAfAcG5dm80LyFBWEu/tOr4MkK0lw9QSI8q1DqlUombyv/NBw+kE:cAzkf/G5dmSBWjV8kebpqklG8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959488, "uuid": "4366c351-e87e-4cbb-b366-d67109886a9a", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959488, "uuid": "0f53a0a4-f86f-4af1-a9aa-6cce188b4aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959488, "uuid": "eb7447fd-f7da-4bab-b13f-2ab757afbaa9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d7d903-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958432, "uuid": "fd91dea8-b87f-45c7-8c05-cd7fdec6612e", "comment": "Malware payload (Mirai)", "value": "dd5ec38ef95a3dbc290e0aa204d91006", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958432, "uuid": "e7eb85fe-7459-4ad4-ad93-7bd91e692605", "comment": "Malware payload (Mirai)", "value": "80b8be0f5de947291e212853884b1a97a0cb62d2e7f16c56e114b01901ec19c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958432, "uuid": "3cb832eb-60df-4edd-a937-d2a35f035cb3", "comment": "Malware payload (Mirai)", "value": "c4188ac2ebe4b62dfa32f901fcc7641f6b0b62b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958432, "uuid": "cf9db367-40bd-4272-93d8-bfb7f2f8ccd8", "comment": "Malware payload (Mirai)", "value": "818d452e87ef59e694d06ea0b444fdf8cf936a6b6672aea8d2df4cf51100235841a496ab713f82f35ab70a491fa7db43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958432, "uuid": "688b3c38-9646-4bf7-8300-e45a41af70ce", "value": "T1263183C7207109F23B755A32B5E8C688768188A61CD1FA5A5CFE3CAA644DD1CF490793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958432, "uuid": "273fae69-2100-47d0-8e03-adc19eaf9d33", "value": "48:vTD+TWaTcM+TvdcT8CT9WTKiT0tmTEaErTTAf:vutCCP0h1IxrT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958432, "uuid": "8af33f1c-5234-46d4-808a-f79ce0118f4f", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958432, "uuid": "d43cc151-48bf-4858-a1d4-638b58abaf62", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958432, "uuid": "928cc792-2700-4967-ae26-fc2d375d6456", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c5f974-d1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764943313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943313, "uuid": "53843fa0-9897-4858-8cfc-75a822060826", "comment": "Malware payload (AsyncRAT)", "value": "d9c94d19c04b6d27695d6aaa7abad5b9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943313, "uuid": "138524ee-6529-47d0-a6c9-96cf4f698de5", "comment": "Malware payload (AsyncRAT)", "value": "80f14abe3016f509071235448f9129e9938b352367402d52dd8c4b0bc4c98e1c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943313, "uuid": "92c143ec-dc71-49f4-beac-231902c3188a", "comment": "Malware payload (AsyncRAT)", "value": "4cc67762be6a4e3536b855cb79a7caedbd874903", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943313, "uuid": "8ee9e017-f7b4-4cea-ae93-6e26b37e80ea", "comment": "Malware payload (AsyncRAT)", "value": "723cd45f5034dc67747c79e8be0da08879d315c0428b18a4b5612eef0352df312488e8225c585064b9ffc727f2bbb704", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943313, "uuid": "4bb6e8b0-4c8b-442c-b3dc-6aaf7c4526bf", "value": "T1905528D2B993117AFB412EB4082BAD6BD9FED1495E275E1C3820F9016C502E3A4F5FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943313, "uuid": "eb7107d5-3f31-4489-91bb-f8739265b186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943313, "uuid": "2d424860-86db-48f4-a028-0286e20fc1a1", "value": "24576:SV+N+x/VM94PeK5MwbTLRhRRkSsURbcj0kV1rGs54EBhf3YxEA:SVIYu4PpRbCBGm4EBB3MEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943313, "uuid": "0ab60e01-5c55-4f5d-abd8-ed522bd08b59", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943313, "uuid": "d005baf9-e7ba-46a4-a41a-f039736061b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943313, "uuid": "9b26e11f-3585-44e1-9a6a-b659b225c657", "value": "80f14abe3016f509071235448f9129e9938b352367402d52dd8c4b0bc4c98e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c7678c-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958957, "uuid": "9468e9d2-8535-4862-90e2-0c84b7f9a53a", "comment": "Malware payload", "value": "ba4195e36ca4980133bf0ee81f9d94e2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958957, "uuid": "ba9da4b6-ea86-4ad0-b5c3-2b8adb6d286a", "comment": "Malware payload", "value": "8222d6c236cb35b586fb1075252c64f9414f5416f0ffefe4192d0fe833f14f8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958957, "uuid": "b1a9e3f9-3dfd-4848-b36c-0ae4221d9d93", "comment": "Malware payload", "value": "55bc250d27ccc6ec092c6f5e2ae36ff7295f49f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958957, "uuid": "413cb192-1b58-422b-8216-16f51e1a83cc", "comment": "Malware payload", "value": "732f08c3b7dea2f62219a69d5fe9f48dea17cf1d8fa7c253467abc8b8cd646e5237d63b174ca84f1cfae7e36e2c43952", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958957, "uuid": "408ce115-8f8f-4680-bbe6-2c5e54681ce6", "value": "T130015BCA8A20BA198039AD1D21F3D4B83411C0DB17A76F9CEF8D543D84CD9BC7829B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958957, "uuid": "71d8bdd5-c196-437a-9567-0d163ed39df0", "value": "24:RxXUE/6nErKHsEcyjYE27EDVQGkE0hx/E6LEfV:RNUEinErAsEpjYE27EDVQGkE0hx/E6LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958957, "uuid": "cac5327e-e400-4edc-87fb-b3eabf8e09e6", "value": 793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958957, "uuid": "656e3d24-faab-4c01-b889-ebbe12bca32e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958957, "uuid": "716e12f4-a757-4e6b-83aa-0558928aa525", "value": "seagate.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dab53c2-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917801, "uuid": "cf0c7878-00ed-4401-81ba-89b563c196eb", "comment": "Malware payload (Mirai)", "value": "1c3ae9767cf83330af0f054a781f8c9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917801, "uuid": "1723f1c8-3ae3-4812-99e4-daf03c48ad42", "comment": "Malware payload (Mirai)", "value": "825de5ef30048b9416e6ba7026a4b0fd4bdc140a5160f0984a652e3b33a8e7b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917801, "uuid": "7e90ca83-a368-4053-ba5e-de2f8b7cfba8", "comment": "Malware payload (Mirai)", "value": "f680c7f5c6d2f85f2a9b90a830d6639c72bc2727", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917801, "uuid": "dc56fba6-1ba3-4cb5-8602-40dcb5fc826c", "comment": "Malware payload (Mirai)", "value": "7a928e690e3a76bd8eda28a4024451c389fd5f7518cff3ce435771afd90bdb21c9a984c6c4d78795b9831a52ea120d6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917801, "uuid": "751c495a-e2ea-478d-82e9-0a1675c7096c", "value": "T1A45172C673924A70EFB15DAA75B644147480E099BBD3CF86E4FCB4BC094FF095490A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917801, "uuid": "81fd2bf0-f567-406d-b6e7-d8459d2666a1", "value": "48:vX4+4Y4O404UpzE474g4V4S4K4YqUf4L4+b:vX4+4Y4O4040E474g4V4S4K4YqUf4L4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917801, "uuid": "01244395-eaea-4f03-9d4c-c478a0a7fa83", "value": 2863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917801, "uuid": "7ccd0d5c-e269-4aa7-92e2-850eafc7e7dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917801, "uuid": "a24fc076-86c7-4bfa-a250-cf32f2990ad4", "value": "gpon443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e9d18b-d196-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764910404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910404, "uuid": "886a0dc0-e44c-4792-837f-eeba09c56d4f", "comment": "Malware payload (Mirai)", "value": "8f2dc487fbc1760f75b42b09e6347127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910404, "uuid": "7a5a4a12-515a-494a-9a86-1d932a76c575", "comment": "Malware payload (Mirai)", "value": "8286fc8ddf3d2e6e32e112ba67bf9de930be1d2a15c77d291284f5163de76326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910404, "uuid": "55250180-0978-4549-bf13-02b92b438501", "comment": "Malware payload (Mirai)", "value": "f9861bc9208496de9f1349bbb59cd394d9d6f5e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910404, "uuid": "e6900caa-b729-4f93-a375-5912e7a4cc99", "comment": "Malware payload (Mirai)", "value": "3bbd071a8429e6651ec0b595f8541f6f35a0c45b01d28c4a2f51e5b92cb4d8a8b091f1fd175b5759b87fccd688dab179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910404, "uuid": "fc2e7ff8-3b5e-4fe3-a4da-ae62c2afeb68", "value": "T11C43F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910404, "uuid": "578a6466-f515-45fc-854a-8e8e2ef85c9b", "value": "1536:LmXou1DAd2GmL+4jbZ92qK0zlKpg7MEhWm5uN:LmBjbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764910404, "uuid": "295919bf-54c4-4cd9-b766-dd5a7d50a2ef", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764910404, "uuid": "c2e545ea-bdd3-4c62-bc21-3717d3a03d4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910404, "uuid": "a3f4650f-80ce-4a67-b238-0e8e33ed1596", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dda8222-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959060, "uuid": "92cca061-f44b-4955-a2f3-032a29d1089e", "comment": "Malware payload (Mirai)", "value": "234cea3040c1b7269feecefa5190bb48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959060, "uuid": "3416e3c7-cf2c-477c-81dc-91f495fb5f6c", "comment": "Malware payload (Mirai)", "value": "830d55b0b06ac8921b33ac5c505a74fac1ecb30928ca2f09dad9cedc0816ddbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959060, "uuid": "f2a96474-b788-4cdd-9f45-639242203835", "comment": "Malware payload (Mirai)", "value": "57e82bb84d18500e5e09c59277cbaad4c1a75032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959060, "uuid": "70e2bec9-8bbb-407b-b813-9b7aea624a45", "comment": "Malware payload (Mirai)", "value": "a079a5dee54253596b3ee3a9bbaf1408b4759b0d55258c0bf8822cab5b1302c7a443513109263687e52829e4acff5ca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959060, "uuid": "2550f079-629d-4ea7-a889-b161a106a7da", "value": "T130036416EFA0DDB7D81EDE3305A8870134CCB85761F4376A3674C66DB96A50B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959060, "uuid": "ae871a5d-c5bb-4cc0-ba02-4423a7e31eb2", "value": "768:oRxaI4aEQFXiMeKZn2Em2eg5do/35/LiR9GeLe1:OaI4aEQ1R2E3eg5uv5jk40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959060, "uuid": "016d1be0-85b9-4eb3-91e1-63acfb8589d6", "value": 38924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959060, "uuid": "f9ffdc34-62c9-443f-87fa-c62c5d51a1cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959060, "uuid": "37bf78c3-090c-4059-9975-09218609d005", "value": "row", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047948f6-d1ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764925731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925731, "uuid": "46a4479c-c9d2-4d15-b1b8-fe0aa021dd55", "comment": "Malware payload", "value": "b381c94b8337ea67e502921955bc1d9c", "object_relation": "md5", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925731, "uuid": "61a0cc29-0d3a-46e9-923d-0b9c8fbbd84e", "comment": "Malware payload", "value": "834653eff148cb83dbfdb20ec6f769d2e454fdac4fe40bbd47bf4663f796dfec", "object_relation": "sha256", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925731, "uuid": "95438240-92ef-4405-9e29-32784e6ec286", "comment": "Malware payload", "value": "7c39648e28f17ace1d4cb6f2828cc634d6879da4", "object_relation": "sha1", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925731, "uuid": "b998b0be-320d-4d8a-8fc4-c6ed124e19b3", "comment": "Malware payload", "value": "70ea31b24e407e11c8f90680d27e5bacf468b1362ebbd6fa2ebcb6077d63dc3f13abc88f591efbb389cf17223e5afc34", "object_relation": "sha3-384", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925731, "uuid": "c3afa872-068f-449d-95aa-1c7eb08e6b2b", "value": "T13241655300044CDA92B5F7F531001C80F7DB829BC8836AE2B08E1045A7ABB6E11DBFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925731, "uuid": "70ad6eac-21d4-4894-ab9d-9149cabcce11", "value": "48:gm3RzNcClGSqgMIPRooxRswIPrx3C+Ks0i1Si18aaXusXuCuUu9oJ:gm1OClGSqgMIPOoxLIPrx3C+Ksb1R18v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764925731, "uuid": "429671c6-d4ce-4a0e-a16b-338c31dd4097", "value": 2022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764925731, "uuid": "2dbf826b-a5b0-4589-b933-0ab46aef8d5b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925731, "uuid": "9c9d06ab-62ae-4b2c-9497-6ca326b7f184", "value": "document.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241312a1-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958426, "uuid": "dd34ff36-3391-4e65-8644-00ed07018a2f", "comment": "Malware payload (Mirai)", "value": "128a6b2d1a7c674c9d2baeb587366da2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958426, "uuid": "32b328ce-79d4-4297-812b-2ed8e208cd4c", "comment": "Malware payload (Mirai)", "value": "83733520fba7205bc0445cad336e74f3b71774f23eaa2a621d7497e9b0e2c7ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958426, "uuid": "aa65e046-ca4d-4140-a9cd-a106fcbe00c6", "comment": "Malware payload (Mirai)", "value": "6fef41d607aed7e56d8153fe351f5c947b1cb630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958426, "uuid": "2da1ad4d-d6f2-499e-b6c9-91d038471a35", "comment": "Malware payload (Mirai)", "value": "50619b0347c267a736541ab5c2e5b0c69dacb2fcfb2fb41fcedc5db2ae8abc0486eb519d4b481698451868336ed9d877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958426, "uuid": "a44cb9b4-041e-4f1e-8120-621968a59c8d", "value": "T14CE33A59B8828A22C9D413BFF92D01CE331227A8D2DF7213DD215F257787A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958426, "uuid": "a1fa1ffb-4819-4b28-99ad-aa0f4a83a090", "value": "3072:BzJdDeFzB1sFPm7W5Y3gVgVanYLOZVZMwwMvkD:BtZeVB1sVm7ZgmVaLpMwPkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958426, "uuid": "603e0d3b-59bf-49d1-bf75-28f0b2e1af84", "value": 149616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958426, "uuid": "b34b3ff8-760e-4227-88fa-6960c3bf1153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958426, "uuid": "63719b61-deb5-4470-bcc3-920f5a2e78e1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad2ea0b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959055, "uuid": "e9d24ab5-3d00-418e-aa8c-9dd1785afed6", "comment": "Malware payload", "value": "c4008a16cb4569450d70fd2f54631239", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959055, "uuid": "7442e7d0-0b4a-47da-8ab6-700b5da5efef", "comment": "Malware payload", "value": "837f2df54ca2ae6a42a8c889ba21a3441a34de9332fdb0dd2886b773ef311351", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959055, "uuid": "07f6dcdd-b1a5-43ad-9dcf-a42cd4ff6e33", "comment": "Malware payload", "value": "a24c6574495f376b0e3137ee6141cd3c16236797", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959055, "uuid": "0b4b1dc7-a15a-4911-b5d5-5cd4342ae938", "comment": "Malware payload", "value": "43a33b5f470d3f2310adcb5658bdf7b0e441f2c6916daf21ae2e39a3c4f62925861ba5b1cfdcedd0231181db4c87194a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959055, "uuid": "2d100d10-62f9-48aa-96ac-cac892641e08", "value": "T15FE012BD103BDF1781149E31A17E24737032CBE65559C959BEC4A43BA188930B372E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959055, "uuid": "866908ad-62a9-47d0-a69c-7d72a4182b53", "value": "6:LA5/rauNFgA5/pjLKAFgA5/laLU+rFgA5/nfiD1g:sh+yFthNtFthlaLBrFthfOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959055, "uuid": "8a400e34-3d3b-41d3-8634-ede560691038", "value": 307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959055, "uuid": "2704220d-91e0-474a-8f55-c0af697ccef0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959055, "uuid": "f4d6dfa9-988b-4f9f-a145-e2c2c2835910", "value": "brick.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed841c73-d19a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764912378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912378, "uuid": "783884ec-5552-423a-a384-a8f71f0cd057", "comment": "Malware payload (Mirai)", "value": "41dc7ef6b27735b220de7abb5abaa813", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912378, "uuid": "b28e392d-5b95-491d-b136-da80d78d1a43", "comment": "Malware payload (Mirai)", "value": "83f1afac0ea44d89415f159c46ff1e62887269c5b93384d61036555c119c033e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912378, "uuid": "d97de283-585b-4243-91ab-6fde2ed74a58", "comment": "Malware payload (Mirai)", "value": "bf49718521e5dfceebe4c04725a09b3f96962046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912378, "uuid": "0f5d7f1b-303f-4085-88db-556332cebc1c", "comment": "Malware payload (Mirai)", "value": "1d6b8e4cb7fcb3a587d48bd17629e7dc092e0b63ff37fbf29c0d512a2c4fdb00a3f2927cdf24bebcfce741a0d0965993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912378, "uuid": "7ce8e6fa-c621-4f73-b11a-f26ac1a86f3f", "value": "T12D83D60ABB604EFBECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912378, "uuid": "174b56fd-e88d-4c0c-98d3-d37979799e22", "value": "1536:WuXW3UTVavjqVQywbPxPP/ww39lT2TiUeL6SZJizKzC:WuXW25VYDUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764912378, "uuid": "378e63c8-e7b3-4ba6-9589-77be0c221bd4", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764912378, "uuid": "4fc2cbf5-2c1f-4d32-ab26-402b16013ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912378, "uuid": "b9f49d03-2a5c-4911-88f7-939c00d6db75", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc8966f-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958951, "uuid": "84faf652-6e29-42f4-8303-8c874d89a064", "comment": "Malware payload (Mirai)", "value": "f18ecb9695486ee69e6a6b5f7c910589", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958951, "uuid": "62c14a0a-c6bc-4060-9047-16530f8b06a1", "comment": "Malware payload (Mirai)", "value": "840b4fb13391a54b732dc60fbdaf55b3a0ca5931b3cf0e63172747e6a09b80ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958951, "uuid": "6eb3748a-bb36-4947-b49f-790d0ec10535", "comment": "Malware payload (Mirai)", "value": "8bd193460332901bbf017f61da66d272046b2139", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958951, "uuid": "8978f22d-cc79-442f-98bf-b62c1224c1c0", "comment": "Malware payload (Mirai)", "value": "bfe1a4901aafb00a75e475a428112fa064086715d66cc95893664d7c6479b9874f632e14154649ac6de6f333d737a1fd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958951, "uuid": "9614ee73-b95f-4d7a-8e93-330d2b83309c", "value": "T14FC09279051FEF0380BC9E1B7675A43F707667AD004BB7846DC2505F60484D52032D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958951, "uuid": "fef09ccb-43b6-47bd-b8cd-098c70d5b854", "value": "3:haX+v1FWISNNXyg/PISNN3zSaDST63S4V/eXIFIX1ISIIFA:WGWv7X5/nfiD4EX4IX1vI4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958951, "uuid": "c2a130ba-e233-4e1d-b732-46eab6f7361e", "value": 130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958951, "uuid": "9aa435e2-720a-494d-a453-fa28a0744ed6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958951, "uuid": "fc1305a9-c931-4143-a2b0-72d6e29b062c", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cecb588-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959031, "uuid": "f4849b7f-7bd9-477f-990d-f5cc4c7fd2da", "comment": "Malware payload (Mirai)", "value": "d74e48d396262972bf2ecda529a4b168", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959031, "uuid": "c69730bc-bb28-4eeb-9c75-c49709929182", "comment": "Malware payload (Mirai)", "value": "8451c6d244503dfe5e808ef5028acc7e1c68c454fddc6dbf5aaebc44b5c4226d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959031, "uuid": "95ab3f7f-af0c-48a2-87b8-d0bc55d57708", "comment": "Malware payload (Mirai)", "value": "162b62f7dba07a731a98e2f79c123ab537000e82", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959031, "uuid": "b95985d7-9e5f-4c38-805f-4c8f36bc9478", "comment": "Malware payload (Mirai)", "value": "79448675716c9ff4ecce94fa2ac5ff2a501ee5c2f88773791079db5361bc1f606d87768cd982fa8d76bd342a59cebfc1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959031, "uuid": "2cc28070-fe59-45d6-b130-c05623faf1ac", "value": "T19ED05EFD8216913A420BED5C7035EF867033E38F31229F03AC8830BAF2C8824B022E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959031, "uuid": "5508b097-61a6-4f12-b7f6-b07e4a799576", "value": "6:LMFt5/jNwAK7PhumVMFt5/ZWJNwAbJ78JhumVMFt5//SaqA3LKfaoe:oth2AkxKthoTwA2DxKth/SaqA3LKyoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959031, "uuid": "f2ec5f6e-bc26-40ae-9208-80a326f1f660", "value": 247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959031, "uuid": "30d70277-2c50-449a-954c-19b7d359e180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959031, "uuid": "3db6bcf9-d047-4976-bc91-35bd4c6f99eb", "value": "sksk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a7b509-d1ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955736, "uuid": "972dea2e-e65c-48be-a226-a5e1dcf7ce29", "comment": "Malware payload (Mirai)", "value": "de99c02ff0bed4609b7ba537906de51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955736, "uuid": "79245e03-8c24-4c30-91b0-f76d435d68a8", "comment": "Malware payload (Mirai)", "value": "84b15c2df1ad681b6ed9b7fc209ef58ffd8e49cdbe7d2901ae9543e16c201250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955736, "uuid": "13034a2f-3f5a-4265-90b7-c6ebbbeb7bb5", "comment": "Malware payload (Mirai)", "value": "0b507918908493b76dad79a72c480cd29328517b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955736, "uuid": "aa8c31c1-bacc-4993-bcd8-66e327c8233f", "comment": "Malware payload (Mirai)", "value": "3ace61794534715a27165f469833f00dcc488305c62bf773a0a495aea5dc552875b1be5a8556db4c72102cb1bdcc3602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955736, "uuid": "a457f5cc-45fd-4efb-9a86-c95869a585ec", "value": "T161B312C9601B4630C4417D7DA2F857D1CC206BF86E78A1474DA48B84FEEBA61AC9E395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955736, "uuid": "35721b77-e3a8-4b23-a60f-dbbd5c549117", "value": "3072:3MkjSCfkJfPykViAGGM2PdwAwQ79tAwZoTLbtDQcGBC85:86SCfkdPykEA9PdwA579tzoTLb2r5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955736, "uuid": "6725ab9e-5bbd-47cd-bac6-b06c482b2d54", "value": 110352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955736, "uuid": "2b575ded-b18a-46d1-b97e-536541d22ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955736, "uuid": "67786cd9-99ac-45fc-8858-cc871c570a9f", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fef3208-d1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1764934877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934877, "uuid": "71171c58-43f8-48fd-a654-a90b826e0dbe", "comment": "Malware payload (MassLogger)", "value": "c924b0d32e27a0f7ac33020aad40c9be", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934877, "uuid": "4afb9786-6c6b-49a2-8ab6-65631c395158", "comment": "Malware payload (MassLogger)", "value": "84c27084bb019d81180f74d1d248f1728dbb2159216d2358ab16003731de2283", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934877, "uuid": "bda7ceba-37a1-4902-8276-3eabdf56e59b", "comment": "Malware payload (MassLogger)", "value": "745cd24b18fa8f0d05d13245fcaad587c46987fc", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934877, "uuid": "1c7bbb94-0ac6-4c7f-b66c-e902cd1e0671", "comment": "Malware payload (MassLogger)", "value": "f4e13f6b655010dd859a201c854e813c949a0cf645df62c22adf6ad4d770ee57ad4d54f36df2de509663252f9261f566", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934877, "uuid": "15984bff-efda-48fc-b965-526cf0a5e87e", "value": "T1F655D49D4421ADD3A054FEF0F540EF97CCDB5794122B47121FE5A8A92212887FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934877, "uuid": "eb80f992-8611-47d4-b79b-f52b542c73fc", "value": "6144:IDUu+ofaXatT9YNkGZ4ULHKISsT0X58idulbwhl6r9bY5KUn39Dwsg3EKFKtsyWR:FH/fVrvF3VEZAxjuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764934877, "uuid": "ae530d40-1507-4764-8dd0-6ac02f67b29a", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764934877, "uuid": "94a5d0c1-784a-4cca-9c4f-041704a6d174", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934877, "uuid": "f41b4919-8dc5-4051-842a-1c35fd655e03", "value": "-058-2025.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd3ed65-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958473, "uuid": "53e01066-45d1-4f50-a0b8-e2c29d6929df", "comment": "Malware payload (Mirai)", "value": "cf2973f5ed6ee5d46e75aca8c4b99e0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958473, "uuid": "a0c8956d-2932-4a77-b6f2-e3d1e7148394", "comment": "Malware payload (Mirai)", "value": "84c3a66620c634b2e77e8904234f8ded8c2a9e0986a361d74fb80d11c0e3520a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958473, "uuid": "0dae5399-59aa-4c7f-ad68-37ddac9f4fc7", "comment": "Malware payload (Mirai)", "value": "06e47d9ec58ba733106052984044ffcd135e2cd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958473, "uuid": "725e83c6-f1c1-4c9d-a987-3c343774e2b0", "comment": "Malware payload (Mirai)", "value": "24bbde10a78987f69346926b224cc1e0c03da30ac937fa9453dcdbd308a935017ecab7110c765f3a42599b32710528ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958473, "uuid": "22c2a433-f295-4080-8d09-7d1ecd479dc5", "value": "T10E73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958473, "uuid": "013ee776-f4ec-4171-987c-b0acc2e3badf", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESte:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958473, "uuid": "2b9d4399-c008-4e28-911d-d59972fb322d", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958473, "uuid": "256de6d6-fd02-4d91-99e3-ee5ef42aea8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958473, "uuid": "31909daa-920f-4c83-a83e-34f472afb272", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9457565-d1e0-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764942382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942382, "uuid": "a0837a30-7dab-4aae-a8a2-7410a804d478", "comment": "Malware payload (Formbook)", "value": "07a37d417d4743a4d84317b3be35ed56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942382, "uuid": "33a1ed06-b423-4296-8bf3-d281f023b30e", "comment": "Malware payload (Formbook)", "value": "856bea9f04bcead1a3202a07000274a47e2c16bf427b18740edba1fb02b3282c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942382, "uuid": "123673b8-7797-458b-a9f0-0a9f94752f7c", "comment": "Malware payload (Formbook)", "value": "d7856f6412b49f9930a611f39fddef41e2b99ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942382, "uuid": "91d46c8b-09e4-43f3-82d9-3148625076b4", "comment": "Malware payload (Formbook)", "value": "473af5241cbeedd1bb9ab9d22e3b2e389eb2512f7168fe52be25bbdc4105551483a0d20d5c004955dabd779a77456a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942382, "uuid": "770f8692-1fca-485c-9f20-016d885782b7", "value": "T13545BF027381C062FF9B91734F5AF6115BBC79264123AA1F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942382, "uuid": "429c29c4-4e36-49cf-8a83-7215c9cca010", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942382, "uuid": "23f5974f-54d3-4535-adf3-b6d71b6852c4", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXday6E/oNRZe7HMyD:hPVt/LZeJbInQRay6goT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764942382, "uuid": "4755ffd6-b5e2-4b5e-a212-6ae9382ddcf1", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764942382, "uuid": "e3aafc61-ed21-4936-af14-9e3d7f39e857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942382, "uuid": "db169b23-515c-4b95-a200-3ad62a0c7932", "value": "856bea9f04bcead1a3202a07000274a47e2c16bf427b18740edba1fb02b3282c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2afcc1-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958383, "uuid": "befdedba-d95c-4c5c-8a18-ebcaabae771a", "comment": "Malware payload (Mirai)", "value": "012a94018dda18d48db1c417cc821f0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958383, "uuid": "c155c875-5c1d-4b42-b2d3-af35a41a151c", "comment": "Malware payload (Mirai)", "value": "85b0fb54baee5f443b84f72cd67a0de4b40228a71e8c574977337f6de4958d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958383, "uuid": "565209ba-4ae0-43b8-bbdb-83997ec0b68f", "comment": "Malware payload (Mirai)", "value": "2cee07371a3f0b20fc08a46d9096b0e56aaa894e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958383, "uuid": "bb2eb403-9907-4f54-8778-4aec395023b4", "comment": "Malware payload (Mirai)", "value": "ec12da50d61bfc2de7f01b0a70acdb19ef42d5b37ce6cd22a8778bb7a28d1344302dba8906b5151a361ce020fcda4a53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958383, "uuid": "fb66fca7-6a57-4024-8de4-4950e4f341f4", "value": "T188237DC8E483DDF8DC1509742573FF335AB2F1361128F9D3D7A99632A842606A71B29E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958383, "uuid": "aa77d1a0-c2d8-45de-8887-6dcc8cca3680", "value": "768:0wUHkmxZl9oW8p2ipW/IS4smTAdvdJ2cJpKjzDyy9t:TUHkmxP9oW8p7g/9+TcL2GpKjXyy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958383, "uuid": "c420862c-ad4b-4313-9796-4f0350673983", "value": 45700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958383, "uuid": "e6354151-6b03-412a-a605-136cf5f25891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958383, "uuid": "5f4be227-dc55-4d0f-9ea1-6a0552d8fa03", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b5d58c-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958474, "uuid": "5df7ce81-8b13-40d6-8442-f943bec4d25f", "comment": "Malware payload (Mirai)", "value": "cb4740f208753ef928a3bf63643cfea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958474, "uuid": "6dfe3b38-2f17-41c1-ae92-c194c43675eb", "comment": "Malware payload (Mirai)", "value": "85e31a86e15248844c7eb79739383b07a7ec0311046a3030a73c2cba4f9e7c8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958474, "uuid": "5c08fe42-3678-49e7-a362-adc66e4fb20b", "comment": "Malware payload (Mirai)", "value": "0534c8a9e7f2d206c5c0ac0bd32b8950c60daeaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958474, "uuid": "af19717a-8287-4f8d-9105-0d408ce0bf8e", "comment": "Malware payload (Mirai)", "value": "35ab1f0510e41abd0849b0a3793ed5f36f55d67ff0b2e73ec20f67fddc1bf8231ce11bd3644136f41ed0e281f51a211f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958474, "uuid": "31bc9c67-d047-4a11-8171-70f3b32b7609", "value": "T1FDB349D1A643D5F0ED1A01352277F73B9A32B475122DDA83E7E49B727C92B51C80A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958474, "uuid": "1832a6c5-559e-4ed3-a82f-47ffd1370cb1", "value": "3072:J6K3FcNhGtMDq3BX3LMrLIuDWp35un1gE7y5PhI:J6K3KNheMDq3J3LGLIuDWogqEhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958474, "uuid": "2d302309-aa19-4ceb-8343-8b94bddf824d", "value": 111920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958474, "uuid": "5062d648-fba7-4b5f-9fcc-b10d80343440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958474, "uuid": "7a1d3cd3-3645-41f0-a7b5-c0369c37e884", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efd6ef3-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959491, "uuid": "dfdd7585-b73a-4a95-b3fe-f35e6cb52c6e", "comment": "Malware payload (Mirai)", "value": "581189db4fe7aa4f691862e92321314a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959491, "uuid": "6024967e-a568-42c9-b0ae-1d1d2829d092", "comment": "Malware payload (Mirai)", "value": "863bd9e8e1f3f36cdfb40e97786232bae3cba4438bc53aee5bed89129c3b6594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959491, "uuid": "647505aa-ec01-4202-8522-4d2e3c3884eb", "comment": "Malware payload (Mirai)", "value": "b2ea8b8ad434aa76c4dc5ecba8e563319815989d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959491, "uuid": "e7298689-b85a-4599-aacd-73f6ed240119", "comment": "Malware payload (Mirai)", "value": "472e58de8fec9acaff2d5199d5c448be0ce0d23e40c932c9b014adb5a7495d69031d9260d9a2938b4612f46242eddc4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959491, "uuid": "a6eae0b1-ada9-4c65-a286-7ca830439f10", "value": "T1E72328DAF8429D7DF94BE77E54064A09B93173C162831B2A13A7FEA3BC331592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959491, "uuid": "3e4583f5-b8fc-407f-ba69-f7ea59f798b9", "value": "768:exeXC2dxHMCk2VXcIhlSxuxlMxjEMYWAw7q8DzSGW:44HMCfllSgx+jEMJAwW8DfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959491, "uuid": "f3f6ab2c-62e3-4ba7-a1ba-26c4c6ee1fda", "value": 46632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959491, "uuid": "21e73b9f-df99-4e31-9458-a2491a090cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959491, "uuid": "b6c20d48-c90d-43dd-9ad1-97030bee09b5", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dcd8d7-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908844, "uuid": "f79b67ff-a005-4d0e-82c2-d4798ae65bf4", "comment": "Malware payload (Mirai)", "value": "63b5bd39b82f0b6a826dac0f399a00bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908844, "uuid": "5930cd09-eb71-4dd3-9a9a-31ce8bea35f6", "comment": "Malware payload (Mirai)", "value": "867911083e0d79297730befd06987801266b3270f543bf43d258349760c7bfe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908844, "uuid": "78a4736d-3819-4f30-a26c-29115099593c", "comment": "Malware payload (Mirai)", "value": "cce6e469a4a27e2748eb9515c9d4fd3983dd9f8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908844, "uuid": "2b9663ea-7ec3-4610-a36e-b9d807de97e7", "comment": "Malware payload (Mirai)", "value": "f674c8b80d650db92dd21e85c66a3abbc896d06fdaa0f49419b7a686eb620369f2191efa6f4727a6d1ec8832e72fc0d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908844, "uuid": "53843cc5-d475-4a44-b766-a969c368c083", "value": "T14A333A02322C0F17C0A31AB4252F5BE487FFEAD121E4F64A555F8B668A39E371449F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908844, "uuid": "b11360bd-836d-4d62-b705-4a52af460d45", "value": "768:2xXpdsRTDRrgZC3pQ68OjIbgXQXaRHVw6rvFNU8pfZGmeCiwgItUte2nwN:q8Hi68/kXT9Vwu96+5e8gIMwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908844, "uuid": "ecf80b2e-79f3-4399-9d1a-69b052d6645e", "value": 53028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908844, "uuid": "783c5c2c-3bf0-4b26-b4e2-8324fcb2f2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908844, "uuid": "e6ac84ab-4e3d-4655-a0fa-17ca5083958c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f62aa2e-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958391, "uuid": "3f2ea256-c2d2-43c7-b7db-d1fd1e2eedb0", "comment": "Malware payload (Mirai)", "value": "00c03fc464e11c181caab6e75001c8db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958391, "uuid": "7d6e7cc0-4058-48aa-8d9e-7748729fdf6d", "comment": "Malware payload (Mirai)", "value": "86d852bc6f4b890df8f854381ea5cbf85551936e882cbcf6e34bfda30ec1163b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958391, "uuid": "1e2a1d84-2987-4fb8-b93e-04817a4ddb75", "comment": "Malware payload (Mirai)", "value": "54d119993c87512a60964e51434e045b91c3c9e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958391, "uuid": "862c8f26-d540-469d-a961-05c68fed607d", "comment": "Malware payload (Mirai)", "value": "846da431332c9b67ab392ad0499d6d21e4cc318a163eb03eb9dcd66512740715311bf642c835c490506c36e8103f3344", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958391, "uuid": "b2dde3f4-9ecd-44ea-bc61-6e9be7a3e2ee", "value": "T157A2E115BF1C86CBC8326A3455E9FAD21292FC71F2ECDC192940C15FB5A33A92470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958391, "uuid": "781c85b4-385b-43e8-b5a6-24b24d0a37c2", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKe:O98o08kxofBE+ZkXaqGbp2F2TWul0c5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958391, "uuid": "b12a1046-e968-4c0a-bd0f-c889d5b7ddcd", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958391, "uuid": "0524b8ae-f89f-4593-a0e1-9ce78584e444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958391, "uuid": "868967ef-0573-4fdc-8e77-41f121bf863a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770b1e7a-d1f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764952552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952552, "uuid": "1cc75755-6f08-4a0e-9750-2e3f42935bd4", "comment": "Malware payload (Mirai)", "value": "149218cd2dc4dd654ad3271f84ac9c95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952552, "uuid": "f692e823-1525-456e-84e6-03f796fdaf47", "comment": "Malware payload (Mirai)", "value": "87414bef833c27a34168605b059291cd4d60bf78ce809108fbdb0dc128b229b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952552, "uuid": "89bc02ab-4926-4eb4-b5d6-20277f729dd2", "comment": "Malware payload (Mirai)", "value": "60531c0b9f69e2ff425a4e7d1969bcf06eb8a5e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952552, "uuid": "762a6376-83fd-4ac2-ad2c-3cacd3d6f84f", "comment": "Malware payload (Mirai)", "value": "4bd6e9325c79fc8c706b65ba960caeefe32735e12cf530537fad7914ac6f2d326cab17490c7b26d8ed0a4c8a8fe065d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952552, "uuid": "18db0f57-dc0c-4c3c-8729-dcf2e0443c43", "value": "T13EC31945FC415B23C6C612B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952552, "uuid": "f931583d-7254-41d4-bb13-106c57a31c39", "value": "1536:JCDwI4fG50nVg/QDEk9+19jAd424V8G2TTZtt1qLj2x1buddLqlEmwyw6FPRbxG8:MDwLYhQDz019jc4r2/Ztt1qYbu7wSbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952552, "uuid": "043b2440-b860-42a7-80de-4d85e27df69b", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952552, "uuid": "56b4678b-bd0f-4b33-9dec-2f4a4f9e9c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952552, "uuid": "c9d040b0-cfb7-42c3-b950-59b5a22c607f", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09e927e-d1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764945374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945374, "uuid": "14007897-34a2-4d13-a23d-7f381f3dae5a", "comment": "Malware payload (QuasarRAT)", "value": "6651b284c571e1f511e190cf167687b0", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945374, "uuid": "b69147f4-d0db-45b7-a3a1-5098ac2c0193", "comment": "Malware payload (QuasarRAT)", "value": "87c95139e2dc89f96b0bef969bd71588ab9a65f6aed139fb25a09a14b4af5fa9", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945374, "uuid": "d5c21961-7dec-4f9d-9cf2-f8ffdc4386fb", "comment": "Malware payload (QuasarRAT)", "value": "e5716d4f4e3b01106d7283e0ab62796039c5f915", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945374, "uuid": "aaf00c2d-d5e4-49ed-b07c-80914e388332", "comment": "Malware payload (QuasarRAT)", "value": "6b3a0fd892c784f4378b708ba8ba03d4fb15ab1f8e95fd259f33a4ab8f74c4914527da3b8c415d1c74af63bd21a50d72", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945374, "uuid": "3d1b8aad-3850-4a0e-b6b2-f52120ad46ee", "value": "T111F43372C08A89C25C64C61D341FD49B3B73EA9042354DE52F0EB71DAC54BBB0AF6A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945374, "uuid": "c2ae730d-8652-4ad2-a94d-7c59e2d05354", "value": "12288:3iDbwFwaWC+m7RG7qoTV//6P/l1Rl15S0Mq8G7fBoLWjAnt4QbUYhI7GTsdoRC6S:3E3aWCRG7d/6Xl91I0AG7GiM3hYGTIoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945374, "uuid": "458a9797-cdd3-4245-b8ec-9b9fd44a2c2b", "value": 726437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945374, "uuid": "4f942796-65c9-4da1-8782-818477874d59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945374, "uuid": "308bc985-afba-498d-b5a1-3753cbaa95bb", "value": "Comprobante.Transferencia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539336d6-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958935, "uuid": "40e807f1-aa06-40f1-8db9-a2306033ab25", "comment": "Malware payload", "value": "44b9dd7ae36156aa25a9317745a834c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958935, "uuid": "0a76af25-0080-4e2b-ba36-998699598bd7", "comment": "Malware payload", "value": "87fa7052b3f906a8f5d5781eee333260f48e44f279de299f888504b0dab7b10b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958935, "uuid": "508d4889-aa0a-4698-a99a-9a5ace30b6be", "comment": "Malware payload", "value": "0c7d0096fd5ce5f6a9bc8bec2172eff094cbbfa5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958935, "uuid": "d15e37a2-b9cd-4d5b-a632-6dbdbc89f740", "comment": "Malware payload", "value": "31a2aec73e4824ac964cc4384b3713baa44b63b411972c231c508e06e80a4a9aab759b4301b68e16db97ce67913370ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958935, "uuid": "f03068dc-7690-4de4-952b-3e1798390eb4", "value": "T1CCE030BD022FDF2781148C2060A630337033DBC7E0A1CE0EDEC4A036A684D603132E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958935, "uuid": "b4a95b7d-a94e-4d79-a2ec-381555d3cebd", "value": "12:shfIXiVhXjz4IhlaLaNgZhSNIE6VhfLK6c5:efIXibXjz5laLaNgHSNILbDK6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958935, "uuid": "44e73d60-f672-418c-b3e4-7edbd3eca479", "value": 425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958935, "uuid": "8543907d-bca7-4644-bece-8e8a7884cf6f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958935, "uuid": "858edb8c-7c26-477e-b3a5-b1e714c5f3a9", "value": "grandstream.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c65297-d1a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764916578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916578, "uuid": "1d84236c-f209-40f5-9bde-4573c2a50fdf", "comment": "Malware payload (Vidar)", "value": "305b04c41a41921cde96644d37c78891", "object_relation": "md5", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916578, "uuid": "5fe147df-5f50-422c-a53d-a889128c6365", "comment": "Malware payload (Vidar)", "value": "8808e19e8c12bc330422f203296e49878211861e86583ceb316192d1e7b716c8", "object_relation": "sha256", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916578, "uuid": "81554dae-1069-4c3d-a42e-eb0210bff9c3", "comment": "Malware payload (Vidar)", "value": "4170431f452958d3b70cc535a3a3059b6e39c86a", "object_relation": "sha1", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916578, "uuid": "e271ea19-eba5-4c64-8b70-7ca7caea0a5b", "comment": "Malware payload (Vidar)", "value": "9cf5c48829fdf42d7d15b4ec71cecd095dd04e36796b384787309200584613393ace401724429ae08039dabdcb8903c5", "object_relation": "sha3-384", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916578, "uuid": "7a53e85d-54e7-4ebe-baa6-d5215818f6b6", "value": "T1DAE57D07BCE148A6C45AB3318CB652567B35FC440B3627C72A52B6782FF27E09E76748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916578, "uuid": "daea40fe-5fa7-4642-b527-7ba8e4eb108e", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916578, "uuid": "9768b89e-2e3d-4aae-a03e-a2399fdad66e", "value": "49152:FASUd5hq3Ozr5r1VxgzcL51emk8dWFluqKwFluqKzh/Fz:Fr+zlr1/ymk8dFdZFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764916578, "uuid": "6a705add-4506-4c89-bf22-09b862fd2586", "value": 3226318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764916578, "uuid": "787f9281-a460-43b1-addb-92f33c17ce9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916578, "uuid": "5047a298-5a40-4e52-ac79-c3f7fdc15158", "value": "8808e19e8c12bc330422f203296e49878211861e86583ceb316192d1e7b716c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c56d5-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955980, "uuid": "dc6c3093-0cfb-43ed-b579-f161d9e08852", "comment": "Malware payload (Mirai)", "value": "7cb3fe7f66ae647a23c3652fba75a267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955980, "uuid": "6204c1bb-a57b-4ad8-87fe-c48f8a48463b", "comment": "Malware payload (Mirai)", "value": "88803850f589e90df40cda3849057e1d1f497d08177998be0f97aa0ec8f04705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955980, "uuid": "f2a6079a-a99b-40da-9518-9f2fcc8b35b2", "comment": "Malware payload (Mirai)", "value": "39d6e3915f25c93396b5ee5dc47da10ebe7a4834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955980, "uuid": "b17bfa5d-d59c-4e12-92ca-30b6b0abdc9d", "comment": "Malware payload (Mirai)", "value": "01789dbf7a76f29bc1cd6a917bf1805fc22c310b797c49145c04c88db0de31f1794de519c480aa8f382deffdee760933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955980, "uuid": "e58d8224-056a-43ae-b913-3a5784be7ae8", "value": "T16E8302E0CBB3A56296D56078CFE3D17B32516ACE911BF1BD221A0666EFDD94F2008347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955980, "uuid": "c35a9af4-b2c3-4896-bc56-4d3ed5b3426a", "value": "1536:8+QQa2b0R9ofpkG2mN0HX4DS2uF/UGCeFwvk+id+eUsDIEQb/bwpf7ozW:l0Rafpkte0HBZHGvPiweUp/ecq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955980, "uuid": "0884ec64-15f8-4a1a-87e4-ed6d8850c069", "value": 82248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955980, "uuid": "b576837d-dcc6-48b6-be4e-d95e51949017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955980, "uuid": "3ce0a139-60a9-4073-aab9-9747730b2ff2", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1153634-d19b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764912760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912760, "uuid": "3dfa25dc-2db9-4f9b-95eb-218f47d1a99a", "comment": "Malware payload (Mirai)", "value": "c84b78d8e63c8b286c7fdc26e83b6c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912760, "uuid": "cd769d8a-0b99-4f31-b492-37129f8d69fd", "comment": "Malware payload (Mirai)", "value": "88d49064febfb113e250220912576fcc9d73499b72e0e7a1cd98373f27b518dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912760, "uuid": "0f0b3579-5f06-487a-9a0c-680dc1db2c87", "comment": "Malware payload (Mirai)", "value": "a02fde1e911dceaa93061fff18fa66299faf008f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912760, "uuid": "972b6c37-8d97-418d-8db0-fa19e13f758d", "comment": "Malware payload (Mirai)", "value": "fc06af0f1bd9ab5d33e128ddd44d281109da9d43a220f01668a275523d20da9f1d635a27d788c2ce32d2f528de2ab76b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912760, "uuid": "8e6894ad-dd37-4015-b1fd-01d47936ea6f", "value": "T12373B70A2E26DFADF768C73587B78E31D798339226E1C581D16CE9045E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912760, "uuid": "a71e25a6-9938-454f-a57f-248f899351e5", "value": "1536:VtyeQepX22AaA36C8gTzTWCB7ZPVS3k/3ht/33Px5Vdih/pHhulO:aelpKiC8gZB7ZP56/BhulO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764912760, "uuid": "a46fc132-941c-48b6-bf3a-27dac9aa9da6", "value": 79956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764912760, "uuid": "ba2b7779-139c-47e0-a0db-aa2f5cd657f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912760, "uuid": "60b9e451-9d0b-4513-b662-0167db1b4550", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c58adc-d194-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909607, "uuid": "72c7fa19-208e-480b-916b-55140a94e953", "comment": "Malware payload (Mirai)", "value": "1a1978522a8b4139aef92152110f7924", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909607, "uuid": "1e0eecbe-4274-4e7e-85b7-0c0ff1cd8a1f", "comment": "Malware payload (Mirai)", "value": "894933ec00a829c1eee490fd98789f13e851b4b23cb004e5aac9453c3cc93525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909607, "uuid": "22d59da5-5e45-4fc8-80f5-4ecd6ae1f3f5", "comment": "Malware payload (Mirai)", "value": "5da8bf00b61df1fd0c3cbe9390840cace839535e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909607, "uuid": "914c3773-1516-46ae-9552-5282e3d5a698", "comment": "Malware payload (Mirai)", "value": "c41b75009c451b548edbbc1f1e1de1604da4dfa1e9eeffaba2a8dc51f2f0523d9b040b3a64d61f73167db203f9e11e3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909607, "uuid": "fece0308-18c1-4d92-9ee3-02b73a0aae83", "value": "T159C2F1BF7AAA2A5BFA18233DF430811B03A9F41C97DD6B5727404032998F82D7631CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909607, "uuid": "1eaa0077-5c11-47c8-a3f2-181e9bbd25d8", "value": "384:MG1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHYyVmNh:HMwxdyoEUnDz+Y8tqHWXmb50NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909607, "uuid": "6ab2035e-0f9a-4e8c-a89a-dde5c2fea2df", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909607, "uuid": "415dc7ca-4af2-4c80-a722-0132e7e5c169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909607, "uuid": "773d89f6-33e2-48b2-b3db-f8774a18c995", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aae4df-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908793, "uuid": "ded04945-d164-4cdb-9500-a770180718df", "comment": "Malware payload (Mirai)", "value": "6803e6a6ec7bf8fa9c28fcf67868546c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908793, "uuid": "3e41450c-ee89-409f-b06d-2cc16dfb3343", "comment": "Malware payload (Mirai)", "value": "8967b6dbe531c828057957fb89816859b4b621a7fc221929535d15593baf4993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908793, "uuid": "5b78107d-5b44-484d-96cd-fdd0e8051f3a", "comment": "Malware payload (Mirai)", "value": "b614a282759e95c630d54d06e49e2bf4e31e266b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908793, "uuid": "978025ea-da8e-493a-a24c-7d46d3228558", "comment": "Malware payload (Mirai)", "value": "98a9ce478721f0a4d9b2d9c612714a1eb1b0963b2f694f27e62cca8bce51390a0a9624f9c38f4dfc40289c93864117f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908793, "uuid": "e0cb0a12-10a6-4c69-8051-ea6b0a5b1b25", "value": "T1BFB2D0DCEB75794DCC5D1C7E90EE03925449B084329E8B2847328D88B46B95BB9DB0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908793, "uuid": "1998aa53-5362-48d1-9b68-4989a627efc4", "value": "768:PnfJpxtbDe+D9SL/1HFHomBmRjgk0k8CWWm:vTrWs9Y/bHYFgxCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908793, "uuid": "79b2fc29-2f8d-4810-8a5c-52716325a354", "value": 24832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908793, "uuid": "067c9e44-ff8a-47ab-b312-a5b692ffe8e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908793, "uuid": "eaa4df4f-3abc-40bb-aef6-7f5d3f3eba53", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329c1819-d214-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764964463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764964463, "uuid": "e3fdd00b-354d-48b5-98da-addcabc933a7", "comment": "Malware payload (Socks5Systemz)", "value": "686d2bf7c4c3244db6e1854582bea2bc", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764964463, "uuid": "ea67a65d-c96b-47d5-b1f9-c69ee0ea8811", "comment": "Malware payload (Socks5Systemz)", "value": "89d7c926dfaa880636ac7b8ce619334b2260e888cc7c32f0980a20e5444261dd", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764964463, "uuid": "55ab3b5c-c7bc-4658-9778-c36286c85b16", "comment": "Malware payload (Socks5Systemz)", "value": "1dfe0b7d4fb14bfb90d58aa61c2846093c65a95a", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764964463, "uuid": "dd6bb0d1-724d-4dcc-a76a-fe8686f9aac5", "comment": "Malware payload (Socks5Systemz)", "value": "2e568e720ea837390e569fcf89cb1915e6fcc1fed0182b4db48dfb06f323b908b380f9533f7cced414507a80558ed0e5", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764964463, "uuid": "bbffa148-0dcd-4831-94e9-04c20a662aa4", "value": "T171F533440FF891B5D0E19B72CE4A152C9A7AAD0B0E74941F368C5B6FFF5790A780A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764964463, "uuid": "a324b81b-59a3-4b3d-a5a3-b0bd3be6aafa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764964463, "uuid": "e9b83652-30f4-4df9-8658-b484fc1b57cd", "value": "98304:MmKrH/THFl1EZ7MKmmm4a7aLwR9setnLpWktDMnQ:pu/v1A7wmxLwRdtLwktDMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764964463, "uuid": "e7cbccfd-769e-4d87-89f1-5907e9995a27", "value": 3553723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764964463, "uuid": "8cdb02ee-682c-46ef-b63f-8f40e99baf14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764964463, "uuid": "3ceda764-8d47-4d7f-ac49-3eb6627e60ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be94eca3-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920031, "uuid": "8f0d4dda-e899-4607-b6bd-7b9b42e321c6", "comment": "Malware payload", "value": "1bd5e68c4b6044ab49fe9659339c9de7", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920031, "uuid": "32123563-5d6e-4e09-b4c3-a44bbce7b144", "comment": "Malware payload", "value": "8a18b8826daafc4a84d49299013c5cabe95dd9159ea5d5f1fb5872a6d70666e6", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920031, "uuid": "557f143b-1f2c-4194-bf0e-2ef003144971", "comment": "Malware payload", "value": "c52473f4e858e91dfd769a1774e5821750b8c8e2", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920031, "uuid": "6c6b893a-5c7c-414f-9891-f3a0f8e34098", "comment": "Malware payload", "value": "f88b559991946ff258e64b042339c96a7e91a696a2efed01b94108a3106384d7c401d8da009d1f37fa3dd8bade3624f7", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920031, "uuid": "bcbc8d59-0e8e-4de8-b158-2b8bf3afede4", "value": "T1C10833E8A4445E0CF55C4C3F2BF9B14983A798CDA778EACD761F22BC6C51A5022E7718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920031, "uuid": "c0bc251e-8ea9-438f-ab01-f4e660da9efa", "value": "1572864:YKydq8xSA+/KA15yeYDBaJntB0csVwxhXg3RPYZsiqkn+TDbFXQNbr3:ZydvdRAOeYDBwnt3sOxi3RAZQXbFXQxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920031, "uuid": "b2d7a202-a0ba-4313-817d-26189ab5d133", "value": 77615060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920031, "uuid": "6c5cdca9-3a85-4a26-a1ef-ad9b7d451ad1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920031, "uuid": "c309e848-9751-4132-8c88-aa01aa8b9b5b", "value": "8a18b8826daafc4a84d49299013c5cabe95dd9159ea5d5f1fb5872a6d70666e6.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920e2bef-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908789, "uuid": "951a80ba-5d74-4912-b721-7af2f517bedd", "comment": "Malware payload (Mirai)", "value": "06ffbcdaef5b3314bdbfe24c2751569d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908789, "uuid": "c8c3f5bb-e85d-4bc5-902b-d322779c2653", "comment": "Malware payload (Mirai)", "value": "8a99912da41b90873e1cb4d2b91bc72294fa7c4034d34522efaff873e6468db4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908789, "uuid": "ff975aca-993f-4d69-ac9b-b3485e6e63ad", "comment": "Malware payload (Mirai)", "value": "08d4f02628eeb822d4ac60a0b9f992ee09e253f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908789, "uuid": "4c9d315f-062a-452a-8d93-576532abc4f7", "comment": "Malware payload (Mirai)", "value": "029e59ef55f31fee4b32641de0b45c27e0fb282fe8631b8787d74a2d2b834a9810dd47de191e59b059c495d3d51eb176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908789, "uuid": "30771f57-0c60-48fb-9725-b802ce517b4b", "value": "T1D3337D35E02A9F94C55600B4B49C8F741F23F1C883532EBB1AE946F1A853968FA09FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908789, "uuid": "2be54466-928b-4990-bcdd-647142388c63", "value": "768:KaEfenkSqCYeztdLr9yUZf+atOhqbN9Mf7YMbCXoiZPZvLCHxw:Kauu2ClzZfbApf7YMbriPzCHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908789, "uuid": "8c14268b-c1f9-4e1d-a24d-16f78da27840", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908789, "uuid": "1b0dd3fb-fa67-4bfd-97c7-de626c313c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908789, "uuid": "c138f5b2-8d0e-470e-be5e-69138fe09afd", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d00f559-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959058, "uuid": "7c200b6c-9a81-4271-ad07-4403ec72069d", "comment": "Malware payload (Mirai)", "value": "04db32c7a2f460161dd0b8265966c34c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959058, "uuid": "1358e61e-1427-4d28-8fad-97010ba455e3", "comment": "Malware payload (Mirai)", "value": "8b1a05b37bfb3e8cb0723943a04b4fe95961dde8bf32211b787637ebc3a59cea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959058, "uuid": "ff446f5c-39af-4b42-bdf3-209b35976e30", "comment": "Malware payload (Mirai)", "value": "9c3bffc07f98e113d37b3034e8542c4b303b5a6a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959058, "uuid": "68244134-107f-4e8d-b072-a3a04904ebe1", "comment": "Malware payload (Mirai)", "value": "e7f9932a1ca1b83f567cd9b931e87d32800cdfbc5713c7b46e003e0ad8604e2959df7cc657b7a715ab63c23296ff26ff", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959058, "uuid": "ea6ffeec-d092-48da-9ecd-0e9d3cfe8e64", "value": "T14BD012ED40559274A14BAC5970754F8EB4775B8E3062DF84AC8EB43AF2CCD75F062A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959058, "uuid": "72dc9425-ce36-485e-b1d5-cd21218d2385", "value": "6:Lyz5/jNwAK7Pi+BFKVyz5/ZWJNwAbJ78Ji+BFKVyz5//SaqA3LKf9A+62:ch2An+FKChoTwA2vFKCh/SaqA3LKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959058, "uuid": "45df85c1-0ed5-4c3f-bb40-02b66345e191", "value": 290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959058, "uuid": "75cf40b8-aca1-4971-a059-6c92e733e0a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959058, "uuid": "51cdf760-1c5f-4560-808f-e10092b5fc4d", "value": "plc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa09ea5-d1a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764916588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916588, "uuid": "de5b25c1-cfcf-4715-8205-8abc81318fc6", "comment": "Malware payload (Vidar)", "value": "8771edac7987a1eeda8ab298d3b5c106", "object_relation": "md5", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916588, "uuid": "1dd7d566-6bec-469e-9dc1-b49e4b08ef75", "comment": "Malware payload (Vidar)", "value": "8b6e5f4bc8e2fb081c8da40a9e9140fbf8615f5cd97041db9c8de441e1215408", "object_relation": "sha256", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916588, "uuid": "1f698db5-8681-4c8d-a695-63e6aa37f728", "comment": "Malware payload (Vidar)", "value": "a9d04c36b7d078cdf46dc4114988c6a014ce81a8", "object_relation": "sha1", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916588, "uuid": "4702e6db-b04d-4043-a227-2e9113fb985d", "comment": "Malware payload (Vidar)", "value": "6f9fdedc0849b0c280b2fbaa9eb54b91c8ae4fe2220793e261b0984dda438571521db370a7edf5d7a8ee28a099119daf", "object_relation": "sha3-384", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916588, "uuid": "0fa6af76-a4a6-4279-a109-f4ccdbe5b09c", "value": "T1E9F57C03BC9548A9E01583318CBA52A13737FC956F3623C72A92B6BC3EF76D05976724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916588, "uuid": "5c6facea-6716-4b7e-905a-83dd46d1817b", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916588, "uuid": "198601b6-381a-47b5-a86b-d8ea0c1b0f8c", "value": "49152:tZArK54ut0loreNsHvAOQro5YJyit7VxT3fshu:tUoOro52FtDEhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764916588, "uuid": "3e271be6-1733-4a10-8fcd-249b74dcaec2", "value": 3431823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764916588, "uuid": "1843f37b-6f66-42d6-8a95-be6be411df76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916588, "uuid": "35a6a00a-4621-47bb-8f9f-eda6d5a9d589", "value": "8b6e5f4bc8e2fb081c8da40a9e9140fbf8615f5cd97041db9c8de441e1215408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735cd28a-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764933648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933648, "uuid": "a874d898-2c68-4933-a9b8-0e3aaa369a57", "comment": "Malware payload (Gh0stRAT)", "value": "1c310174231730a34d337537e235961a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933648, "uuid": "9dc8c88a-54f4-4349-a63e-95b3cb7d4c89", "comment": "Malware payload (Gh0stRAT)", "value": "8bbeb43e0b81f67ff785fdc7371f9c8038c893dfa0efa105b022569f09502fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933648, "uuid": "e27dd129-4445-43e3-98ea-2afe1ed27f07", "comment": "Malware payload (Gh0stRAT)", "value": "4ac7b83c39ce7a778468fef596d3e91773e80384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933648, "uuid": "1c8ec460-df93-472b-b4f3-e84cdcbe0b32", "comment": "Malware payload (Gh0stRAT)", "value": "cc87037bf839ee4e5747568a945a1e5b87a3aa74230d0995a58d5d217743c6b70f8854045ef2964b83e0602c230dbd2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933648, "uuid": "a1ceb5c5-a86d-4161-85da-7f0485ba49ac", "value": "T14E36232EA2F34937C16216FD8F4B929898EB7B812A5864F127E4ECCC2B787D135151C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933648, "uuid": "73d6a216-e062-42b1-b37e-cc0e7ce23bb8", "value": "b921055238d5697e4d6ec2ec02ed778d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933648, "uuid": "4b2fc246-af51-4577-b99e-dc597f21a820", "value": "98304:eH671c//////niadVpFAsqqI10R88JfcvIpr86tkVFEB6fDd9hwyY0xDbHx8:eH6w7p3k0W8RcsyqiTTPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933648, "uuid": "a36288fa-ff58-4525-bc5a-4f65cf69a61f", "value": 5046784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933648, "uuid": "25a14ed3-8b07-4c5a-b403-18b182c3c8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933648, "uuid": "756e2c4c-a09f-4a1a-aaa2-d688423104eb", "value": "1655\u65e0\u540e\u95e8\u751f\u6210\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b56e014-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959485, "uuid": "2880d9aa-ef14-425b-871e-f29f2148f8ab", "comment": "Malware payload (Mirai)", "value": "dd9189fb2e3884e50d160167a5847969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959485, "uuid": "0cee09b4-2b7e-4369-bb17-8df0d028a6ec", "comment": "Malware payload (Mirai)", "value": "8bf0638a63f3ef6e6ca20b9f0e22e6c19d7dde384b83de0d10a3bcc102803f6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959485, "uuid": "a9494404-7380-4341-9c3e-54331aef2a23", "comment": "Malware payload (Mirai)", "value": "2e53a5380d7023682fcee0fe78940bd8c07d7073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959485, "uuid": "75db8cb2-59df-4062-b5bc-60bb93a44a18", "comment": "Malware payload (Mirai)", "value": "5a65f9f35cc84620d9bec5479230843f1c0ca605b78fe6e935a21f4f7665eaceeda7c0d0ceaba75d7729d69b665d7451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959485, "uuid": "5b42c601-04b2-40d7-a6cf-6cbdf88bd2fc", "value": "T17E43F855F8818B22C5D4027AF92D118E332367F8E3DFB2129E116F247B8696B0D37D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959485, "uuid": "97401288-0922-4539-95e6-a5e0b85861b7", "value": "1536:xJnxwDe3UTQUFO3LRUTJMuwIzcI+i6Xye4hwt:pGeETXE7LXye4hwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959485, "uuid": "b5b4b7c7-f42c-4496-a301-4c31e9ae66d2", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959485, "uuid": "2b93eb31-2b74-4170-a1fe-1111cf22db90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959485, "uuid": "b7de91c0-bd1c-4148-bf08-f3e8506b7a1c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f5f14d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958944, "uuid": "04e4afbd-993c-49df-b5c7-665690883256", "comment": "Malware payload (Mirai)", "value": "e85460152a7f046a036c00ba0cc85d8e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958944, "uuid": "cdc328d5-723d-492d-824f-66470a347626", "comment": "Malware payload (Mirai)", "value": "8bf079dcd5e37f38fd5e2b3226c1d412497bc4a00807355a3295ba5d3076f953", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958944, "uuid": "c82cd430-4cf8-424c-9b2b-3df69d1a653e", "comment": "Malware payload (Mirai)", "value": "979f7e29bf69ba75d12f5ab4ad4180ec2c6b2a69", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958944, "uuid": "58414d59-a840-418c-b15a-d7c027e810ac", "comment": "Malware payload (Mirai)", "value": "e895aade0e9847b8c1532e0f38ab222d22ad32822be0177e1593ea09018e77cfcc5278a5804e7534b8782c9f77431dfe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958944, "uuid": "26b0bb3f-2118-4412-93c7-584c20eac834", "value": "T1DBE0CDBD002BCF17C1129D00A03B30333033DBE660A0CE0AAEC5F836A19CA203332E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958944, "uuid": "27642969-de72-4cc8-9a10-bc9941cf637f", "value": "6:LA5/nfiAK6iqLGmRDA5/pFGNIvF+6FakDA5/laLaNgoCKDA5/rHzaQ7:shfLK6nyxhSNIE6FakUhlaLaNgoCthfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958944, "uuid": "350b5755-809d-478f-9aa2-935c4b0b1ab5", "value": 324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958944, "uuid": "48a1acdc-f318-42da-83ed-83cc76db7225", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958944, "uuid": "740fd830-fd72-4bb5-9e22-0c7d8541113d", "value": "usw.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94042f2c-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908792, "uuid": "ed945af6-ec56-4b7b-bc2a-eddb12fa1758", "comment": "Malware payload (Mirai)", "value": "10a883cdbd730d963de89b1719905579", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908792, "uuid": "0127b016-e6e7-4aec-ae92-978033467552", "comment": "Malware payload (Mirai)", "value": "8c7a8c541cf77546198c139898318c6754ee1983c737bf8632ebb077f312a4fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908792, "uuid": "b291f7ee-04d0-4435-8769-3b3511574623", "comment": "Malware payload (Mirai)", "value": "ed8cf43c41792701520906071f5427964e879b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908792, "uuid": "6430c246-c7a3-4d5f-afb8-ee846891052f", "comment": "Malware payload (Mirai)", "value": "fd1bb6101618d2f2cb72862407012580477999d14b413b90ca73b867628f53a1fff523e080c85fa4535c307e29a37821", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908792, "uuid": "a19a7fe0-facd-4a4b-85da-5578e225334f", "value": "T14BA2D069FD901ADACC33C67259A7E5F0479AB844920E0296E258C4DBB1AE206F460DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908792, "uuid": "3ed9f40a-56bb-4e0c-a952-23d47488034e", "value": "384:MBQ8gempAvy+KNgLHH5HfYw5lY/H1DdhaxRbq0t3tyjWF8+gfmkrzHSyM:dq6YZHfYQw1QdttTgvrzNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908792, "uuid": "120c3f10-9cfe-4eff-b13b-ad5357873054", "value": 21468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908792, "uuid": "ccb04aac-d1ee-493a-96bc-c47b4e4564f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908792, "uuid": "365d5ff6-ec78-4669-a2c3-84385f301b12", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f0a28d-d1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764954988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954988, "uuid": "4fe6f0b5-8b99-4bbf-84ab-a161cdeef82a", "comment": "Malware payload (Mirai)", "value": "9de5d2ac4cd8afd3e2a08b9d41261074", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954988, "uuid": "f78f89b2-e36a-4ff0-b061-d29e1a9fa06b", "comment": "Malware payload (Mirai)", "value": "8cd6b6fb52741a7c4a611a69c203130e09b9c21a5c5d86063b3206ab7faefe93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954988, "uuid": "df0c886b-38db-42fc-bfb3-0bcd271a2d45", "comment": "Malware payload (Mirai)", "value": "675d4b3a1d457118a1db1ddf77dfeed87e75e2eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954988, "uuid": "7cfffe92-c57d-4b90-810b-361d70d6a596", "comment": "Malware payload (Mirai)", "value": "f537c4427cc62d05c3e674542c8ad8eb4648b10a228900db9b2d460fbcba03b30e211de175708ba638c516fbe2740a17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954988, "uuid": "bab8c3f7-3656-4b16-b2dc-9d991c06aece", "value": "T16A113DEF34211AC4D598C7C078BEA900A229C28520C0AB17A7DF4776809E52F792EE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954988, "uuid": "d968dbf0-1843-4c7f-9e84-6c9c8c50d4b9", "value": "12:78ZDxbZqxbZVxbZpxxbZXWtxbZnxbZ7txbZ7SxbZ7lx4:eDxtqxtVxtpxxt8xtnxt7txtGxtJx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764954988, "uuid": "c16b2f87-bf97-4c44-89b6-203ca7aa7f32", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764954988, "uuid": "3856a1bd-4d98-443c-9935-5b1474ae78ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954988, "uuid": "b5350323-a17e-404d-9028-e2c1ca269c62", "value": "router.faith-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b415e0-d1ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764947710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764947710, "uuid": "b297c733-83a2-4ac5-a74e-88aefb784d04", "comment": "Malware payload (Socks5Systemz)", "value": "05f6911d73e43e507007e5995800aa62", "object_relation": "md5", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764947710, "uuid": "d05f817b-1a50-497f-88c2-5658237a460d", "comment": "Malware payload (Socks5Systemz)", "value": "8d9c4acbd3e7b15c391a06d8903f4232dd91030c47ee7e3c1116f81e6788ff02", "object_relation": "sha256", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764947710, "uuid": "f6f10e97-7908-40a2-8f64-a08f00ffb2bf", "comment": "Malware payload (Socks5Systemz)", "value": "c1bb366c658d886783eb74721f0fb2d99d78f4c5", "object_relation": "sha1", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764947710, "uuid": "778e92e9-d854-49ed-b6a6-9d317558fdaf", "comment": "Malware payload (Socks5Systemz)", "value": "12ad771f99c304635ee63629910773130f8674f2dbfebff4bd70b75b088987032bde508a60ba410ba2870691e601daaf", "object_relation": "sha3-384", "Tag": [ { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764947710, "uuid": "8a1a6b1d-fa60-4c21-9e24-b063cfca621d", "value": "T1FB06332182EC9A34CE50B4F64D4B9E653E6AF8441C3C1788B1ED9D8D5FBE094987A337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764947710, "uuid": "77d9e12b-66d1-4015-a43a-a461896bac7d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764947710, "uuid": "d0853d4a-4b6b-413d-a94f-e609509e1aa7", "value": "98304:MtMXjIZdZHJ1K84rhcAIydkeTogpyJr172lLP5:fTIdH1zL0ktgpyXylb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764947710, "uuid": "5f6897b8-31b8-43d4-8905-64ac2b2c33b9", "value": 3810769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764947710, "uuid": "41973f95-0de5-4949-84ca-53db8ea4858f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764947710, "uuid": "36adc13a-2df7-4b10-bbc0-f1a8a49fea0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c46965-d219-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764966640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764966640, "uuid": "10f0ebbf-7a86-43a9-a07c-bc253a3a1ece", "comment": "Malware payload", "value": "690028daa756176b29470178b5c0743a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764966640, "uuid": "7ce1d441-6592-4d55-8208-e99186a403d3", "comment": "Malware payload", "value": "8dff0d5021df7ebf9aedb201f6dc9998202930b0843ada1ed1b4453b29b4094a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764966640, "uuid": "9ac0cdf3-9855-4f82-827a-a0acbfd6232b", "comment": "Malware payload", "value": "742f37331fa51a2f1499debf03448536cce48752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764966640, "uuid": "8cf5910b-23e4-457e-b837-e0d063bd8848", "comment": "Malware payload", "value": "963187853a3bac4ce69c1a3bed5b5e3523dec4bad9800fe90d0948de0adf783f2e2bbb42be693806f1d099b510046534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764966640, "uuid": "f98ae9a0-d208-47bd-b590-6309f9905bf5", "value": "T186C63BC2F9410626C56BF639ADB162247330BD49433126D76FDB06A50DEABC4273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764966640, "uuid": "5e60769d-116e-47c4-aed5-20c6c148b5cc", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764966640, "uuid": "c071cfc7-995e-49e7-b966-237e1eb4a98c", "value": "49152:SRVUe36ZA4NPqKfJgeL9ugfyBK1xiHPHb9tojdQQoMaff6XS9QqwBWbIVV0z/idP:te36K4nglYhiH/SdQJlfHdpGNmmPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764966640, "uuid": "91383657-19be-43a1-8c36-e7ca3ac0f9a0", "value": 12574032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764966640, "uuid": "26cf69ac-5b03-49bc-a1c5-9b3b11a12a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764966640, "uuid": "461bd15e-d51f-421f-b5b9-4a561e4ffc1c", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e76d50e-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958417, "uuid": "aa32f38a-4251-4efd-a7b0-31c050d94aab", "comment": "Malware payload (Mirai)", "value": "6d8ad3ef0067be1716bc5238a9ac0102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958417, "uuid": "ab9a5b9c-4534-437c-8cc0-5464dba752f8", "comment": "Malware payload (Mirai)", "value": "8e6ee2c5594a21c640fd95b7fd0c2199ab4d5d170cf7dd2306cfb67da6f0f68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958417, "uuid": "6b8145b6-bb36-4025-8503-62f2c2379af5", "comment": "Malware payload (Mirai)", "value": "da9011aa51eaeb12d67e9875d8621362b67d6cea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958417, "uuid": "db308061-29d9-4634-8415-15b5de81e819", "comment": "Malware payload (Mirai)", "value": "612b8ae80d0b2a927cfcfd604f0f629580e3aa453e84c8e1b9066f38369dd325538ef56a3b749996a21361b22e6bc4cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958417, "uuid": "973ef9b7-4f68-456a-a9b1-91593d366906", "value": "T115C37DC6F243D4F6E45709B12136AB369E72C43E6025EAC2D7789D31ECD1A019637BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958417, "uuid": "b292ef09-a631-4834-af5e-80140c76f7a4", "value": "3072:AViHMbhhe2yEt4pB4t6qQMw9WoCUET4XhIB1ASx:AVis9he2yEt6NBlET8Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958417, "uuid": "0e8f09ea-2f8d-4b11-af8a-21c2c72a948b", "value": 129864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958417, "uuid": "e57d8cae-e012-40d6-8694-786663fbdc8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958417, "uuid": "cbf6f7fb-3ef5-491c-bd1a-2bb5af012e51", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334b53a6-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958452, "uuid": "9365a7fd-9366-4b77-a718-fcd2b9242aee", "comment": "Malware payload (Mirai)", "value": "c28718cc2b35425cc52345bdc9ba9a43", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958452, "uuid": "3aef7ed2-0395-492d-9a8d-73bb9cc448a8", "comment": "Malware payload (Mirai)", "value": "8e96b8d240ebeee3c670f9a9d36b634b39cb0cc5610f7d3985173733953180ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958452, "uuid": "5efbc3e5-ff86-48b6-ad3d-f36ba1f8e9d6", "comment": "Malware payload (Mirai)", "value": "b3cad39774770519078c3c8752b0d596db96738c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958452, "uuid": "2899f051-978f-4bc9-a36f-a7eaf1fc9bab", "comment": "Malware payload (Mirai)", "value": "60e296f30bc06f74cf526682a57862c516e6ce84d60f4150467cd7bd3ff624cb30fb745ee0a8af71aaf81a3758f76f40", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958452, "uuid": "38e1acbd-10ab-4542-a5b9-9721ba28497e", "value": "T1BD313EE00896173F9EC09917B366506D203A29CB7E3B6DC0E4DB78D5B3586D2B221D1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958452, "uuid": "6aac95e6-e217-4568-bba0-bf8237306a7a", "value": "24:e/EBvw01CKBFBv60hzqYTtqBvTm30Tcs1BvG03yBlcdvbEByTvNAUs8c1OMtqBVf:uovw0DB7v60h5cvu0RLvG0ilcG0KUsFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958452, "uuid": "cf739dc9-eb2c-4183-945d-5d7f6309cc80", "value": 1466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958452, "uuid": "09e838f5-34b8-4cf1-81df-f76d82c783ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958452, "uuid": "4f9d8395-faaf-467c-9b07-6b67be1f57c3", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c4b06b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958961, "uuid": "513a594d-ce45-4297-a46b-f7bac550f07d", "comment": "Malware payload (Mirai)", "value": "2a5cc7ff93a6cb5fa6644a07a5dee17b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958961, "uuid": "b1371836-0074-4576-b3e7-556cbf803a1a", "comment": "Malware payload (Mirai)", "value": "8eab9907c474746741af4cc186aded79fed7d7655d53b93b045b90f832ee6bcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958961, "uuid": "57fc7289-c079-49a4-8d4b-8d48324f3935", "comment": "Malware payload (Mirai)", "value": "7bccb4b9e0c8a56cbee229e4c2a2ecf297786b71", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958961, "uuid": "53424413-49d9-4559-bc8b-3c87796dedfa", "comment": "Malware payload (Mirai)", "value": "f5a740ac9fa0de71df8cac5d6869a9092be7d0e3e22c31ba03cc69a77722a608a10707ab2f7471d14882f8a03c14b79f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958961, "uuid": "99d78cab-382a-4464-b39b-182a097279ce", "value": "T1071189EC011BB94084389926B13ED4D5B172DBABE5F79645BEC5513FF1C8831B132E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958961, "uuid": "e03fd4b1-cef7-481f-9f02-1b4bce3167d8", "value": "12:shdChaXhJuh+6ahlOBnhnIhO2QhwDlh5uhcDRnV:eS2GClYhyK86i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958961, "uuid": "4fddff6f-c0d6-47ef-95be-1041489fe8b6", "value": 914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958961, "uuid": "7a7b1d92-9eca-458c-b306-5d31c6283150", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958961, "uuid": "f37ce139-fff7-46eb-9d65-2e466f07fff9", "value": "sd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cfc31e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958959, "uuid": "8d10698c-6b3d-4121-855a-22aa1ce1739d", "comment": "Malware payload (Mirai)", "value": "272742ca4e51ebf1b6e04ccd1c5f619c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958959, "uuid": "0f223839-e1da-48cd-a1f9-4ccfaa58c317", "comment": "Malware payload (Mirai)", "value": "8ed141ee728ea1767e4cfb4e505622124fb3eb01455f0772a6360c30d709e24e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958959, "uuid": "a3fdea05-383e-4774-9450-983df1fbd3f8", "comment": "Malware payload (Mirai)", "value": "c89738756b2f224d9301c0044fe2f761c618718f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958959, "uuid": "aa92fdf8-6e98-4bc7-80cc-cccf0f2534a3", "comment": "Malware payload (Mirai)", "value": "8b137b31132adfe7a2d71c07c1f95a4b63856fb71cf18ea083daa14143d40a783ed099a0532640bdd8f161f16c23bda4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958959, "uuid": "745e4116-bc21-4874-9a56-236559851acd", "value": "T17BC08CBD002B2241C000BE107026305DB233CBC720B28B0A96C83033F48C420B222E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958959, "uuid": "7f332890-86c9-426e-957b-364893d59e5e", "value": "3:LxAjtyg/w8NBzSa+ANjaziDxAjtyg/pONBzSa5Ap9Mn:LA5/wkPjmiDA5/Myyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958959, "uuid": "1d89ea4d-a4ea-45c9-ae7a-616d9b279f3b", "value": 154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958959, "uuid": "8e17d9d1-3113-406a-a55f-922635939568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958959, "uuid": "2eeb5c17-336a-4d4f-95ad-6e056227bd09", "value": "4g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44db2b9-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951796, "uuid": "8b917357-2b83-404f-8474-80b4e6620911", "comment": "Malware payload (Mirai)", "value": "7baf253ed300ef6f30c6c25b6c7812a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951796, "uuid": "9da57588-e326-4843-b397-72c1f3821cf8", "comment": "Malware payload (Mirai)", "value": "8edd26bda76c644896088eb6dab91619a1f072ca64e6e1791b6a4d5d7b840900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951796, "uuid": "4f2710e5-e422-4aa7-a04e-a63c84bad5ea", "comment": "Malware payload (Mirai)", "value": "fa12153b993a621c1ca21defd2532d362cee9678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951796, "uuid": "e8bc0557-9b1c-4608-aff7-ac1c28884e40", "comment": "Malware payload (Mirai)", "value": "5b5b42c45bcfaeff0e7babde275504ce473ef889d1f59aef875b63b0066a7d7d1dafd44cb7d245b6aaf1bb76085e9ee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951796, "uuid": "e609472a-7ea1-459a-b9ce-2c9e425cba16", "value": "T1770412312DECBBF0A8E4C9729CF8810B2B149174B94E3E37D9304273B5A6797872A755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951796, "uuid": "4ee52df3-ec2c-43fd-aa7a-d499691d7234", "value": "3072:Ce3Z6Tw4s+29jdpi1aglvmeY7xIHW4HGL7usj9ZG2+u4t7eS6D74yop/PO3U5tjS:p3Z6Ts+WjHi1JmpxI24Hsu6R+JJ00zlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951796, "uuid": "c83e6915-dd2b-4df1-8aff-6cd0263c5a0e", "value": 185308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951796, "uuid": "92e1090a-b5e1-47a5-aa45-d6a80ceb9834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951796, "uuid": "33e905d6-add2-4fcb-8ca3-1535aa5c6980", "value": "SecuriteInfo.com.Linux.Siggen.9999.15616.789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871ed96e-d181-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764901469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901469, "uuid": "320811a5-04e1-431a-9303-3a8eb3e2f45e", "comment": "Malware payload (QuasarRAT)", "value": "92b2acfdf0a5a9fe3c39bfde595ca527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901469, "uuid": "0095738c-fae2-45a3-a452-692504b84680", "comment": "Malware payload (QuasarRAT)", "value": "8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901469, "uuid": "863bd388-2a5e-4889-89be-f9b0db9b5921", "comment": "Malware payload (QuasarRAT)", "value": "7e147eaf3946a68fa305962a33167a4bdc5f8bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764901469, "uuid": "4df98978-368c-4c4f-87f2-c6ff017d5be5", "comment": "Malware payload (QuasarRAT)", "value": "a145e473fb7717766fadc1eed29790e98bc8cd45f430ea52fb882fa6ab0c0c2bfc4233d8f825000d766080cfee1537ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901469, "uuid": "4f2c073c-e8f3-4ede-af1c-9939dd12df5a", "value": "T12236330FE2E32877EB561BFAC80FB5020493CD44B58B53920D9D4B1D61786FA8B5672E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901469, "uuid": "2c07144e-488f-4296-9cb9-7569e9aaa1bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901469, "uuid": "f3c177d3-ae65-4dcd-9158-fde1702a8514", "value": "98304:PSoyOByvzsunMi1WqME5y/C7n2K6bjqnh1MtMhbp7ksWcUa8sHXp+/YSL:6oBybsuMi0PE5aRbmnnMQb9kXc58kpS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764901469, "uuid": "b2f5d32d-d42e-4c9b-b658-87237bfad85a", "value": 5261824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764901469, "uuid": "3cb1f3a0-b1d3-4c16-82a2-fad9e624c158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764901469, "uuid": "4c0370dc-7afb-4031-a65e-f5c822886f7c", "value": "SecuriteInfo.com.Trojan.MulDropNET.78.32007.10377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5580aaad-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1764952067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952067, "uuid": "f374c3c5-3ec7-4ce4-8d7c-54fb4e9bb3c2", "comment": "Malware payload (AgentTesla)", "value": "13262a3012a2b4030c821fdb8b6084ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952067, "uuid": "a2c48c6d-5cc8-4896-8212-da7ee009a67d", "comment": "Malware payload (AgentTesla)", "value": "8f9199f00483cf197611ab4e975d0305caead0023b57c77f1bc6f7435e19d2d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952067, "uuid": "5502870d-9f2f-445d-8428-de87244f0962", "comment": "Malware payload (AgentTesla)", "value": "ab04abe9b69900a8749a3bdb7c2b20fdc9f28203", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952067, "uuid": "1164f75c-5bf0-4325-8bb5-039bf30935c7", "comment": "Malware payload (AgentTesla)", "value": "3339e6c4c783692e8084c3722722bd82e146588960fa5e0fffb05dacc576514b842009f969f4b5121c88c8d80a8f5a53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952067, "uuid": "358b9dfc-546a-46dc-9ac7-8afdfb27e3ff", "value": "T1D4130208E4DBE915DEB5322F5BD6726421F39E2C095375F85C4C598BA7E0D483BBC640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952067, "uuid": "a757467a-6430-4953-a95b-ca7003eff1e3", "value": "768:mKeadcA3oJ+/GCMzBrJbsp3nCh/j2Snrk3KOyQ6lTrzAsBbbHz/y9iRBM2sv/0cN:bVRhGCMtrJbiArOKTvxrfQiP49z/vy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952067, "uuid": "f693536a-1152-4e95-83b5-9adcd90597e3", "value": 43265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952067, "uuid": "e142ae76-71ef-4615-a339-53db2d1ad01b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952067, "uuid": "c3b2c512-f088-4238-844e-e53bfa48a38c", "value": "Invoice_Petromar Shipping_#8201B340.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34786225-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917222, "uuid": "00ad73db-2998-4494-92ca-9d450f1dbea2", "comment": "Malware payload", "value": "11ee5f269902e37ab15e8ae2c5d37412", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917222, "uuid": "523d3466-a537-4a66-bb3a-97a20eab8a8d", "comment": "Malware payload", "value": "8fb52fa62541c16519520d305d5d4ec7ac3fe2e09156c1011a05ebc9dc05707e", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917222, "uuid": "61a4fac2-f5d5-4882-8ddc-7897836b461e", "comment": "Malware payload", "value": "007b5cd6d6acf972f7743f79e23cab9bb2ecbee3", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917222, "uuid": "e07d41d9-c9a1-4278-8a3b-f1ec221f507c", "comment": "Malware payload", "value": "77666e63b9160a7a4c234403c6dfd5ce0f4ae38177ecc1e59a719f7618de39c54eaba77b94dd0dd005b7e51f020c9935", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917222, "uuid": "a85a74d4-7cbe-4ade-80a6-55808aa7685a", "value": "T1B114AE5B76E930F8F0779278C8525A45E732B87157609FAF036846B61F232C24D3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917222, "uuid": "7536bbb1-7d24-4b5c-9823-73f7bafa887a", "value": "e2266d2aedae8b121835a66ac51cfac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917222, "uuid": "2ba22d12-7d37-4088-b74a-f4667904025c", "value": "3072:2H5it4izHJz82FKqv/87InPsFMdOZtKGzTMSgQ6ED/4n9TVf01DoA99jNGH:eit4KBFXYIn6MYZt7zIQ89TlYDfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917222, "uuid": "ce737ead-b311-4846-91f7-79981f4ad889", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917222, "uuid": "e362e518-4131-40df-b553-acebda3c469e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917222, "uuid": "fb9cb92b-7c6c-47ad-8542-2fcce4329dda", "value": "8fb52fa62541c16519520d305d5d4ec7ac3fe2e09156c1011a05ebc9dc05707e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05851304-d206-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958375, "uuid": "81e9aabe-3446-43ea-ab1d-0c410b1472bd", "comment": "Malware payload", "value": "1dba3179654a5f780c1d5e68e3fd1c72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958375, "uuid": "69ec7b49-b0c2-42ee-b466-80e3598f5882", "comment": "Malware payload", "value": "8fc202383dfd40ff57a379cd4413cbab65a62250085733a0dc13bfb20ea8f647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958375, "uuid": "bbf24d24-bccc-48db-83aa-f8955e0963dc", "comment": "Malware payload", "value": "58b43bc5570e74774d1b2be94a4366e88e8403d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958375, "uuid": "3bffc6b8-464e-45f2-965e-3fe06bc1823d", "comment": "Malware payload", "value": "8bbc3733f14cced060844d3bbe9b685f44f17951d2082988fcaf2f87a596b679633bb46d7acad1597d20adfdc1060ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958375, "uuid": "2289814c-74b7-4ee2-80a7-813194275a0f", "value": "T1C02318C5A903D8FCDC1A1D742563F3366EF6FC791028E983DB94EA36B852701A64729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958375, "uuid": "0e6efd78-80a9-4d67-b130-216edec318e0", "value": "1536:0CVW5MMDKvoud+tGolK9z1wkjuljuGjuAjuZAZxYY7lNt6u:0CVGRDKvNI7lKQSAXH3Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958375, "uuid": "5cc5cff1-0bba-41b3-af58-9253e5b3fdb8", "value": 49808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958375, "uuid": "836c3065-0e8d-4351-a242-abd2ed6f9e31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958375, "uuid": "c1916efd-b135-43da-a3df-ea2278cfd483", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f520e13-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898289, "uuid": "ef168d47-5877-4547-a0dd-1bf4f3b3f14d", "comment": "Malware payload (Mirai)", "value": "fb1bb1642e1fba4caf5b920e8f8082a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898289, "uuid": "002ee10f-2fda-4639-b9fc-840784cd32a6", "comment": "Malware payload (Mirai)", "value": "9063c5657fb39d55b769901b4f544a772b8e9236b27072bbcb5867f54c2f32e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898289, "uuid": "95b05af1-c5e2-4b8b-9a47-38f7803a8d10", "comment": "Malware payload (Mirai)", "value": "1234fe02ab68503a9ae312b7a031ab49cb388a64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898289, "uuid": "4bc1ba82-09bd-4d18-ab81-1b25bd0d6e64", "comment": "Malware payload (Mirai)", "value": "32995a21f1a8681b8cef173de0b80a517a8008828266549ce9051064c18fb63e71759c5ade83402836652128b3925fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898289, "uuid": "bc4f1502-67d4-42ee-8b9e-698379a3508c", "value": "T1BCA32A857CC29A22C6E163BBFA6E418D332563E8D2DB3217DC255F1533CA91B0EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898289, "uuid": "b030df09-e6e9-46db-a2d9-18bec9e6dd87", "value": "3072:lhzzaVEcVvBa+dXYQM0/uAhVJew3jmaSPM/d:lhzk7hmaj/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898289, "uuid": "35f0160f-548e-410a-9353-68630e60cc32", "value": 100336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898289, "uuid": "ca268638-d57a-4c01-a3cb-f58f8d41a522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898289, "uuid": "7e6e8dc9-2892-4ac5-b900-25fb80f3f8c9", "value": "UnHAnaAW.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9f191-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958479, "uuid": "49fa4b2a-936c-42e3-a509-a683cd6df17f", "comment": "Malware payload (Mirai)", "value": "e8b7a8e81bbaf21cbdbbe41589234946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958479, "uuid": "20608c36-397a-48db-b937-6abac4ecc5fd", "comment": "Malware payload (Mirai)", "value": "909943600b4b041eadeb2bba33511d6c3254f2ace62399a7b1e52cd928d2863d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958479, "uuid": "40a8f00a-1b62-40e0-8a42-dd9bdf89eae7", "comment": "Malware payload (Mirai)", "value": "80c4166eb1179953c6b886d50cf9ace939d3c22d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958479, "uuid": "cfb7ecee-153a-45b1-9e46-8ec663aa3a93", "comment": "Malware payload (Mirai)", "value": "09974d0d274454661d7a0432e1400a3d07e676f4b6c1b293fe4f4430dcd2db0a9ad4df998bb01e33745dc2d7c080ea12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958479, "uuid": "d8666567-1890-4845-bbc4-9a2dde88b81e", "value": "T1F3D34A0672180E07D5E719B0263E1BE083FEE9D421F4BB89295F9B6A4672E371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958479, "uuid": "47a16ef8-5e4c-495c-bda0-1b0cf80c569e", "value": "1536:5/N3Fgl0wGYZ69LwsIJK6gUr9qkzUAU+JgdIX0G3MQOUwU21LG0vg77j88yyZ7Yl:5/hHu9qerJv0G3lOUwUeVM7FyyZg2QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958479, "uuid": "d97248a4-8281-4050-a528-54c46795b4cb", "value": 140856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958479, "uuid": "894c3148-f081-49d3-ad31-262dd0dd1082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958479, "uuid": "d099e886-dea7-4fcf-bbd4-6716e08d59dd", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8624666c-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959020, "uuid": "e9e06162-c2a3-438d-b231-23a0b0b0ab9d", "comment": "Malware payload (Mirai)", "value": "739e0bc17707915860f2a32efbd1b30d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959020, "uuid": "86eef327-698e-4651-8e81-5dc0d28c511c", "comment": "Malware payload (Mirai)", "value": "90ed45ca85c103a92f2046155505c45b90eac445b62c29fb591cf9822b920b12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959020, "uuid": "a12d7739-28ac-4d4a-85ab-4c549e12363f", "comment": "Malware payload (Mirai)", "value": "bddfba8bcd53d30e26306f133da70b323926c970", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959020, "uuid": "5d4725bd-b505-443d-ae1b-025c5e8155ad", "comment": "Malware payload (Mirai)", "value": "148b534657d5c4f4f3c2650fed9ce89b272fb13a02c23a9ac1be0d56e78012a211487886cd726a6eac6d01a4c5cf6d22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959020, "uuid": "291fbad9-f04d-4030-94a2-bcafc1cbf35a", "value": "T1F9112E7C861A6DA48149D42B7281880E71A38BDF143FCB982E4C113D31E41EE6132E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959020, "uuid": "d4619248-e876-4d33-88a4-ac8efbe411de", "value": "24:fFIrFl5vrFirF1rFAhrFBrFMrFfrFrrFSrFAB2:fKrf1rkr/rmr/r6rBrFrArS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959020, "uuid": "6c88e140-af4a-495f-9194-2bbf6ef3e57f", "value": 1016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959020, "uuid": "48eeb5b1-e336-4102-8506-d7dcef0cd210", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959020, "uuid": "065a89f0-8a30-4d62-9cef-ff17d6deb54c", "value": "af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694bb83b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958972, "uuid": "913a5dbd-3584-4d05-bf8b-efefb920e090", "comment": "Malware payload (Mirai)", "value": "4b1f2871f49402407686d36d06edbdd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958972, "uuid": "2983bc1e-9298-4710-b202-f39950761ecb", "comment": "Malware payload (Mirai)", "value": "9172f7f80d127594c081f59ce462f96977d3a1a5c14e11e9986aca453e9c61a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958972, "uuid": "d1838db3-c876-4afd-bb8d-01399f85a799", "comment": "Malware payload (Mirai)", "value": "e6066a9eec41db08354580d79e4a1eb6de8ede9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958972, "uuid": "41b01288-f740-4486-8d5f-9488e366f9ed", "comment": "Malware payload (Mirai)", "value": "84fc4297558eff408298799cd22caf5d8db66b07b2910c3e1d0adb18cc48456f4253d4ca06fd3e4b1a5dc2c83925a27a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958972, "uuid": "d55b675d-b9b9-4e3f-81b6-75298a2b473a", "value": "T132435D42721C0B13D5625AB0293F1BF087FFADA020F4B689654FAB598675E331442FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958972, "uuid": "91c1e420-36a6-445c-b37b-711306416c89", "value": "768:e0iGMINPneCoRBZR6Z6napGGjmLQvF+87VTmAIcl+cAnCDfVPefu7:8Q5ezzngjm8s+l+5GfFIu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958972, "uuid": "f9ff387c-c0f1-4e8c-b6e7-6b66b205922e", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958972, "uuid": "9f2c6dd4-9d20-429e-80b1-366502657d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958972, "uuid": "41302eee-9394-4a3f-bd70-f02b3e7af131", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93599e18-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908791, "uuid": "3c0871e9-3af8-4b28-acab-f7c28c8c06e9", "comment": "Malware payload (Mirai)", "value": "5e97661e9a6541dc83cf877f9d3848d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908791, "uuid": "5c9e349d-7e80-40c3-9c3a-fb603f95e0ec", "comment": "Malware payload (Mirai)", "value": "91829037e4bdd2e4c3e871cab110f2c604697fecb8916483459590c715f0d17c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908791, "uuid": "c82f1ae6-dc99-4a9b-9fdc-b2ed580183e3", "comment": "Malware payload (Mirai)", "value": "fb77f8befd1d033497456dc5be60f83c3111cf91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908791, "uuid": "d78280fb-076c-4f9a-b260-e5b3a92f0b20", "comment": "Malware payload (Mirai)", "value": "4bbb683088f37179a7a3f2cd4c0ce57aaf3dd6430a68b3acc45e563263f0aa1ef8aa2e1c9359c466c2a805b2f1714254", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908791, "uuid": "3a2d987d-4e9d-4727-9cee-be6de1ca7c2a", "value": "T154C2D06111B1AEA1C6619EB1CC796682AAA307FCF3DD61308959495C3BF56420FFD0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908791, "uuid": "07713d19-a169-4955-81f6-39301ffb9e1c", "value": "768:lYC5mKrXEjfUoOzQGrz1iD0+0QyG9X9q3UELftD:2C5m6EY73rzCyGQLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908791, "uuid": "e0b38697-4399-40b9-b248-d100615cab3c", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908791, "uuid": "3433ab97-1634-43c4-868b-0160e5754623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908791, "uuid": "3f027099-3da5-46fe-8eb4-76aa0ca6e34f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcc3465-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958952, "uuid": "f2a0f234-c5bf-489e-b98b-f4af364f3903", "comment": "Malware payload (Mirai)", "value": "f215d1193490ff1fb70a7fb0d4fc5fc8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958952, "uuid": "bd72f8a6-7968-4308-b9ce-06b321402474", "comment": "Malware payload (Mirai)", "value": "91bbcbce758e5f576644ecea54934a618efea85e32dd62fa1b149a4a52abf5ea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958952, "uuid": "284bfa10-6654-4fb2-a668-19adb66068ab", "comment": "Malware payload (Mirai)", "value": "ffcbcc51dd9e61f0cbc3ee57d3a63dc6511ca7c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958952, "uuid": "6d64c58f-b556-4553-b1e3-a58be562a84a", "comment": "Malware payload (Mirai)", "value": "e24368b1f8cf3b7f17755f6c8a0fc62bc82b1b2db718346dbbafc44bd1e25a2c4dbcd5712ca82767a6d2e1146d606f4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958952, "uuid": "a918adaa-8463-4eb0-9f7e-68dd2fa9c469", "value": "T11FC0C9B8001E7585C084AF15B029305EF2A6475B21374740E9C830A2F84D521A232E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958952, "uuid": "0a08b730-bee9-499a-a5a6-6ac5239b71e1", "value": "3:L08ND5yg/w8ZBBFSa+TSJarjKPJVtOVRXyg/pOdFSa5T69/KO:LdD55/w+2f+PJVty5/8MKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958952, "uuid": "a3a16f25-647b-4e5f-80c7-3e6df03b405b", "value": 186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958952, "uuid": "1123d6fa-ead7-4b7f-bc78-db4faf514f84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958952, "uuid": "751d6ade-4a59-42e3-a2d8-d77f1b309d1f", "value": "skidb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4829ad-d1f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764950227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950227, "uuid": "a219625a-7dc0-4c37-864c-8db469d52bb9", "comment": "Malware payload", "value": "4b58b1564c5d751e40f0e763b822984d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950227, "uuid": "f3f7b630-5eb7-497c-84d4-b025c0f719e5", "comment": "Malware payload", "value": "920ba9e169a2da88237ce444c1d7ac53af0323bf5be1024b4a2836b505407991", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950227, "uuid": "d7fc9af3-e5ee-49a2-9900-72e484d1ec2c", "comment": "Malware payload", "value": "31b162028b973ddc351c43588f728c28e59dfa49", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950227, "uuid": "14d3b538-b918-43d1-9204-64eff33f9f8f", "comment": "Malware payload", "value": "6cb2884f5b40b31a860c67df9e72c7263446bba5d4f6b9f90ef2c3209e839d8d1855a9b13af993f3d47d9a6b3bab9d0c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950227, "uuid": "fe1c5dac-bbf9-4a50-a10b-a6d212488f4a", "value": "T1EE560222B1CAE6FEE0275531CD6275F0447B6E10D91A8CAB9DE43E48FE39054197EE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950227, "uuid": "49728dbb-bf08-405a-91ff-a7fc56ba73d9", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950227, "uuid": "6927ec53-19e0-45d7-bbb1-d380cf322cfb", "value": "98304:+Dbua4YwGaZc1YQVQ86p780jQavjfuGDS+4L1pSf4oNQA84:+DbeDZcmQVQf18oNWGu+4hpSQoNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764950227, "uuid": "36dd2986-6baa-43a8-874f-4efa5087cf82", "value": 6123244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764950227, "uuid": "1c1937dc-810b-48d4-be2f-8a87d1909bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950227, "uuid": "63c43594-a1ee-4c0c-9240-ac77fb3a317a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefa1fb9-d1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764925642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925642, "uuid": "6d686cd6-8c02-475b-8856-94ae9e2c19b3", "comment": "Malware payload (Mirai)", "value": "fa9e8fc2d0f7ac2205adb64167937eac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925642, "uuid": "3171cb18-6987-4658-90fb-62c95512229f", "comment": "Malware payload (Mirai)", "value": "92257867a48bced34d6d2aa6d4cb731400671024a48847a6be94dadbdd9db2ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925642, "uuid": "3d221feb-99ef-4d80-9c58-e3319d4a49fb", "comment": "Malware payload (Mirai)", "value": "605c8f0db6b60799ffc0172805c285ac933696a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925642, "uuid": "4a9fc4b4-6c4f-4338-b14a-8815a4cb9533", "comment": "Malware payload (Mirai)", "value": "66a6f1a8885d92a62e1517a826e04c96bb742a09ced646f22ebd1ad87d93fa319e359f31a6f0d885f9689c802e65ea7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925642, "uuid": "66794841-a3d6-4c18-b7bd-142cefba7a09", "value": "T10D44972A3E22EF7FE568863107F39A70879921963AD19345F26CD71C1F6028D684F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925642, "uuid": "4cf7b398-fd37-4630-b90b-4bf8579233e2", "value": "6144:I8h696zJ8y+Qru0gTAqgPmJG9X1CGv13ZbSanEu:bo9jEoTZgPmJG9X1CGv13ZbSanEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764925642, "uuid": "d0d35ed7-c53b-46c9-9058-a026fc0030d5", "value": 256379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764925642, "uuid": "3bbc777d-034d-4a57-88d8-db74d9880ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925642, "uuid": "4f9c9c46-f3de-4d13-9372-f59f4fd46ed1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8fbaca-d1b0-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1764921611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921611, "uuid": "60ea6867-ccb7-4fe8-86f6-f45a96bd083c", "comment": "Malware payload (DarkTortilla)", "value": "6435bbc81701ef985a7eab6c6ebef559", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921611, "uuid": "79870df1-8cc9-42eb-97cc-9b2d2c49888b", "comment": "Malware payload (DarkTortilla)", "value": "929a6fecc6b43b14b92fb96ea538fc3b64f44a5224e47505bee802817d584e3e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921611, "uuid": "271c209e-da0e-4f9f-8be7-5090864e5d20", "comment": "Malware payload (DarkTortilla)", "value": "195ebe7179f8f1d65a4f62c621ac3c806b31119a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764921611, "uuid": "d197f96f-022e-40a7-874d-caf6843e54da", "comment": "Malware payload (DarkTortilla)", "value": "19267edbacfb737c615b50167153c08dfdc2de37dea8d25ff814165d98aa5838ed84ec93de33727b8c2caf975a6a6768", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921611, "uuid": "ae4dfbb0-2821-4fce-9493-b83bf0c5d6fc", "value": "T15185D05223D51F58F07F9B396838644147F2BD0BEF25DB8F7E9919CE2860E818661B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921611, "uuid": "ccc2d217-04aa-4d72-a6a2-87d662d2b46d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921611, "uuid": "3ea30e7d-234d-4bfb-b0b4-6f40044ded22", "value": "24576:+GeFCw9qOfb2OwK//eu9BrV7qItaERqILw:Veml9U/VVmIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764921611, "uuid": "ad681909-1e54-48d2-b2a6-4cfccbc5fa6d", "value": 1767424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764921611, "uuid": "6e99f21b-c5e2-4b6f-9e2a-77250c4c41c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764921611, "uuid": "6ea0b3b8-852f-486b-bdf4-3fc44bd21820", "value": "z1PurchaseOrder_ET_251204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2de15b5-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958343, "uuid": "ac90f7c3-b693-4725-9888-844fbc58beb5", "comment": "Malware payload (Gafgyt)", "value": "d98ede0f1fcf9b41686f65de10dd3755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958343, "uuid": "94bb9f4a-c5f7-42d4-bdb3-926fb5bb51db", "comment": "Malware payload (Gafgyt)", "value": "930eaf8c3d280aff4fa8539f865b22587353a3113a50399d39f1bd5b34ed6714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958343, "uuid": "469ef9c2-123e-4e5b-bd7a-2bba24897945", "comment": "Malware payload (Gafgyt)", "value": "7404541e68259886386622c2e664c21707dd6f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958343, "uuid": "578e6874-5201-4cc8-be14-939c66b274e9", "comment": "Malware payload (Gafgyt)", "value": "2351c504fef7ce82a7f565572bde7a77b76a7532d259c77461baebf49ce58cc916149b5bc17308e7a8030251d52307ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958343, "uuid": "54db23d4-9f93-454a-ac1f-c62900c9b566", "value": "T170A31792F801EF76F40BE77604C74B207630BBA20A535622735B79A6AE762D43933F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958343, "uuid": "7733845e-8ae6-4f52-a2ae-1cb35ff850e3", "value": "3072:I/l2/g5q3DC3ZtTz+eURhWpyF4ioe/uo2mu2VMDrY8faJX:I/I/g5q3DC3ZtTz+e3yFAe92mu2VMDr+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958343, "uuid": "03387f03-e763-435c-955e-fa4b9856fb32", "value": 100089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958343, "uuid": "5ef4b426-7148-425d-83e0-6ba56d6a09bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958343, "uuid": "1e8f3633-fa6d-4daa-8fdf-9aaca85e07bf", "value": "Fantazy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1389b0aa-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958398, "uuid": "ab35e9d6-0995-42de-be2d-bcbc3a0ad963", "comment": "Malware payload (Mirai)", "value": "7bd754d05b77551de183d90334bcf046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958398, "uuid": "556a27ee-6609-4b64-8420-920bf04aa13a", "comment": "Malware payload (Mirai)", "value": "94d082135d8f33b9775b2a47e0970794d0f81908a998ab54e7eef9ca184d79cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958398, "uuid": "162e075e-0d2c-427d-b7e5-87c29f96d690", "comment": "Malware payload (Mirai)", "value": "9fd839858bd339c54cdce6f3dfd68e575d4cece4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958398, "uuid": "e43677cc-5303-49a3-aca3-6763b4a9a961", "comment": "Malware payload (Mirai)", "value": "56ec99f6c331178399c667547676a0b78922f972faaa9ee009bf52bebe6c48a710598dbf0533b023e79271190c73fbb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958398, "uuid": "0d49e81b-4a91-418c-9735-5df59f8af7ff", "value": "T15A435DD4E643D4F5DC4B19B1203AF7375E31F5F82228EA93D3A4AA32B853741A546ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958398, "uuid": "50868292-c376-4be1-941f-1a427d0890ec", "value": "1536:uITW3WsRUK1ZgQohZVdASpY62QaF5TTSlay:uIK3lRUK1ZgH/VdAS+6PuTUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958398, "uuid": "88a13316-5ed2-4930-adac-996537fbf550", "value": 55440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958398, "uuid": "3abc9ce6-3669-4030-b34d-2866b9b768bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958398, "uuid": "60c02e75-58a4-4cc1-81f5-336e80305ab3", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92576447-d1e5-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1764944438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944438, "uuid": "e06e89a0-ffcd-4a1a-8f38-03898f9df15c", "comment": "Malware payload (DarkCloud)", "value": "5fb9d80be429b594e18846bc1a33002e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944438, "uuid": "d8fa4e03-822a-4f04-a026-b66d7d34cda5", "comment": "Malware payload (DarkCloud)", "value": "952cae4b179b75345d4647b208bdd7b1f1dd2e083ff4a7145bd3137637add67f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944438, "uuid": "53ee0d16-34a1-47d3-afc5-4f435b6074c6", "comment": "Malware payload (DarkCloud)", "value": "47c32589b1a6ce7ad0207276e96f5fc8b311c338", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944438, "uuid": "a1dcaf35-ea51-4655-bfb6-d71275836c16", "comment": "Malware payload (DarkCloud)", "value": "c82436ead898b93a5b502488c7f84a2db76351f7a22464206938b52910794b91080c28544da42f5e8468176dde389ae6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944438, "uuid": "d7b10422-197a-4640-86da-6d3b1984fba0", "value": "T1B006143D59BA113BD1B9C3699BC4892BF840C63B31157D79AAC347A9430AAC375D223F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944438, "uuid": "48b48967-4954-4ae4-a843-d1fab39ce94f", "value": "a07725d85caebe5599796b8ad5a18cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944438, "uuid": "61539637-00fa-4c4c-89b7-cea9b2d1b075", "value": "98304:z0Wzlqz1zTTmPbNkPixsqJRhPY4vvB1bIJeVhdHwqw5SvN3N8yYeEL/IKeVrSL0I:z0Wzlqz1zTTmPbNkPixsqJRhPY4vvB1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944438, "uuid": "34170eda-ed9e-4975-9c0c-47dfb37b6a27", "value": 3682379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944438, "uuid": "14fa8841-49fa-4945-8b08-6807b32ddba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944438, "uuid": "4529571b-305f-49d8-a12b-2beaf4c35cda", "value": "Cuenta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cfd448-d1a8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764918293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918293, "uuid": "8899738a-ac06-4dc0-b4ae-40fa178112a3", "comment": "Malware payload (Mirai)", "value": "416ad1e056b814c5bfeed6498d0a3d7c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918293, "uuid": "6b1e6c14-ccac-4f16-82c5-9673cdd34cdd", "comment": "Malware payload (Mirai)", "value": "952e09daa592826facca236924666041d39b329dd577a1d405ff96bba54dcca7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918293, "uuid": "5222700b-cbb8-4f6d-83d7-d3ecec4db90c", "comment": "Malware payload (Mirai)", "value": "2b05beb54b27f2f73287f350f681bf372b395432", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918293, "uuid": "5565a3d3-8525-4e54-afde-6baac40609b2", "comment": "Malware payload (Mirai)", "value": "8ec9924a86501fc6d851c93197a26d315397ded8f3de757765a99dbd1ab73f4cee6df5f01c2cd720621c8c0dc095ce5e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918293, "uuid": "0d2dda2a-4637-4a8d-b7da-d06b4a639b7d", "value": "T1F411825E78659465ADA8CA1438B6E510F5349F8038F43B3C51CECBB5C0D98183A12EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918293, "uuid": "134f2c9d-a578-4320-8355-fa856a6b34e7", "value": "12:78ZNyUKhEZGyUKhEZ3yUKhEZpjyUKhEZXW/yUKhEZByUKhEZ7/yUKhEZ7+yUKhE6:eEhSnhS6hSpOhSthSghS7ChSLhSW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918293, "uuid": "98c746b0-00bd-4643-b135-e2e8dae33111", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918293, "uuid": "2384a38b-1858-4373-bbfb-e60278a240d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918293, "uuid": "4583f70e-2209-4a43-8a1b-f3ad35502c87", "value": "router.draytek-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b42aeb-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908849, "uuid": "4ab58ca9-c041-40ee-8fd5-b6f2d566796b", "comment": "Malware payload (Mirai)", "value": "9a919f2525320636dcdb81789e160a93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908849, "uuid": "7e8723c2-064e-4a2a-976f-a23928b1fffc", "comment": "Malware payload (Mirai)", "value": "953e969effeab2af8f823656b55add66504520e173867abb9526d409bf0b0185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908849, "uuid": "0a226a96-ef18-476d-a77e-f2af6735e4f3", "comment": "Malware payload (Mirai)", "value": "6aac4e9995f89f7389189acb5264f1181faf474e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908849, "uuid": "b0f6bda5-4c8b-4f12-ad81-f1561acc0a24", "comment": "Malware payload (Mirai)", "value": "0d617d1350ed5b00ac036ace26c45d48c3e891f0ffd3a9fc656005a7ed10b579483c08f42e6bef20cd5a0efe8ba3746b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908849, "uuid": "0cd58ac2-57e5-44d7-8df6-4c8d087879d2", "value": "T17B2319C4E443DAF9EC4605742032FB279BB7F6FB2228DE43D7A555236C51702A805AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908849, "uuid": "36b8348a-c9a0-4f99-b906-10548a6217f7", "value": "1536:YtTeY1ouu8z7YRBRk2zBhNFxG3avTw1q7WM:Y0Y1ouu8z7YRnkGRFc38TwMiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908849, "uuid": "34b52c08-036f-4ea6-b8cf-da2ec347dd71", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908849, "uuid": "f2d3316b-86ba-489b-8de6-d1359d643e76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908849, "uuid": "bcc8f7d7-32b7-4430-8bfc-ac1f6ae5a242", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c2b06e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958967, "uuid": "3fb8275d-386a-4f44-b647-6f5b5b82605d", "comment": "Malware payload", "value": "7eec4d44c5c4a31a954ff2a314952566", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958967, "uuid": "1f42a81a-c87f-4232-a06f-a519af6c0f26", "comment": "Malware payload", "value": "957fe4541be2a5be01bb7d7ed0fd9a83689f3933efb1e2cbe89a59dbb81a7d74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958967, "uuid": "bcb5866d-f4b5-4493-b52e-f74584791512", "comment": "Malware payload", "value": "4472fcfa81a1f984071818fa3afe6a7053c2df6d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958967, "uuid": "27658956-9481-4e10-9400-50d6ac170d70", "comment": "Malware payload", "value": "a54ae4ee61a0f122b9d9ca8a91b0c23e7b0ef941c6cb9927191cc7c0d1ba31b687835c568255a8640438de416f921f35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958967, "uuid": "1217eb10-f4fc-4314-abe8-61319bb79db3", "value": "T11CF0E02ED10E8BBF581665453E593DFCA21E41585D8B0F4099790D097488DB860C1076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958967, "uuid": "32638a78-3b4f-4535-a3cc-c40d9f7a669a", "value": "12:/5949dJ37aV/BhBUFKoIOqZWgZesFrFBEGgbu+yfuT+JF8EquhHdiA:ha9X7eeIO1WrTBEGjTuyLqg9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958967, "uuid": "85446b03-6f8e-44e3-b041-2d2476bf8d3c", "value": 499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958967, "uuid": "d6348eef-6221-4435-b971-be7060af0b89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958967, "uuid": "cb7ad5bd-2bd2-4436-8b34-0e7e0075ce2e", "value": "rob", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ced8c7-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958907, "uuid": "ac9344bb-10a3-4cde-bf1a-9790ad035726", "comment": "Malware payload (Mirai)", "value": "e768704b7f31397f265ef5ae8a1ff6cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958907, "uuid": "77436307-7542-4f57-a174-660ed88f2541", "comment": "Malware payload (Mirai)", "value": "959b7dc35d1a13cc2fa6bb76f35ec3aad09225df99b474fcf50f9663aa35711a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958907, "uuid": "e062c43f-6690-41b6-aade-0f12b75d0064", "comment": "Malware payload (Mirai)", "value": "219af35b5623ef6b4a6e3828109da6a38fb35dae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958907, "uuid": "4bc2df62-5ad1-4c74-adc4-02e055361092", "comment": "Malware payload (Mirai)", "value": "39c5844f21060f0d94ee2c94f8693cb018b5532b8a9563d2eac28772cc234c318bb9c657db7d3f20c02a1b3a7dbe04ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958907, "uuid": "4a9013af-7c5e-46b0-965b-965fd4fe7aab", "value": "T1F0330841B8819A17C5E423BBFA6E428D332663B8E1EF7217DD226F11778982F0D77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958907, "uuid": "fd714783-2f60-4851-913a-82460c821cb4", "value": "768:kLUcjgvALqHqLXj5xnkzrEvi3cUddz1wir8c3KMDPf1N0zJMTX6PPu:gj8AJxn43MUdPNp3iBnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958907, "uuid": "b5b2692c-b92a-4c1b-bf27-d8eb485bd2c0", "value": 50516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958907, "uuid": "10cc548c-bb72-4839-979a-95ff873d6407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958907, "uuid": "29a4911d-705d-44e9-a904-861a5e13065d", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b98423-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909201, "uuid": "8a92982b-4186-4903-8ae8-a0553d70686a", "comment": "Malware payload (Mirai)", "value": "5434476ab693af226e300ec1f15dd498", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909201, "uuid": "e43a58f0-4177-4484-a5d5-2bea5e18915c", "comment": "Malware payload (Mirai)", "value": "95b770ac94c945f1e442209fa34e7dd7449469150aace82003e4c76bdccdd4a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909201, "uuid": "2cba4b9b-b480-4e66-9826-a358ce78a536", "comment": "Malware payload (Mirai)", "value": "1b20ee69a40c29fefdd86fbf9223023de2027c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909201, "uuid": "0c580833-dd44-4630-b3e5-215e842dd5a7", "comment": "Malware payload (Mirai)", "value": "0529ed648c1311737c92a97ba36d587cf21e687969763e957189fd1b6867afbf8819156b7a2663beae7db450bf1a9dc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909201, "uuid": "61d54a49-153b-403b-b0be-9dda14683127", "value": "T1E9835C55BC919A12CAC152BBFF1F428C372613E9D2DA3203FD155B6D3B8B96A0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909201, "uuid": "dc585db9-0d5b-4987-9e86-6f557fa800b5", "value": "1536:jghr81ArjYvohsPERLSie0GCOEvnDCajuvEEqGvRk0EmS1c:BADsMRGie0/CajxWRlE7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909201, "uuid": "0a1ca639-d475-4a10-a815-ab596fc3c38d", "value": 83392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909201, "uuid": "3d6fa2e8-db55-4008-9e9b-b07b4ff2045e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909201, "uuid": "454bb507-2da9-48fb-88a1-6b49d11455b4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290c1cda-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958434, "uuid": "16664246-c653-4347-8cd5-74f4abf4b685", "comment": "Malware payload (Mirai)", "value": "228e84df691d35c63b5953b43d8e37a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958434, "uuid": "e41a6c6a-c80c-4f6c-8cfa-a60a9fdb5df1", "comment": "Malware payload (Mirai)", "value": "95d9062cb24c84dd10bd70c563b14830b58d55a2508a553bb9d41b0cfd0720fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958434, "uuid": "02483856-24d3-4bcf-b83e-96589fa53c68", "comment": "Malware payload (Mirai)", "value": "609e839c6a62cdd49b3d0e0d4d6f16b2b5bc6666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958434, "uuid": "87c48371-c276-4baa-80ba-393a0e18f75d", "comment": "Malware payload (Mirai)", "value": "43e63bf3605d7c83fd99a5d0e2a465ef96f3a241bef1680b6ae86965ff9c8051f153754d85d170a61c01796f7ed7f279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958434, "uuid": "0229f738-98d7-4448-894d-92faff31fae6", "value": "T107333BC4D903ECF4EC1659782473F7369B75F8351029EA93D794DA7AF802641E10A3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958434, "uuid": "7145cadb-0bd8-415a-8a66-b921d67119ca", "value": "1536:psK6EgtnDReNG8nzaDQszvon2q89Veul59H2Nc7:pslttnDwNTzaDQVn2q6VeM9WO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958434, "uuid": "88ec08f8-55f3-4f19-bf36-ae59d8813824", "value": 55028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958434, "uuid": "8f956913-8b88-4b3d-8fe5-f0b52a435e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958434, "uuid": "50057e77-dd67-4841-8ef8-482fee9ffb78", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870dbd9a-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909200, "uuid": "2c1bb4af-cb76-4c92-a54a-de95b56463c2", "comment": "Malware payload (Mirai)", "value": "5aeb906a96a617bd3ff58505cd4c40e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909200, "uuid": "96bcb48f-0ad3-4075-8e6c-fb0b0831ac0d", "comment": "Malware payload (Mirai)", "value": "95fc6a06f974be25bcc7736e4d8ccd7f0321ae2efc265d2e4e3b2594649f6f96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909200, "uuid": "b0665a3e-845f-43a4-9a93-597b0602c0e8", "comment": "Malware payload (Mirai)", "value": "f820c284224885a152de1a3bfe1d5e57e5be3e16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909200, "uuid": "d25c6fcf-585f-4a80-9e34-4104649578a5", "comment": "Malware payload (Mirai)", "value": "1df6f7554248698313c10849fa986d0491258e64bdb43b1032a032c0baaa093be0e940efd8196764278e5e4b6dd79f35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909200, "uuid": "6b6d26cc-f7f8-4f32-a7b3-39ad6e483816", "value": "T12A837D01B70C0953D6631DB4293F13E1D39FDA9023F4D549391EA78E81B2E32A686EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909200, "uuid": "e043785f-00c5-4c89-bcbb-c3537587b899", "value": "1536:BN9FCK6M5Zu5grUD+TTiqSszG0I4TjAa8sc3O+ZnmmS9ex:BUMzlUKKJ0IE0AcdZnm7wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909200, "uuid": "2b1ffbff-81c4-42cd-9c2a-5abc44d76f48", "value": 83548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909200, "uuid": "6e8cfa47-2de3-439a-85e2-a9bea6e166b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909200, "uuid": "2628d606-9f4c-4a0a-87b7-aa0fb77c07e2", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6fd3bd-d19c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764912994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912994, "uuid": "24419ae5-394b-4195-9b44-aec83a23e0e2", "comment": "Malware payload (Mirai)", "value": "228a7546c492ca607daec09374d34f0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912994, "uuid": "6a54f9e0-5a95-4e87-963b-12e4eeafcd6c", "comment": "Malware payload (Mirai)", "value": "96774e5f70f4cb217d716c62ad8b52d1fa22b60bc4b1a8eb78f3e0bed654f2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912994, "uuid": "778f849c-97ac-477f-852f-afbbc1adf010", "comment": "Malware payload (Mirai)", "value": "1e301c357afacf7728664b9a6607fdfbd7a61ff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912994, "uuid": "66401c97-ba51-4a54-a612-990855b1332d", "comment": "Malware payload (Mirai)", "value": "8b0638180a0e1d5892bd7d4afe861810a87c8358e8ddffaec3ba5bcbe59b1f8c616f6035827b311dac302a7b6ee51f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912994, "uuid": "40296658-5923-4176-ab83-9a2fa3182a46", "value": "T1C1C2D060F1914D0AFBFADEF41DB9E7E37BB0192BA187CD9064C4B69267023660255DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912994, "uuid": "014514bc-4fce-4715-83cf-8940a8f0e975", "value": "768:SVdafO76jpmX1tJHYkYRCyQkiILKyS4uVcqgw09N:2am+SPekoCyQ/hF4u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764912994, "uuid": "c2df72b7-962c-47a9-82a6-a4c09d011fb8", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764912994, "uuid": "7c983165-a63c-4ace-95cf-bb15c19d89f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912994, "uuid": "f9d35eb8-ba75-4b4c-b5d3-8dbc9a23cc87", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76717d89-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958994, "uuid": "3aff550e-0c14-4114-b774-7cbd5eed83f5", "comment": "Malware payload (Mirai)", "value": "985462229ef1ca035317932980a2dc1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958994, "uuid": "a46c4b2f-73d0-47b1-aeef-d427ea04b1ca", "comment": "Malware payload (Mirai)", "value": "967f5e54719ef1d8e77341bc71366eb5c142246b6091f896120876d03f290c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958994, "uuid": "aeb5e9d9-b948-471b-8c4d-619f031b8ee5", "comment": "Malware payload (Mirai)", "value": "4c14ed0a6ef610f344cc1f5cd1e2d19c51084c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958994, "uuid": "c7ce8310-b19d-42c4-8222-6fc38f9f5aba", "comment": "Malware payload (Mirai)", "value": "110b142a0218518da7baa175f33ed1c32fe0ce4ed8458564a881b7c74d189ba957536b44c6b81dccb51d101a479b37dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958994, "uuid": "0e6c7e6a-59a4-42db-9dfd-900edffb37ee", "value": "T1B2134A21FE7A1C2BC0C5A5BAA1E34231B6FA470A65ACCB2D7D720E9CFF509443607675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958994, "uuid": "acbe1e47-4e52-43a1-b968-3044be467855", "value": "384:6XxCNZlQGAH/bcwVW5GJRmNIKk4BQEK53r6xl8ysDFcZvWIQIDUUvaFU+p6jY7NZ:IwNZepNVW5iRVKk4Be3rCZWO+wAZIeQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958994, "uuid": "3c571b5d-49f6-4e17-b7d2-ce8531ea56f3", "value": 44104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958994, "uuid": "c10e1531-b16c-479f-8eae-eb35c51cf073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958994, "uuid": "d8d4684c-8597-4697-bb14-555ff24a0989", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7636ace2-d1ab-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764919480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919480, "uuid": "932ff2ae-7b3b-4b63-86dd-5c09813c2756", "comment": "Malware payload", "value": "e9bd226256c46b99b00e76765ef3fdf2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919480, "uuid": "1e995516-f3fb-42d9-adc4-92953cb874e8", "comment": "Malware payload", "value": "96b35e7c2661e1bd3935fbcb0dc76fa6837f0f03c53262ebdded0f94bbb0d4a9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919480, "uuid": "7c22e899-aa54-4cd7-940e-22ebf33429f4", "comment": "Malware payload", "value": "99a525a325fe2973220e376a8366d26d64ee90d7", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764919480, "uuid": "abb69fed-c2df-44e4-855a-9895cb9e822d", "comment": "Malware payload", "value": "19632538901b2b55f29b979b77b32516a4f7b1c95645176042b8dac9303e90c63796fa6a8ac4680e0181e0f3b92f029a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919480, "uuid": "a4e87301-e929-4cf8-9bbe-c8d01d210ac3", "value": "T14D82D0A852ECF07A0A74409799C1741793040992ACB6EFF496E1A333E37E0DE55679A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919480, "uuid": "e64aed3a-09ed-4125-9cf6-c0b823ca4dc4", "value": "384:G0BkkalbMDzxoDVLIXBj9btG8GmA9HDx5cSC2GbZJkGiYpetG:G88QDzxoDJIXB5E8k9jwUG1OYpaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764919480, "uuid": "e229868d-3e12-49fc-b8f5-f8458fcb78b1", "value": 17971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764919480, "uuid": "12733e12-b4ee-414d-bd47-8f0d1dd01988", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764919480, "uuid": "a280b487-15ef-4958-95bf-4e4ee59a7140", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07533fd4-d1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764945063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945063, "uuid": "d40ebb40-4b19-4b06-9226-0ce436a1c9f7", "comment": "Malware payload (MaskGramStealer)", "value": "dacd09d9eab6845495213008041f3c21", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945063, "uuid": "5bc69950-87b3-4996-a762-0b1879a59e32", "comment": "Malware payload (MaskGramStealer)", "value": "976ad1637dceb8ee8940c40db3fee072d59301693df566f530561ad69ad3f2a9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945063, "uuid": "1f394e42-5797-4d29-940a-353ebf45c639", "comment": "Malware payload (MaskGramStealer)", "value": "4af78bce0234d7278236ac7028d89b2cfdad675b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945063, "uuid": "b1d4007c-df91-4c50-9d92-ce2515bf67c9", "comment": "Malware payload (MaskGramStealer)", "value": "454105c9ab950af75657f5bf50b4430ea8a0937683ef19f90335d406ae432825a918735b9a5e13989b05b32905f6cdc9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945063, "uuid": "533b133b-7cc2-4464-a2bc-496617d92d2b", "value": "T1A8C533E33BA896F6CF8EB177AA272DF2A973C8EFCC50890D154AC0787555314994E207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945063, "uuid": "c4939815-0f94-4269-a558-edf7d2fdfe87", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945063, "uuid": "12663238-e701-4593-9071-64cef3c9488a", "value": "49152:E8qtBr/F3BKE5ktLLppPsnADYPX69hRRQ3+plR8nyE8nF:XGr/1B/aLphsnqYPq9h0Olmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945063, "uuid": "69c80f71-2d23-45ad-afa2-e71f9a424e06", "value": 2503168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945063, "uuid": "bbdd6b6b-0e99-4663-b658-d3627059e965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945063, "uuid": "0ed4c647-1bea-45f6-aea4-f4556a0cad7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22215bb3-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958852, "uuid": "93f952fe-b4d0-40c0-b955-0c01f40e0468", "comment": "Malware payload (Mirai)", "value": "70db0911f5daf00710c445edee483ead", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958852, "uuid": "99cb5fd7-0b54-4694-8eff-446dbf6327ae", "comment": "Malware payload (Mirai)", "value": "9780b0be8bc73d3fabd695181250f74f02d78c50889a6a8211442226170e1da0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958852, "uuid": "c73d2c88-396a-4d5b-8a63-41b11ef4919e", "comment": "Malware payload (Mirai)", "value": "4b58a8b7ac645fcc94523e85856c457fc1af428c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958852, "uuid": "7071599b-9ceb-426c-a322-e2b249375b18", "comment": "Malware payload (Mirai)", "value": "9032c4ca475f4b96ff8e78556309c8a76f6931a97d43e981b7afd2940203d3531a7bdd1c85b9953d39fae2f876b6a751", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958852, "uuid": "070d0545-2313-490c-a8b3-2827f7084a90", "value": "T14C0180FD06397B05C1246A6772354435B03387AA75B78784EF84653A73D13603122F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958852, "uuid": "6603fda3-4d48-41ef-ac06-12bfeac9df7c", "value": "12:AhdMXhaRXhJ4Xh+6UXhlOBBXhnuXhO2GXhwDLXh54XhcDRZ:6ORqRaReRlYBRuRGRgRWRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958852, "uuid": "9048be2a-e642-4ba1-b6f4-591b8534fc32", "value": 780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958852, "uuid": "e668117a-0ed8-43f2-8b72-c21d2c9076ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958852, "uuid": "867bd4b6-8a31-44bd-bbc0-121456cc18da", "value": "irz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27472ff1-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764958861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958861, "uuid": "8f616935-8e2f-43cb-a17b-35f4605c675f", "comment": "Malware payload (NetSupport)", "value": "20ef853d40fba0e107cafaf8a3fab293", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958861, "uuid": "6be10117-b8d1-4983-acf3-f77d9a0ee904", "comment": "Malware payload (NetSupport)", "value": "9979394f034e0ea78efe1561be0280be89a0d731d0d03ecc0b8bbcb4d4680250", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958861, "uuid": "204a61d2-27f1-4992-98a4-51a230be387a", "comment": "Malware payload (NetSupport)", "value": "e82edc3f136aaf6db8b989a2db48664f5b3a5657", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958861, "uuid": "e443a461-7b16-40f0-9c22-49f0617e46f6", "comment": "Malware payload (NetSupport)", "value": "4db3431c2323c92d977ba30068a22a2e6707fcd6b929b9da2a7e9bea70bd9e41b943da63f93b8e930827fafd4661e18a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958861, "uuid": "a4f8254e-b27e-430d-b9da-c031b09e15fd", "value": "T1E602DF593E8025530B4717D7EF2BB8C4FA18D89A3AE40787E450BD94BA55F70D3D2A38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958861, "uuid": "f0efa0b4-624c-42bf-a0df-79b917b1cd34", "value": "192:REgbUMg45k/9G3AyDI4E1vHO6FIdHFy+TtFHu74SffWemob5VJY+5YEXrtg9JouH:RNbUMg45k/9G3AyDI11vHO6FIdHFy+TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958861, "uuid": "c631de44-f5ca-45dc-b745-33f681aaf368", "value": 8510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958861, "uuid": "da6573d3-a6f4-4121-a8ba-fbd35eebf364", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958861, "uuid": "46665691-ad00-402f-8213-d05899e567cd", "value": "tww.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f915dd2e-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958354, "uuid": "def5c402-2f83-4281-94fb-c39e2e35902e", "comment": "Malware payload (Gafgyt)", "value": "885ae6cca1ea5b3227e2da2525513882", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958354, "uuid": "57e1a6bd-2cc0-4d6b-b907-17e25dd93381", "comment": "Malware payload (Gafgyt)", "value": "99b9002c9a534afd7631071f7d4e69f0aacc1844fff27d885d2477b262773b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958354, "uuid": "258f0206-1569-4844-8e08-be150458205e", "comment": "Malware payload (Gafgyt)", "value": "b5fbf1d9b90646316f2e0f32341117289b7302ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958354, "uuid": "3f1eeb7c-2591-4ab5-9d9c-a46a8337ea56", "comment": "Malware payload (Gafgyt)", "value": "414d41c9ce79acc02138e28b9524ac0f7a84193eef110b353396ed2e08768851136e059bdee982588c0f6d2c575d5341", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958354, "uuid": "e5c8b843-50c6-4748-90c2-7f9ac2ec608a", "value": "T17AC3A52E7E22AFBEE168823107F75F7087A521D637A19342F26CD6581E7128D1C8F754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958354, "uuid": "1aa731cb-316b-4981-94cc-7acea2ed1008", "value": "1536:HbDwVYuaKurNAV2rKQ7j+4GeGISeG+GX8J2rKQnGx7M/wa5zIXp3xJJoPxeKPb3q:QRGUwaMNoPhPb3SrmthjF71Dq1MdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958354, "uuid": "75fe3018-bac2-42fe-8abb-a15c0e70ee89", "value": 126307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958354, "uuid": "39576f7a-52b2-4cd1-bb06-8ff0096fad30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958354, "uuid": "071e64d4-e7b9-4cd7-b0ab-46de5c4d8ca2", "value": "Fantazy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e5f6a7-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958401, "uuid": "7d5ea212-ddb3-4519-acb1-a3c5ebbb774f", "comment": "Malware payload (Mirai)", "value": "0bdb961a1a310c0bfda23e459ea0c129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958401, "uuid": "5488c338-48cf-4809-988b-e7cc8f7429ad", "comment": "Malware payload (Mirai)", "value": "99c3d8b734c5129cfcff095de1e7926617a740a651c4b558c5155e1ae1e62d4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958401, "uuid": "7333edd2-888e-4162-b29a-133500a91979", "comment": "Malware payload (Mirai)", "value": "78f5e5a25d478b9acf1071f2cf5f326f0ecba610", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958401, "uuid": "e19a9bb7-5679-4671-b885-bb8e12bbbb0c", "comment": "Malware payload (Mirai)", "value": "bd8996fa0f4e94731f16265842a1e13f04eb61f9a959a6e5ca041264ac3386f886e522ed131230387df9b4c681a793f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958401, "uuid": "0efae5f9-7f62-41a1-973a-2cf77530f95e", "value": "T12B330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958401, "uuid": "8b88c619-4c15-4679-8468-fc7a2a95754e", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGm:r/hqaJMcjeqK806MHdMfQXoHuCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958401, "uuid": "bc188728-d5a8-4bc4-aa7a-1c0945801b84", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958401, "uuid": "5a028021-53bf-46fc-b65e-c7ae1b68d0c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958401, "uuid": "16f85949-4855-46c0-acfc-222d5111e4be", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a850ca0-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933660, "uuid": "9b4cf4ef-2e0d-4789-bbc9-9529f7203609", "comment": "Malware payload", "value": "3e4e6091833b5b343142199f591d9fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933660, "uuid": "f4704344-10fb-4435-a8b7-f4e07d6fee2c", "comment": "Malware payload", "value": "99f37be737f2a1d0cfe958cc65fde94c310689d59304845c6e9a882bb75c08a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933660, "uuid": "abb798e9-1538-4f42-9e87-9bd9855b8cf1", "comment": "Malware payload", "value": "c8da3112aec96c69874b08a34e9adb7245babde3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933660, "uuid": "3e632ebc-c61d-4dd8-8f2b-e9d24defd4c6", "comment": "Malware payload", "value": "a2b1ca2f50944af38d598c757a6171f091fe5fb6d40e6b26f66726a81011b4e5b7b82c2fe73ca23ad10408418bdb0d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933660, "uuid": "8c8020a6-8234-4250-af38-4452f77be50a", "value": "T1F546222273CD9374CB769033BF6A67456EBB3C250634F95B2F881D79BA50171222C6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933660, "uuid": "fcc1cc75-6291-4c49-be99-5bb4c3c4c3ed", "value": "649f6ed9a4d576c154bbc0357156a4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933660, "uuid": "3c3e6e5c-e3d4-40ba-b529-4e7f47394c33", "value": "98304:f8sjkLiaEUfyTaD4Wu+29lZMea7B0zmFldv+QHI4/Lulf2UU:RjzaEUfX45+eR8HZl3LUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933660, "uuid": "7d39c434-3c90-41fc-8acd-79a09423db78", "value": 5523456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933660, "uuid": "5650b6af-8e68-4237-af93-9a093aa71702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933660, "uuid": "0f2d1274-db26-442c-95a6-64c88768e241", "value": "HEU_KMS_Activator_v19.6.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918bac47-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959039, "uuid": "8bc40158-487f-41c4-a9ce-ccad2fd6007c", "comment": "Malware payload", "value": "872c1b5e838210e1d7a6e17563685fb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959039, "uuid": "c1288200-33d1-410d-9175-e91628189c54", "comment": "Malware payload", "value": "9afa4fa00a8a0f170e7203cfe60cead85094a2af23f983d46780639d943a2b1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959039, "uuid": "7790081b-27b6-4eb9-b13c-58406daa7017", "comment": "Malware payload", "value": "5ee18504a3a5bac276d634b77da3e7d9c80015dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959039, "uuid": "400bf8ec-7fad-4287-bf5c-4315284a932a", "comment": "Malware payload", "value": "f9725a5b7bf1d3468436403c69727b85dfcc1158131476cd1af35e2702bd53b8897d47be5bcf06ac0c48826dadd82e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959039, "uuid": "082d35b7-3a36-45ee-896a-1c0f1377dcd2", "value": "T1E733E646F991DB15C5D151BAFE1E514D331317ACE3EEB3139E242F246B8B46B0E3A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959039, "uuid": "4ec5bd50-a6cc-4033-bff9-789c3110b153", "value": "1536:bhnRaob/AqLqsf1gaEGotdJB3039MritKUJgneotu:XaoLAqO/GotiKUJgneotu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959039, "uuid": "fe0d2fee-00be-415c-97b6-91b6fc27b127", "value": 50344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959039, "uuid": "ecd8606b-7054-4f19-975b-ed44b44970f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959039, "uuid": "d2f83ae5-f2c7-42ee-8f90-18cacb8e20c1", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d8b50b-d1d5-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1764937511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937511, "uuid": "4bd60ac8-ffcf-4f3a-9702-39af8de0fcdd", "comment": "Malware payload (Gh0stRAT)", "value": "2a1694b5d99af10787759bebd77c9400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937511, "uuid": "92b4b945-ef00-4053-ba5f-ad060fa4cc6d", "comment": "Malware payload (Gh0stRAT)", "value": "9afd664778c88d394558a7f42227e868830d0ab5f4fd53746e8a2370ad69b07d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937511, "uuid": "d6bb7a0c-e938-4702-9a70-2ecb258a712d", "comment": "Malware payload (Gh0stRAT)", "value": "2f0885043a0a1f9dfdbc311061147c56cbb1a5e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937511, "uuid": "8556f6a6-fc87-4d59-8c31-37cbfca752fe", "comment": "Malware payload (Gh0stRAT)", "value": "670786a291fac0fd2550c38e4d8c2210233239df8687be5cfde0d43c824396342911a077e84451358feef8811d9dd0ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937511, "uuid": "fd54232c-45f3-4b63-a3d8-446f0d9a2621", "value": "T1700502C9ED382273D27311706817A0DCEEB50DE21E79C9BA53FA43C67A711B5617E282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937511, "uuid": "566f1b73-1735-4175-8ddd-a0ea704efb01", "value": "fc4bdde5d34dff025d3c07f139a4507a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937511, "uuid": "7ed7cd60-309b-44eb-ab77-fc9ae674914b", "value": "24576:Da5gMg2W8egBWpJYAfzFz2KF3shprn3dBfrN5/GHj6:U9gL83BUJrfJqE3shln3XzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764937511, "uuid": "9fddf019-c7ee-4b7b-806c-f6b90a1deef1", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764937511, "uuid": "35fd2e0a-eccb-4a72-a509-bff403c7cbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937511, "uuid": "1f00d18c-3aee-44fe-a23f-b626e8878870", "value": "2A1694B5D99AF10787759BEBD77C9400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f1be3e-d1a3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764915959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915959, "uuid": "c46c9fc9-e6a9-4796-8035-361ae854abb2", "comment": "Malware payload (Mirai)", "value": "7c2501935c396f5cac8b5062236878bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915959, "uuid": "9043d765-1761-492d-9586-c72db0c97c92", "comment": "Malware payload (Mirai)", "value": "9b067d610707cb2265b1735a292b4bbc471218e91a2c13762801a6b468203bc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915959, "uuid": "8c8f90d5-f0ce-4d84-9268-4f72bab29207", "comment": "Malware payload (Mirai)", "value": "246847e04cbd7d68b1cb32606db2dad005ad0130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915959, "uuid": "707804fd-f8d9-461e-b181-76f179ca03b0", "comment": "Malware payload (Mirai)", "value": "6c03105b9921a60497fad705227dd099b4a98bd6c82db8bd1b0bb1742cb4ad7eb5e7ffca4bbd0513b3c2296e4b8f5c47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915959, "uuid": "d43ac7c4-96e7-4b19-ba2b-47293cf457d2", "value": "T18CD2E10E36AC61578FADCB795EEEF0E6B025E07243A50316B944DC426DBF360DB4894C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915959, "uuid": "08fd84b9-d698-4a91-9ac1-5d9104f79ca6", "value": "768:NixIqH/L+fBHXr+MQcxHY4CsxZLjryK/U:zAzGXriAf9zfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915959, "uuid": "562b6667-f3bc-48de-a51c-b9c2f3dfbe0d", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915959, "uuid": "04162d24-817a-4dcb-88b6-bda15642723a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915959, "uuid": "245868f3-40d5-4dd0-a31b-adb3233adc1a", "value": "sora.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13aecb34-d1a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764918455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918455, "uuid": "e87c0c2f-6cce-41b2-b7f4-3cf69f85464b", "comment": "Malware payload", "value": "f30a849f5880243c48d13c76cfb6f227", "object_relation": "md5", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918455, "uuid": "162141cd-56b1-4b5f-be27-b5f5b4b0bcf7", "comment": "Malware payload", "value": "9b0afe79696ccb263b8a00c75c021d115f152283714c0e4c5075aad4e52b94f9", "object_relation": "sha256", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918455, "uuid": "7a19c047-aaa6-4cbd-ac96-a0bb9c292375", "comment": "Malware payload", "value": "65fec70eaca638cbd10a6774e4e67f2d55f63959", "object_relation": "sha1", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918455, "uuid": "395a5fdf-991a-4098-b00e-39d2d77262b8", "comment": "Malware payload", "value": "f91e84d1e97b20de9f2532765c2e5dbebf3fda11e14125dcabae9ed7072592fc6ef82f5abdbb0e25633a63039c4efaaa", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918455, "uuid": "3545b39d-9126-4003-889a-faa8388e7504", "value": "T1BB214517220664FD8178D57191871397F69380DB5102FFE8718701D413276EED2DBBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918455, "uuid": "33316958-bae1-4c30-aebf-0baba3445e7a", "value": "24:wqF70mCfmgong0aB3jlZPq6tmJmX78VSqjLZ9WivoV0IzIO:umCfmgongNTdkMSHWKS0IzIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918455, "uuid": "d3fdd093-c09c-4005-9e36-535f7851b955", "value": 1327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918455, "uuid": "8cb779f6-7e91-4e52-b9e0-c62b75779774", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918455, "uuid": "0913594a-b830-4db8-b25d-935303d34501", "value": "9b0afe79696ccb263b8a00c75c021d115f152283714c0e4c5075aad4e52b94f9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d553ecc-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898285, "uuid": "83529762-0fb6-485e-9e80-c21a785f53d2", "comment": "Malware payload (Mirai)", "value": "b11597b4d36216a56b07d98454ea9765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898285, "uuid": "62df65cb-44b6-40d4-9ba0-c56876e6dadf", "comment": "Malware payload (Mirai)", "value": "9bd52d6509ab0325316d765d98c29e872461a48999d80a2b2369595ff651fc2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898285, "uuid": "1a0637e4-8231-4c77-a367-b3de23f902ff", "comment": "Malware payload (Mirai)", "value": "b5dcd5b763c27cf29336b3362d68fa43f3d7eb3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898285, "uuid": "96ec6acf-a6a6-4a1b-818c-76430ad8352b", "comment": "Malware payload (Mirai)", "value": "108c65de596011ce3f69fb173aadce2e67f98d36a2f3dfd9f57e083896174fa224fee03fd441373d2b3076e51f1d373a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898285, "uuid": "ab9d1fb5-711f-48a3-8fa0-b206daa82a3c", "value": "T132A33A362E752E1BC1C0A57B11F30760F2F1479E26A8CA1E7EB20E4EEF2465061576F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898285, "uuid": "98b587db-310b-47e7-b48e-cfa30ca65421", "value": "1536:MnpJV3a0ERsujU5wJNE6jDjZrSVUUkBXERYM5WtZshH5:WpravD/ZOkVERY8T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898285, "uuid": "775c4d5a-c4e5-4dcd-a7ac-71452d80c275", "value": 99864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898285, "uuid": "010540c6-bbf2-4639-a3f5-acde631c0734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898285, "uuid": "c54fe9ca-442a-42a8-8ef2-e67c9361753f", "value": "UnHAnaAW.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8f10f9-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958923, "uuid": "d2914e63-0c2c-454f-9961-dc6b1e6bf41c", "comment": "Malware payload (Mirai)", "value": "688b3256bd9b3d9ddd005ab446d4cc15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958923, "uuid": "8508c4b2-20b5-4bcd-81a5-e1c8c85a9cbe", "comment": "Malware payload (Mirai)", "value": "9c0248c83e402c15e87aa17e496faa0471850dfd78db99769c4decfd2fb4b606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958923, "uuid": "d6c98d9d-a2a5-4b04-a419-b1841e5de25e", "comment": "Malware payload (Mirai)", "value": "662d2d83bef0ced95a15bd465497b917cd89efe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958923, "uuid": "b442113c-bf6a-445f-bddf-b0f40556c2fc", "comment": "Malware payload (Mirai)", "value": "6df75a2558f3ad683638c5c7c653f456dad0c82ee18348cc8b9135aaec42599da69acf83dc9fb01d12056d04cc7a8eed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958923, "uuid": "4f88ced6-5c72-4acd-a060-3ddca4ac4ff5", "value": "T1BE63E886B8918B25C5D412BEFA2E118D332317B8E3EFB213DD116F14778A86B0E77945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958923, "uuid": "de1c9b5a-6100-4138-bab3-d6d0b265bb03", "value": "1536:Dtnwt9GRYmMA4urXZeCGnnx6qoBUUMwx5QCUqwPJ3W6M/ir5Jy5kxtue:WGymMQ7ZeCWnxvbwxaCK5Jy5kxtue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958923, "uuid": "d2008511-6496-4a32-9f38-7679c7406a8c", "value": 71148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958923, "uuid": "6e3e7ccf-9de9-4d96-8080-4fc4d72ffe1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958923, "uuid": "3a431f11-a395-40ae-85fb-c11205987beb", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9769ae11-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944017, "uuid": "38c4d676-9fd2-4e8f-9be0-bf87590b2353", "comment": "Malware payload (Mirai)", "value": "c69ac38b3db66a5bf665d4202b7089b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944017, "uuid": "4362c0a9-0c99-4d00-96a8-697b2800ab4e", "comment": "Malware payload (Mirai)", "value": "9c7918f983eba8034072a5efa31d29e883b79d074fb591d7b0b17abcbed286eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944017, "uuid": "48e96aa3-8425-4081-9819-223f21818d94", "comment": "Malware payload (Mirai)", "value": "0c64fade72b57d2db1c756735f134b8c9acbcc2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944017, "uuid": "54f0548a-4c31-4a34-b7f9-c7ec6b1de15f", "comment": "Malware payload (Mirai)", "value": "0b29632f4ee6d25bd90f3347183d151d0bc3c97bf13d88194e2a699859d9ad6abe030c978d6842d43933aa628c1baa9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944017, "uuid": "3f46f2ad-c012-425f-a099-08c700d88e46", "value": "T197E47D637B21DF61E395D27005F3C6915AE424A20AE280A6B37CC3187F61A6D2D5FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944017, "uuid": "36c90081-a949-4b2c-b21a-17a724a2c1c7", "value": "12288:CGWrJn5o5a1ml5fdos4YIGM4zojp4gpjyDeYz3Oy:9Wdi5fJ4YIGM4Ujge8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944017, "uuid": "a5c1a27a-745d-40ee-9505-fa2a83105582", "value": 695852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944017, "uuid": "f1bf667a-0e64-4cbc-9572-ee0dbed06fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944017, "uuid": "a5aca9c5-4837-4b7b-b486-0bb49bdf698a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9986965-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958677, "uuid": "99a663be-91b1-49ab-988f-cbd0aba35f73", "comment": "Malware payload (Mirai)", "value": "a85e0d6a6e02568ddc8570eb043210cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958677, "uuid": "789eaab8-e55e-4225-a4ec-f1da0ccb6cd6", "comment": "Malware payload (Mirai)", "value": "9d83f1eb9746e6c6a129c2b4fbc6f6186f1cd2aef7caaedd887710c7f3557397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958677, "uuid": "15a028fe-01db-47ce-9d35-63db273db93a", "comment": "Malware payload (Mirai)", "value": "ec24f2feab39f2c8141f818f98dd418c61f213b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958677, "uuid": "11cad830-0872-4fbf-be25-027f12ecb1fc", "comment": "Malware payload (Mirai)", "value": "c9cdf8d7b80bbc3f53f3c140ed9bb8fdceb48746d80e4d8975a2aa3001ec63c7edf8b78d41bfa7fe77218620361dd510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958677, "uuid": "f12b12bd-d57f-4597-839a-1508467191c1", "value": "T1B3C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958677, "uuid": "87a388aa-7294-426d-84a4-551863e7c68b", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHowrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIwrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958677, "uuid": "95503c3d-6c17-4f44-b8a8-ec3f56cab357", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958677, "uuid": "3e4b8c62-177f-4e6e-92c4-4a7e2ed73e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958677, "uuid": "b0c8bcd6-3ab7-4932-a661-c1fdc1f7227e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bfd0f2-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959503, "uuid": "a3ad70e1-bc12-43f5-bbef-498a141c877f", "comment": "Malware payload (Mirai)", "value": "df0e5537d74ed0a0d3c91a12b4349657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959503, "uuid": "bfc90368-1425-42f5-b7c2-30bb907beb65", "comment": "Malware payload (Mirai)", "value": "9e198bcec03c47c87962ad00d66661aa1e75768621579ccc8643d1fa538b4971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959503, "uuid": "e2bd9604-1784-452e-b9ba-ad0b120911e3", "comment": "Malware payload (Mirai)", "value": "741c9ca0dfc603072290cea20f38c8595c71e0fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959503, "uuid": "24386535-9c11-4a63-a347-d49a0d6551a2", "comment": "Malware payload (Mirai)", "value": "bf5afe4af17e3d8479367d427ba0b6325a6f4884f5ab96c6f7b0255671821bd84e3843cdb1e6726ca0d82f7e53dd37c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959503, "uuid": "fb2a004a-d316-4bef-8460-d4d61136798e", "value": "T123B318076FB01EFBD88FCE3711DA4711149CEA1B27A66B36B538ED58BA0764E05D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959503, "uuid": "8f8cca2d-03df-40bd-9542-6ae120b91d00", "value": "3072:ULwdwFotzXiNda1RkCDddfKzAwfzxJkNd:UMmvNda83xJWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959503, "uuid": "e64bc805-b929-4ea7-a18a-fd0c8cd5efcd", "value": 114375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959503, "uuid": "92b7b605-eaec-4213-a8cc-abfa72d1d46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959503, "uuid": "8ed6434c-6c22-478b-91ab-6f5b1b023ba8", "value": "Omni.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679e9f84-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958969, "uuid": "0562ecb6-d987-437e-946a-295e7fc94dd3", "comment": "Malware payload", "value": "9f2d0d1097df145bb155e7cb6dd28482", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958969, "uuid": "6f50deb4-690c-4ab3-b934-0766dea30d6b", "comment": "Malware payload", "value": "9e3ae68d6e6192befbee8df98f5e85b746fdcaaf3fc26caa369cf4f49806039e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958969, "uuid": "c6c90dd0-2ff2-48a1-a1cd-dd5998f5e4b7", "comment": "Malware payload", "value": "a90dc9c57b10081f08efc55c0eaee8c2b26cd550", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958969, "uuid": "ee56f21d-3bec-4dd9-ac47-a352758e5c9a", "comment": "Malware payload", "value": "96d278f150c7b7678097b5258e61e4937e6bce64066b795254102e8fc8e5a5af6f86c2c334e9054cbe3c823a3a8946a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958969, "uuid": "46f3eb43-8c7b-4505-9034-366ac66444d5", "value": "T184E0A5B9406EEF07D20D0E4BB52A603BB13253DD411B8A42FED0903F664C5903172E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958969, "uuid": "36642824-84e3-41c6-851f-43350e93fd58", "value": "6:fp95/rHicQjXtxJBp95/laLU+7QtkJBp95/pFGNIvLK8QRYFIhJBp95/nfiD7Qvt:/hIp9hlaLBuu9hSNITd49hfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958969, "uuid": "0f875630-4bb0-41dd-a8df-e148edd31100", "value": 430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958969, "uuid": "718f75ab-deb9-45fd-a1a3-2b465ea91ab0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958969, "uuid": "d0e6272f-4852-4412-ba70-3c248c9783d7", "value": "li", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8a24ec-d187-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764903918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903918, "uuid": "e7427a9b-3598-41bd-a79c-c81017b106cf", "comment": "Malware payload (PureLogsStealer)", "value": "258f766db4b47d01afac1b936bc68491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903918, "uuid": "ed54981f-ad7f-4162-822b-e57505baf8f2", "comment": "Malware payload (PureLogsStealer)", "value": "9e4b906cc1513c2c1da331ea25881ead2ba68599a9429f5af619b97816eeebfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903918, "uuid": "58df496e-0618-44c2-b3a4-ab521b1e2398", "comment": "Malware payload (PureLogsStealer)", "value": "07c9165974f07448891a8e040e5b23088a1300a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764903918, "uuid": "eac0af2d-fd97-4db0-a6a4-1b4af295289a", "comment": "Malware payload (PureLogsStealer)", "value": "ecabe1eba7c5f05cada71490b99abf7904656a880255f32c0060b77934b7527fb5a81b2e5eac11e44eda13dc0d2b4f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903918, "uuid": "470358bd-8df8-4965-9488-39117e61bbaf", "value": "T1EDD4CFC1FC93D029C4C118F6D89DD13E852AEE9893922D01B6C6BB1995F690DDDCC1FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903918, "uuid": "001939c7-fd08-44f6-a92d-38d8e8854b6b", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903918, "uuid": "f03bef4b-4f61-47c4-a8f1-4ca15cb97da7", "value": "12288:7L24bc/kcZzaYMif2tO1ECN6PF8ZQz0DnrYzP00ZA:7NI8+MzCNa8ZQoDnsz1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764903918, "uuid": "72fbf602-c7ce-4ffe-bcd3-a42a27342d8d", "value": 632297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764903918, "uuid": "7e0b317c-dca3-48ab-b609-56b16ef1ca21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764903918, "uuid": "d8363a28-9f23-4d49-b544-3ed54da24af8", "value": "MlREURSWIFT-302111-MA30019-2X9030-ED83901-UF7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4e77cc-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898282, "uuid": "d810818d-ff2a-45be-8ed9-c3bd86cb2e88", "comment": "Malware payload (Mirai)", "value": "e8e8742e868ceba2f47a7a489058c8cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898282, "uuid": "83a36afd-b5c8-45c9-ac2c-201d539349f6", "comment": "Malware payload (Mirai)", "value": "9f992a024298686dffcb58940732018260a893df13bf9328f0fa7c8399ac9d6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898282, "uuid": "662d73e1-b442-447b-96ef-6fc31f1c22ba", "comment": "Malware payload (Mirai)", "value": "35bf243bd01133fdee7d8c1aee5330705655e171", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898282, "uuid": "5442e209-5021-4c3a-b776-f7c8ad1719fb", "comment": "Malware payload (Mirai)", "value": "4a49237d4841f867352153c21a0b3aa7f1f6d3d0560bcd808a82c043df69d2d2f4df608d8ee921a22a66a9bcaccbd573", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898282, "uuid": "ec0607e1-4890-42cf-ac4f-2a7c21a0e615", "value": "T12341A1C81A7204366C55AA7736A548A036D5D0419CC7DEB4A0FDF4BF816FE882F41EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898282, "uuid": "032c8a09-fa02-40a2-99c0-2714cf56347f", "value": "48:v4Yy4PZ4sVI4ktKVss41MYL46QdJ4zok49T4UTUTf4pZ6:v4Yy4PZ4EI4kAH413L46G4zF49T4UE4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898282, "uuid": "73c9f589-65d1-46fc-8858-7fc64ef36362", "value": 1980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898282, "uuid": "5e5100a1-8eb4-4358-9823-e8b11db39e0d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898282, "uuid": "98f8931e-7b94-4244-a9f2-f8760a9e8dad", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3282aa48-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958450, "uuid": "30fe26a4-ebd0-4fb6-b037-69a8b6812661", "comment": "Malware payload (Mirai)", "value": "c831988b2d1c0f56da5455117399b91a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958450, "uuid": "55fa1efc-80d0-4c7e-a7d4-5b36ec04a707", "comment": "Malware payload (Mirai)", "value": "a0b2f39cda749ce793a071e1fc9fd5ee63aae6818150972d99a557effec3293c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958450, "uuid": "c387230c-2c98-4a70-811a-f505158371df", "comment": "Malware payload (Mirai)", "value": "1406aae225769ff5f5b31a863c20bbd5f0737493", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958450, "uuid": "7c31e42d-6eaa-4d04-aa29-798f4e34f562", "comment": "Malware payload (Mirai)", "value": "cf2bea533a381ccfec41d047d8adbe1c6780264925af9c025383787e7902abb26196a593d6e824dc40b540c30747f5c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958450, "uuid": "ed036b70-8bd0-4c62-a783-6268ecd1e079", "value": "T14C3121E008D6177ECD8099177756503D603A2EC66E3B9ED8E8DB7CE5B344AE2B221D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958450, "uuid": "33a6ccb6-68b2-45bd-ac33-c9157ec5d100", "value": "24:ffEBvw01DbeBFBv60hOq4TtqBvTm30TlM1BvG0ySBlcIv7EByTvNAUs8l1OrQtqY:Xovw0AB7v60hicvu0yLvG01lcJ0KUsFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958450, "uuid": "89f8bd0d-cb78-4a91-94fb-e92fc15642dd", "value": 1465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958450, "uuid": "5fe20dc5-b946-4c9b-b52f-3ee108448654", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958450, "uuid": "d87abfb8-a08d-4e64-9b0d-c8f03744559a", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deb9f0b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958899, "uuid": "be07b854-ec45-4918-832c-fbc7480e8d06", "comment": "Malware payload (Mirai)", "value": "58fd76f3e976efdcdb986ed8e1298dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958899, "uuid": "44b6115f-cee9-4f85-87a5-b344fc0fe741", "comment": "Malware payload (Mirai)", "value": "a0ef71db443af4c87c9db1511fceeb37ed9793709d104ca5ae238bc58ebf0a18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958899, "uuid": "5b2f4b84-d468-46e6-b418-7c579e86476d", "comment": "Malware payload (Mirai)", "value": "4ab32b7ff96a89e6efaed0c4c5c32b199d862d4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958899, "uuid": "39f9c1fd-26c8-4c69-956f-7687a98c7617", "comment": "Malware payload (Mirai)", "value": "b04d80959b464281e4973256a69abd21abb5c392d396e19962fd36e969398f48d86e3addfc49a765d2018eacce0905a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958899, "uuid": "bd07b4a9-77b7-438b-bf5d-94235ee11fb9", "value": "T11D53F886B8818B25C5D412BEFA2E118D332727B8E3DF7212DD115F25778A96F0E77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958899, "uuid": "e3cac19c-6753-4c36-80df-14f110d9f3f6", "value": "1536:uJnu2IgOlSSu53KuqKusJE25ogbkjMTi14D4DMNiu:djlsysJE264DyMNiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958899, "uuid": "5a4067e9-fdd4-4dad-bdb6-db6f29f08521", "value": 64836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958899, "uuid": "d1e6a579-b516-44f9-9a04-5da38b3e0b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958899, "uuid": "fe2fc398-9564-42c1-bd61-18b0c2784c43", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d571d2e7-d21e-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1764969032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969032, "uuid": "a9fa68e5-c842-4130-8d9f-144005205766", "comment": "Malware payload (FleetDeck)", "value": "736598e517ebc7915752efa552e5805b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969032, "uuid": "6d7f676c-420c-4f2e-a2f5-e644b457b9de", "comment": "Malware payload (FleetDeck)", "value": "a12a8dc5fa6562ff4d64e031b57d735d970980060f0d9cb4f0caa526b3cd5caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969032, "uuid": "14a36577-c944-4454-8ae3-b17a32d35eda", "comment": "Malware payload (FleetDeck)", "value": "b9ac65394366f4b0714feaef613d517596ddd0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764969032, "uuid": "9432af03-6f0a-4b57-9597-1fc8e938faf6", "comment": "Malware payload (FleetDeck)", "value": "c27224a25b6bf8eacb65fe21fb4c32cc06acb6e36c186d1b092bee22b0f2deaab11c84726b508804e9dc2837d0cbb324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969032, "uuid": "6bfd7da2-906f-4489-84a0-fc298caeeec8", "value": "T15716CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969032, "uuid": "33aaaab3-8c19-4cfd-9b7a-6ad0949d1ccc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969032, "uuid": "2448dc33-0100-4398-a5dd-ddbfd4c8f35b", "value": "49152:zP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snUD:zPtZAl3XzKnaIcDgRjOlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764969032, "uuid": "6fbb2438-932e-418c-9752-f5eff2adc882", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764969032, "uuid": "f9530f51-ff0f-4c5a-a14f-3e9bbd68666f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764969032, "uuid": "0a44f9b8-c188-46e5-8588-44f123437696", "value": "Project_Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4a7b4a-d1db-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764939945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939945, "uuid": "6b06fd0d-73d0-48c9-a702-c27d96756465", "comment": "Malware payload (Vidar)", "value": "678df33cf57edf6ede153966e43131ad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939945, "uuid": "13519039-e1ee-4283-b645-1ecf2e9352eb", "comment": "Malware payload (Vidar)", "value": "a1855b1ff015d227dfae1a8776ccd5b3afcd46fe2335ed010150082c97ce4f5f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939945, "uuid": "799fe018-7c41-4cf5-b7dc-afa46a35ccc3", "comment": "Malware payload (Vidar)", "value": "23570a4faa17af379f45fc244c8aa1cd005e25d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764939945, "uuid": "323f6ef6-10f5-437f-9cce-db7205fcbb3a", "comment": "Malware payload (Vidar)", "value": "705e5506e367563dd9b74ae10d83960ba356863737879359a6c87251093c92a0d2e13dcef1f10b190fb76624911b62fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939945, "uuid": "e643723c-bb9e-4705-a115-81a913720a31", "value": "T15CA60892F9454577C5ABF23493616270F6307C3D43312AE76FD926A60C3AAC01F3EA99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939945, "uuid": "630dd131-fa41-4069-8a17-5dbf6aae2e52", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939945, "uuid": "0b0127b0-ec51-4498-845e-f42e67dda1fc", "value": "49152:NtGV3sIJWEmc7/bSVRrq6YMB+m7G6Qvweq+a4azof9Jv2AjYmwJZefOyNSz1jeZv:6V3KRSzSVpq6Y45ewT+avzofscX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764939945, "uuid": "8d06c73b-a2c0-46f0-9ddb-3718c5d9a551", "value": 9992832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764939945, "uuid": "edd15d0c-40cd-483b-b37a-fffa8fe8aac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764939945, "uuid": "72e6fedc-9f65-4af1-8613-54a10159b66b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bae58b-d1a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917039, "uuid": "379fd8f2-fc48-4443-98ad-6b2945f7c7a9", "comment": "Malware payload", "value": "bbd0c55ec36a93f352ff092040713b42", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917039, "uuid": "50fd604b-1585-409e-b51b-a192ec4f2252", "comment": "Malware payload", "value": "a21847e72cefadb005323ad17061e1789bf564abf56717666913bb53e9028210", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917039, "uuid": "a58b455c-d269-4c69-8721-7be837166550", "comment": "Malware payload", "value": "c8a9275d1de3c1bd93bfd878b48ba2e40aac853c", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917039, "uuid": "d92fb2f3-56f0-44ae-8794-7e1c9e582ab9", "comment": "Malware payload", "value": "23906a37b6d531f143d813f8f3ed45a9ffb49301cc3efd4f7437b45d6931ec6c639d949911b7a78871415120efb14ada", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917039, "uuid": "54007e50-8a6f-4697-a91f-1b1cb3df8326", "value": "T133418E25CF29F8C0072E7050876D2E9121436562CBB54764E9A259873F69F87EF0B74C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917039, "uuid": "8f8962b6-4216-4eab-87d9-c5a26471f39f", "value": "48:Uw5AKt7JJsKJn5IPp8GTLeeZ087qvHFI5xiwFq+Nq+rq+23J893Ud:p5AKq45W86aeZUC5RFqYq2qcJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917039, "uuid": "b94e777f-adb0-4ee1-ac90-9361f40fa79a", "value": 2384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917039, "uuid": "f11e8da0-682d-4b37-b21c-d9fc60437869", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917039, "uuid": "4ef7644d-29d9-4c1a-a155-fd7abc0e647f", "value": "install.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f536c7c-d209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959921, "uuid": "471f7be5-2734-4278-be01-cd6062a3a121", "comment": "Malware payload (Mirai)", "value": "0f4cf386a2254456bed2189c63296a61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959921, "uuid": "adf1bac5-cbf8-41d4-bdaf-a98a7d09ce31", "comment": "Malware payload (Mirai)", "value": "a22a62164daac36f7881fe749606c861976219c7d80232464841e80b469c3bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959921, "uuid": "5b7f1eb9-adb5-432a-a0aa-4394fc47e8f4", "comment": "Malware payload (Mirai)", "value": "3da4968cea5bd0f8ab00c5b7fe279962de76ce09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959921, "uuid": "0e7947bd-cc91-47d9-b837-78c6140f6609", "comment": "Malware payload (Mirai)", "value": "6bf86b1629a76adcd950e7c066fe50c81f56b57c07645db2a0ed1605eca60f1e6a263bcef812775899e7bb02b0e0b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959921, "uuid": "20cba135-956d-4e21-a3d1-6f0c4f9487c9", "value": "T16D2422E9BA36C5BFF9F2657996D9284303A00F0435B230098592BE5127E7BE53DE7348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959921, "uuid": "1a155d5d-970a-492f-837e-8ce4ab53d0b5", "value": "6144:Djq5goyHlbE0UVVlfdoBvETmXrqn+3usc5Th/UX:Hq5gTTSzeBMhn+escFh/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959921, "uuid": "84ca9844-29a6-44d0-8c42-257745de613e", "value": 224132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959921, "uuid": "b3b04a0b-8f32-41ea-b014-a51be8cb1a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959921, "uuid": "6d1503ae-8203-4652-9d7b-b5818f96fb2e", "value": "SecuriteInfo.com.ELF.Agent-BQZ.12576689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca9d4ce-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917960, "uuid": "453139f6-9506-409b-a66c-dcb8b8113745", "comment": "Malware payload", "value": "d3e259a8caa7e23e89453a387caa3a15", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917960, "uuid": "0d9fc16d-4ad2-4986-b8a9-8cf962f8580e", "comment": "Malware payload", "value": "a2f8c96429914ff66662b432f9213a795856751290b5a510605212d5e6ee7638", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917960, "uuid": "7b949771-f0ee-4aba-bf40-d07ea923a910", "comment": "Malware payload", "value": "2b09241ca025bdc4455e9f6ba6009e2f27c08edf", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917960, "uuid": "d044a71e-3827-44d8-bdd8-0d3760a4b7f2", "comment": "Malware payload", "value": "41a34c070426a75db3600557aaa957db686329c4ef74a7056bc861d56b722eba43175d2b8909f376e49d467a542f5d26", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917960, "uuid": "97a525c1-0e2b-4707-ba2f-48bf1b29a641", "value": "T136163A07EC9145E5C0AFD23589669252BE71BC485B3023D72F90F7382F76BD0AABA354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917960, "uuid": "70702f47-c762-4f52-b793-badf7c1179c2", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917960, "uuid": "84eceb5f-e3d3-4b3a-852c-8b9e4f001248", "value": "49152:bjp0psoGPl0tL1Kf7QplJG6EZnkc56FjS5E7JlqDlYc23e:Xc8fbxE7y5Yre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917960, "uuid": "74196956-4fbc-4c5c-9ec7-b3c3f4fcc701", "value": 4272800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917960, "uuid": "75bdc36f-c9be-463c-a1c3-84b2f9f8f40c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917960, "uuid": "08d34c93-beab-4d3f-9850-71bf3cf72fa8", "value": "a2f8c96429914ff66662b432f9213a795856751290b5a510605212d5e6ee7638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c9ff0e-d1bb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926245, "uuid": "1e4103af-b655-41ec-a684-c2ab7f2a7591", "comment": "Malware payload", "value": "29dee8b421fab8eb1e67c7451aa227f8", "object_relation": "md5", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926245, "uuid": "6141699d-5dab-4f14-8d50-766a78a0a56a", "comment": "Malware payload", "value": "a32fa6ba08db96ebd611f6ee06da44b419d569a6bac43ed00c68d6ca674004c3", "object_relation": "sha256", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926245, "uuid": "a92ca5f2-3e3d-4ccd-9747-ce8f364cdd39", "comment": "Malware payload", "value": "ebcfc4f6c6e63b75dc407f5e76c9d96c69c3c1b6", "object_relation": "sha1", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926245, "uuid": "3fe21593-4d8c-4195-8034-d479f113de95", "comment": "Malware payload", "value": "978818948d593ba5c9cf0fd86801a5ec0327aaa2785fd54d88e3354f80237cc9961033c2fc87a665495e0e7da8edff0d", "object_relation": "sha3-384", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT-zgRAT", "colour": "#62B778", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926245, "uuid": "3712c7da-9f6a-425d-a00d-68d6baebb217", "value": "T109C4231CEB5AFA31CAD013396ECB62464BB0CF06970EE715B92F4B466C85377C80587A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926245, "uuid": "323b53a1-8d82-43bd-a1d7-935058cc1943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926245, "uuid": "df8630cf-d9fa-4f37-a53e-df940ab070e2", "value": "12288:QfJGQWWD61dDjePxLJj36EXTYsG8iHGgKSVMc:QBXWK61dDCxtjrksGzZKSVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926245, "uuid": "0b00c6b7-c2e2-42a5-8b34-15e3bd8730d2", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926245, "uuid": "df001671-6665-4063-b992-43f8e555519a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926245, "uuid": "0f80d2e4-a755-43ba-bf72-a1180fcf0bdd", "value": "Zmvaqpgm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccc781f-d1fe-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764955273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955273, "uuid": "486bf1e5-138c-4407-b5a0-61a74ca25833", "comment": "Malware payload (CoinMiner)", "value": "11a6b87800e6480e1029c8cbc77111d7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955273, "uuid": "1b597dbc-0485-412e-b6ef-1aa086375827", "comment": "Malware payload (CoinMiner)", "value": "a4aeb85ce09118a3c9af5307116c4fe95e94333bfbf6d268abbdb19bdfd043ba", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955273, "uuid": "572b5a77-6b23-49aa-b8f6-41512035ff31", "comment": "Malware payload (CoinMiner)", "value": "6451382450f6588251a9c30f3d0060d5fcd0a567", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955273, "uuid": "d509eecf-ea69-40fb-8ed2-ee39d3597025", "comment": "Malware payload (CoinMiner)", "value": "c997ff88775a68043cf0bc2f91b2d571828e6a6db64ccead77bba3953ad7208643c59732f0b403ef8fc8186f0957eb9a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955273, "uuid": "530ffe20-6bf4-4d59-a461-a9bd9898cfbc", "value": "T1424633456AE00AD2F8FB813CDCA3941AEF76BC2207A6D6DF47A0D2651F236E54C36750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955273, "uuid": "79f9191b-a7fa-4a67-b105-b75e474af9cb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955273, "uuid": "42609684-aef1-4fd7-82af-aa55034a0dea", "value": "98304:m86wZ5im32uW5MI0mTO7/Xuy/+7F+7cETnKMeBkADCjvZ:mrwZ5fGL2VmTc/f/+ScEbKBBhDCjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955273, "uuid": "28fe507a-8f33-44f2-ae44-32c5db94335e", "value": 5677675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955273, "uuid": "cca0317c-cbc1-4411-af98-bf6d09e67a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955273, "uuid": "242aa210-8bf9-4dc5-bea3-8570a0da61be", "value": "Capcut PC Preiumum Setup x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d331a2-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933673, "uuid": "8c966692-0b57-4a03-939c-4d1b8a7098d9", "comment": "Malware payload", "value": "21a9d0e535714a5300785a02f8ca826d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933673, "uuid": "b9332235-d7fd-4711-a7b3-bf145e7385d6", "comment": "Malware payload", "value": "a50aad2bfdfc5f6e090d9c1a35715ffbde76e034bae3128f2a9627b1a07cb9e2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933673, "uuid": "039f9dc7-f455-41e3-af95-ad8e6b82986d", "comment": "Malware payload", "value": "8ce5b5464ef172f00302f98bb7bf328be1fac9d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933673, "uuid": "68ad3291-ab6c-41c2-b6c1-39eff66944ed", "comment": "Malware payload", "value": "68cdd092e05cfdc9f976c3cb4b3e38b32f785fb2e98d53407fa701d04106e9acc8c79518c4fe625952e435dbb9ebff42", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933673, "uuid": "9b8489dc-cd33-47ef-9573-65f267369770", "value": "T1E046F1C6F7D8A92FC8775072C9BE52B151874C028A839F836D18760C69BB5D42F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933673, "uuid": "f2ef7561-315f-4a80-9b7b-3ba938d9ec57", "value": "98304:qPcZoTwrYJKjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClte:qvKMfyaIbaciAFvrEZpXqmY9XrF/mpCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933673, "uuid": "0981a7a6-7386-4615-b8d5-f4bbf871a059", "value": 5876994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933673, "uuid": "ef81673b-20d6-405b-8ee6-52fdf46f4385", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933673, "uuid": "e86c645c-c82a-45dd-82b4-3f3bc8a9ecea", "value": "Skybet138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b100d68-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959001, "uuid": "8aa40989-a3b2-48d7-855e-a9695d7037e5", "comment": "Malware payload (Mirai)", "value": "00430b2955ec0e3c94f9704e8e18845f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959001, "uuid": "c5b190ac-6961-4019-b338-4c7183deb406", "comment": "Malware payload (Mirai)", "value": "a548d6f66bb11a4f3ad517a5dec59996ed36d3ff836d5a1128e42f7a997bf81a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959001, "uuid": "c859ce1b-1d63-4e58-89e6-add66f285cfd", "comment": "Malware payload (Mirai)", "value": "8c3bc397d723537b3962a309298556b5e979cec9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959001, "uuid": "4f9b2d19-6206-4d1e-9c67-b233ab4f6b81", "comment": "Malware payload (Mirai)", "value": "2f27496796bb6f6e00ee42159c149f7b84dd318d6e8da1a0d4f714d7a1abd61ea157d092fe8acfa0a14c2fb129a5c410", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959001, "uuid": "6e96a498-9a6f-4747-a554-592e427182c0", "value": "T169C080BD002B5281C000BE113096341DF133CBCB21724F0995C83033F48C910F212D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959001, "uuid": "5fbddf99-ce22-44eb-9439-becc997b96d2", "value": "3:LxAjtyg/w8NBzSa+ANja0lvJRDxAjtyg/pONBzSa5Ap9C3oITI0n:LA5/wkPjnJRDA5/My03Vdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959001, "uuid": "303d19d1-7bfd-44fc-b395-e45e1cc5ddc0", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959001, "uuid": "c93dd0a0-1e58-42e2-b121-801c4fd3b4f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959001, "uuid": "d29c5713-b169-4700-881f-ac46a06f4179", "value": "kws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de354dac-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951866, "uuid": "7722b324-0311-470f-98d9-b5e942c52ea9", "comment": "Malware payload (Mirai)", "value": "232054c2aa65492b01056171015dda9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951866, "uuid": "64a605e4-7f36-4bb2-befe-0b2e42acc917", "comment": "Malware payload (Mirai)", "value": "a5865e4c0baa36ffe2698be4d23de1faee10d1d2e2532bc0096a407b982d7719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951866, "uuid": "f26681ee-da74-480a-bb4c-3a758ceb1187", "comment": "Malware payload (Mirai)", "value": "7ea3db093e0340e1078503c74fd9916f9e4a6e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951866, "uuid": "ac928fe8-34b6-4547-bd8f-525c11a6977a", "comment": "Malware payload (Mirai)", "value": "119981b5d68d74c70cdec95fa441cad4120d706e64208815d77951eeb22ac76a9e3399dd70ea6c9ea3391e3c5ecd1a76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951866, "uuid": "f90e1951-3185-4733-9a8a-a85a955b46df", "value": "T13DF48D2BB2B3B1BCD01BC03047DBCAB25531F47526212E7B26C4DA353E66DA1176EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951866, "uuid": "c9565b3a-0760-4fe3-9a4c-469c60ad3405", "value": "12288:QtNv5np+dHdFjZpPVHiGP3zNg8lkHddhHYngEYx269ChQevayUQqHX:UNv5np+d9FVpPVF/zNg8ShYIChQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951866, "uuid": "bdda8ee3-c823-4a58-9af7-b545088224cd", "value": 772400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951866, "uuid": "86d99874-9fdb-470b-b594-a2577f31a242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951866, "uuid": "cda8fc4e-7c06-4e91-b9a9-ba471cb02524", "value": "SecuriteInfo.com.Linux.Siggen.9999.17867.17793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a17218-d202-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764956954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956954, "uuid": "36cc3b3a-0432-41cc-a000-f0aaac6c70a7", "comment": "Malware payload (Mirai)", "value": "9bf8021bc56f424320a5b730b7459337", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956954, "uuid": "2b9d4553-be64-409e-8db2-67e350527aba", "comment": "Malware payload (Mirai)", "value": "a612e740de2697bea0938197a04a4d203bdb1c51d20a07b4485999022321cf91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956954, "uuid": "24c6fea7-ef12-4ec1-9992-c4e48fe4ee2a", "comment": "Malware payload (Mirai)", "value": "6502a7dc637caaef7efdbc4de301b688a37c4c65", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956954, "uuid": "628362df-f2e3-4736-be3e-7c8ce8ee1153", "comment": "Malware payload (Mirai)", "value": "60f8eae7265d911b2401c4198b222d3aeaf25a61ef899a9bab3cd6f926fa6e351d4ada3d1b4161c70daad98394802c73", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956954, "uuid": "a01f91cc-4048-460a-8b9e-1613021636dd", "value": "T11211606FAD645051DD00C904B816AA897A5DE34FC5D0B72E8CCE1B3181AAA18F506EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956954, "uuid": "3de2b8a9-2fcc-4310-bb1a-1c898de3ae0f", "value": "12:78ZUfPfEeEZ3fPfEeEZGfPfEeEZpCfPfEeEZXWOfPfEeEZ4fPfEeEZ7OfPfEeEZJ:eUsD3sDGsDpCsDZsD4sD7OsDTsDqsXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956954, "uuid": "c6cb033d-4f64-45a2-b3ac-5c84956d7ed3", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956954, "uuid": "56a913fe-78db-4f46-9ebc-83d681ecd475", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956954, "uuid": "2c345973-05f8-4e86-9c4c-4a7f89db836a", "value": "misc.ictbroadcast.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f1a733-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951800, "uuid": "8ff91b56-8364-4bf2-94db-3fba0b31ef0a", "comment": "Malware payload (Mirai)", "value": "f1b437b1a2b0eefebac1a25000954365", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951800, "uuid": "6dc243a4-7ac3-4504-bd58-fc148bfcc55c", "comment": "Malware payload (Mirai)", "value": "a61a2e970df1dd99f0c5561cf313f26787ec27da5ef9929469dab043de3c8b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951800, "uuid": "3efb8775-2698-4bd5-8826-4fbb6d64908c", "comment": "Malware payload (Mirai)", "value": "c6f7383460942d8963101549b353cb155278c885", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951800, "uuid": "baf059e0-4030-4461-823e-f2d5af2b37de", "comment": "Malware payload (Mirai)", "value": "ac39af824c9440a1a1cdba50d8f53d559b082953839a679cb10578c712d66cfd924b5ec00d74f2c08faf4de0e86b32c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951800, "uuid": "2954bfe3-b2e9-4ed6-b8b3-1c3d96a8a7cf", "value": "T1CF34220EE369FF61EE1C4D983D5477A93A6AB9BA264F098B15918E423FC43C4D700DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951800, "uuid": "9a8b7c38-1409-44c9-a4e5-9ee261793aed", "value": "6144:5bSYtxv9W2z8ldujOOc0hTliuogerCn2S:ND1W2kcHRolrCnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951800, "uuid": "bc669a7c-9512-44a1-9f90-7e932727c1be", "value": 246820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951800, "uuid": "ee40e68d-685d-493e-9bae-493aa8aa2901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951800, "uuid": "98d9c558-e4a4-4c6f-a0c7-0004eb38782c", "value": "SecuriteInfo.com.HEUR.Exploit.Linux.CVE-2017-17215.a.25533.29414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef00aba-d1f7-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764951975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951975, "uuid": "6270b515-6d42-40d5-b4db-6388f051ebdb", "comment": "Malware payload (PureLogsStealer)", "value": "b51bc005857ea07172afabc9be91baa0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951975, "uuid": "8be69320-49d6-4ab9-aeee-a3c99c94425f", "comment": "Malware payload (PureLogsStealer)", "value": "a6ad40feb8a882f25e8b95a1e8544bb6f58c0cb22044fd740f8cca8bd868f5a3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951975, "uuid": "e9ea4dd1-eafa-4d5b-a96a-6e5f7c482db1", "comment": "Malware payload (PureLogsStealer)", "value": "1e99c3264e9ded8df32c01291f1136389c0a7a80", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951975, "uuid": "bad1d6b1-250b-4d7b-86c4-ef1e64097826", "comment": "Malware payload (PureLogsStealer)", "value": "ff031d67f486e970a7282f9339af33a8d92a3a8749668aada2034f113cc5e30d244b13fe5b6230d03d537dabc4a396d0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951975, "uuid": "cc77b35f-b3bb-4567-b8a0-d7146dc72b37", "value": "T1522533EC2859F7A8CE4E9316D8077ADADA20D0E7308F8E0C4F4F734465F56AB105676A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951975, "uuid": "a9df7d1b-5a00-4f34-95c0-ec1aa2631405", "value": "24576:dGb0h8vLqjG7sF/M1Rb0zI9N7FsoaRgJHmWmJ5pbdnJrgHl9xK:dzG7sCD0k5daRTWmBbcpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951975, "uuid": "d54262a7-dfe6-4dae-9520-3b8967300e2c", "value": 1013160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951975, "uuid": "b651b30f-c614-4b5d-a874-3bb1822b1357", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951975, "uuid": "4b63e546-9dc0-4664-b915-bb72d4fe8ceb", "value": "Bill of Lading_ 514863409.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8470f90-d1f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764950622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950622, "uuid": "780a2b2b-5c2b-441c-b84f-8c20e54d2509", "comment": "Malware payload (Formbook)", "value": "facc0e36c7976248a6f2adeb883f2286", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950622, "uuid": "98c80a2d-85b2-4d9b-bfab-9d10b24107d5", "comment": "Malware payload (Formbook)", "value": "a6b7931467496b98c91d8c9979a3e5bcbfe89c43b75550078078ef5f8ca177aa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950622, "uuid": "99c7010b-305a-4a44-a620-30a43fbd1b0c", "comment": "Malware payload (Formbook)", "value": "3c14356b5d794479ecdc1143a89a8f603e8bfd3c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950622, "uuid": "0ac45c43-efe2-478f-8b60-64f90de64e3f", "comment": "Malware payload (Formbook)", "value": "8fa66ec5a86c35f827f0224f5cc10ef85bd2c96c09eb2c35b78a76c3c2546ff8c92cdd8cce920076218a0ac22cdfd1a5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950622, "uuid": "012a335e-6af6-4003-a80c-57017e55aeff", "value": "T12935339949C59F47C6F5423082E7AC090B8BC5ED55AD1F1B71CC02DA630BD4BAF82EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950622, "uuid": "c980c6fa-e8e8-424f-af84-cca9145b24e3", "value": "24576:EaVbzwdXEbwbwMP4kaScy2ITl8ACFLtg2H9m1BWMSZrxIuw:Esb5wbwkMITldgbm1BWMYrxIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764950622, "uuid": "30004fd8-cd4c-4329-a425-883b79b6e219", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764950622, "uuid": "20a6abfd-2e70-4dec-9e0f-6f5358173193", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950622, "uuid": "47f03a80-1e8d-4e68-bfca-0634220b4c2e", "value": "Ngswbllyyq.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0c432a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959080, "uuid": "f17c29b4-87f2-4394-aaa0-2d74116a4ab3", "comment": "Malware payload", "value": "c6f3d0f96674288885e8698a07c3355d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959080, "uuid": "c07b30ea-4343-4432-a8ab-dbf023165d46", "comment": "Malware payload", "value": "a72a78186f85e4eb9c8c5016250eaae5032cb46981f02025d7071f2ade7703fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959080, "uuid": "96e02600-3660-4d68-a00c-fa873a38bae4", "comment": "Malware payload", "value": "3930086f639b08de743d24192e3e199fe8923b9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959080, "uuid": "5c38bb74-94b2-49b5-a4df-977c70da26f1", "comment": "Malware payload", "value": "74a4b9689e08fe0902a3696a1b6a05b787d64fc51d1114cafbdcb1636d295032327be61ee21335c13b9c1c6ae2322de9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959080, "uuid": "a6094f33-30eb-4355-a93f-9a2b9a5a83e8", "value": "T1C3E065EEB03206AF05098E0EF126C88CB033D7DE4397DB946D8AE02D64659147133D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959080, "uuid": "3e7751a3-e25a-4c72-9e08-aea60caa9ce9", "value": "6:zFVmVMFt5/SpyLMFt5/BeUaYElMFt5/nNIl5DFzCMFt5/Va0LKijcjLX6:PthothBeUa+thnNIl5D7ths0LK3vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959080, "uuid": "9141c4b8-35d8-4241-836b-b0efc8d68492", "value": 406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959080, "uuid": "806b9e27-b99b-48a0-bf1e-79eb67714fc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959080, "uuid": "736c2e50-0cdb-4ebb-95de-a2a874d8250e", "value": "ipc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae5bb4-d1ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955763, "uuid": "03c012f1-72a4-4007-9145-6e2b1a6f0cf1", "comment": "Malware payload (Mirai)", "value": "749ded59e1c1e98298274938b7b8cb6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955763, "uuid": "a660da7e-ac55-468f-94ce-3dd36f7f1cb5", "comment": "Malware payload (Mirai)", "value": "a72b050b9a46ee3fa7e63715f73b8f7e32c6064bd731c0d816d2918279c30fe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955763, "uuid": "87b4e84c-debf-4d96-a812-1ba67294ce1d", "comment": "Malware payload (Mirai)", "value": "a4ee04cca79f1340aaffd4a7b2bba8238d8a516d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955763, "uuid": "d3ffe508-4665-40f5-b760-66b02a42567a", "comment": "Malware payload (Mirai)", "value": "c28c3b0f26bc25851e1624e415a9671fc1abe31ae26192c02a46ff7263eae11f6686b9760c8971249b08186e561faa81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955763, "uuid": "5778dcd1-c6f2-4736-bc76-2c70125c3ad0", "value": "T14D643A46EA418E23C4C517B6F6AF4246333397A4D3E7B2069A285FB43BC775E0E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955763, "uuid": "74a86227-cf5e-4f87-bc90-acb0ae934726", "value": "6144:U0Hg/DvEQw3E922G3BWxfrfaPMaBpXTYVabpiN0lWnng2ZZRM/RBm32eCgHmSm8:U0A/DvEf3C22GMxfrfakaBpXTMadiTn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955763, "uuid": "4f7c5523-5eee-4ea2-a3c9-f47cfd6bd834", "value": 332849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955763, "uuid": "7d1f2321-49c2-41f8-95e3-e639739e01ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955763, "uuid": "3b7d614b-5f08-4bb7-878c-69357b1be61f", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18009d6b-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917604, "uuid": "2a026dd6-3294-4044-9401-599ebb193376", "comment": "Malware payload", "value": "9fa34dcdec188138ded6a48877076405", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917604, "uuid": "2e4ff650-2be0-479f-8d02-8c4ccbebd254", "comment": "Malware payload", "value": "a736e27cebbfd324e1d9ef1b1e53310f660158fc3eeceff57624ee1f2f7b2271", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917604, "uuid": "4d6aa704-5be7-4bed-b403-7a7856376ade", "comment": "Malware payload", "value": "f2744d7c97e7c8920ee5a756ef5ff5d0eff547b3", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917604, "uuid": "abc32e52-68b7-46d3-9832-57b42c4dd9f7", "comment": "Malware payload", "value": "aff53376ee83c7e6405ca73488b7e125e5f359176b8a23a41d15c14116f38af8fab62e915e68d1c516d796759e94b32c", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917604, "uuid": "b1fce2c9-b2fb-4d62-ac90-a1335eeb7374", "value": "T167952366B6EA20D9E0B784748D9010C6F575B40107A5ABEB065D873FCF372E0AE3DB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917604, "uuid": "bebbb579-8cb0-4a6c-b78a-418c5adc6741", "value": "370ddf1e71e487cf30c7d40836d361ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917604, "uuid": "30bd03b2-6702-43fb-8e85-cab03026b5eb", "value": "49152:r02H8AYutkv6Aa1oqqONsru+a34kVk3tzAuGSuZZu:Y2H8Buq6AaKfhuTRVU8tSYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917604, "uuid": "347b43dc-9db7-4e01-91b1-401ffc94b39f", "value": 1956584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917604, "uuid": "109cd585-df66-4144-b4d1-fc05d64acf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917604, "uuid": "1f7abcd6-ecbc-4295-a5b8-8e764643d1f3", "value": "a736e27cebbfd324e1d9ef1b1e53310f660158fc3eeceff57624ee1f2f7b2271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923f65b5-d191-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908360, "uuid": "f28ffbe8-c7ec-4f76-b837-f9767c652663", "comment": "Malware payload (Mirai)", "value": "bdc60eebad1040d8e56e1912f654810e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908360, "uuid": "6cb1e89d-0af7-43f7-a50b-20db09961e0f", "comment": "Malware payload (Mirai)", "value": "a85f4c3353661fd723fc732d63940f4e150fecf29da64b9762cd68c7b6d5907d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908360, "uuid": "f97d651c-b0ed-4ced-8f84-c5b74a65f2d6", "comment": "Malware payload (Mirai)", "value": "6ac28d2988f9d9900954adb9d6a67941cd3d28f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908360, "uuid": "9f1decea-4244-45c3-9ac8-2d74bf0b3092", "comment": "Malware payload (Mirai)", "value": "ef8ba038db002609b9ef9f8a3e5518865be87b5027ded74bf064f2ae7d9a5416c3837366af579bc9a9e098417202e471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908360, "uuid": "8d4f0417-2085-41f7-beca-b5f807080972", "value": "T19C735D24A9792E26C0D4A17B61FB8361F2F6230E25B0D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908360, "uuid": "5c1ab8b9-d7d0-4175-8346-8285de30b527", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8W:YwfdNu4cmZvFqI3w7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908360, "uuid": "31a339f7-7a75-4a06-a284-3ecf0944dfe6", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908360, "uuid": "fccf9fc8-c7e6-4956-8c53-e5d70a2ac41c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908360, "uuid": "9034719a-dcc5-44a1-a00a-0786108ff83f", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a6546-d1bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926771, "uuid": "e70b1044-36af-4f56-8822-eba5cd1d486c", "comment": "Malware payload", "value": "f7e0478ea1034d9445dd3080d3fe1e6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926771, "uuid": "224de791-33fa-4f2a-ba50-816fb820ed6e", "comment": "Malware payload", "value": "a866d7f4fc7b3f86980a6ee698038b39e193c616059aabc937ff1a2ecd40c6e5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926771, "uuid": "e98ef1fa-0153-4fe7-9770-5bbb9650f6fb", "comment": "Malware payload", "value": "62c0527a63a5fac69fd0593b3197e6675d611d94", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926771, "uuid": "28092bbe-c5e6-4944-a110-8a2395da2541", "comment": "Malware payload", "value": "c51c87bea80eaee50ab69ad4cbea836a04fab336903dc2d6be00abd8ba77580fa02a896c34fb9e2208e9d9cf2a1403cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926771, "uuid": "f58137c8-b0f7-47c1-b1bf-f44b938b51d6", "value": "T1BEE02DA0D01FA041D80DE0B3C42B8A0F034164B4F930DB82B2898212300BB386F7B6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926771, "uuid": "d179aa02-32d7-483e-bc87-0099e178d700", "value": "6:5j2lJhxMcWVrg9RgEOQi1EYQLnq2c+HSTOnkFcxyCQttgoAhxr0J+l2n:5jCJnMnVr8gEwxQLq7+HSnWxyBHAnYJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926771, "uuid": "0a82571b-bfe4-44e5-a7f9-85670b4915b5", "value": 366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926771, "uuid": "5351394a-26dd-4e03-bbb3-715e5fca41ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926771, "uuid": "0030aabd-db3c-411e-ac43-0a327cb1c0c5", "value": "RE-09832983.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92815068-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944008, "uuid": "d158309b-601f-45ee-9580-63ca25481672", "comment": "Malware payload (Mirai)", "value": "7ef1cf516051c7c141e872d79b775601", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944008, "uuid": "e7ff3f4c-36df-4c8b-85ea-12763b389405", "comment": "Malware payload (Mirai)", "value": "a8a55f97f2ee04b0c7b7c29b7f08ba0860438b88c1507fa43128f0d866c80502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944008, "uuid": "1ddb6330-ca49-4ca7-9751-8be00d51f709", "comment": "Malware payload (Mirai)", "value": "45c300ead4ef621946d24011901b9e4da37c5be5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944008, "uuid": "3501f68e-c2cb-4152-a211-21157372c0f1", "comment": "Malware payload (Mirai)", "value": "59b41484d9bec29cdf78fb72b728fb53c77b67aec8f39e96ccdc60a9890ec74d96c325ae76abe3f1c3bd3894fe5305ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944008, "uuid": "3fcb0f4c-5ad7-4afd-8801-8fb36c451d12", "value": "T196B43956F8809FA1C6C12976F64D46AC33134779C3EBB20699245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944008, "uuid": "e08dfa45-be62-469a-be89-bc175b0641fa", "value": "6144:8rY4ClDrzIjx1r27XC9onNDHoi3J2NWp9IBJY8dRk3APfUUqv65SKNAWUHFgpjji:AcI92C9CFHoNj0ARg6UVdC+gpjjoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944008, "uuid": "c79f56f1-4146-4ac2-bea4-2337a7dee071", "value": 513388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944008, "uuid": "6bde1017-9fa7-45fc-84dd-59a17f01d9fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944008, "uuid": "c2ab00d7-fb6f-4072-ac3a-f575cce931f4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f437cb84-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958346, "uuid": "06a9b65b-1175-48b4-83e1-808f39e06cd9", "comment": "Malware payload (Gafgyt)", "value": "19604ab8f66a4633de6869b18a7f3d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958346, "uuid": "d4d5186d-953a-4888-9c9e-3b32478900a5", "comment": "Malware payload (Gafgyt)", "value": "a97eba9dfe33c276605bd32cb3b8e509a38ea85b44c1a72ac72a93ae3549e8a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958346, "uuid": "0b173962-7203-4101-8862-962bfb9bbd48", "comment": "Malware payload (Gafgyt)", "value": "2f489706f538008f08cc90a92beb3fab670c97e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958346, "uuid": "ae607cc6-1974-4cfb-9cfb-1c049765ba11", "comment": "Malware payload (Gafgyt)", "value": "786d4b237046b615a19016f3c3ccf3a33efda715cff0690b9fe719993ba350757c7b4680aaba1628beefa54d418c3027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958346, "uuid": "66b187da-8b63-4299-b93f-0bc9fade1c45", "value": "T1DFF33A09F6408B57C1D2277AEA8F424A33339B94A3D733155A38ABF43FC2B995D32915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958346, "uuid": "08666b11-feb6-4928-ab62-8a96b8aeb3dd", "value": "3072:Bi3eg/SaaOfhANbakAslBo9unH5EM/9xEZcmgwZBxPQgVa:xg/SatfmNbaEc9unHqM/92cmgwZBxIgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958346, "uuid": "e21a4566-fb9f-40f0-b9b7-eb5700c966d4", "value": 161376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958346, "uuid": "96e03440-9753-4d7d-a788-51d21a32709a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958346, "uuid": "26b9bd27-2569-4840-805f-9c73acf5adc9", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c40a259-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917342, "uuid": "9164de0e-ae77-4b53-94f4-4cbf28f7b351", "comment": "Malware payload", "value": "46e036b91e6673e3b46d43fb1e6d0104", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917342, "uuid": "3d502e17-24cb-4734-b3e9-d69e583aa271", "comment": "Malware payload", "value": "a9b5db00bc7f94c8f01fa7465585a1244c02085747bac9981be63e70ba8f46ed", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917342, "uuid": "a0fcabb8-fafe-415c-8408-a7dd053f39ab", "comment": "Malware payload", "value": "74d5b44f900988d2c3fc11938d2fa353be8afeed", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917342, "uuid": "ef579d32-c6b3-4992-a6ef-c5427b0c9bcc", "comment": "Malware payload", "value": "97697f18731bbffe25e0d5baed69e2fb95fd9f77bc6dd9b0e82966088e24890619a80d4d4ec8470917cc0e0a43e0470e", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "62-106-66-112", "colour": "#A52722", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917342, "uuid": "40079ad0-a3e9-44f8-ac68-74faad82c28c", "value": "T12D51E62E87BE85A9119081B7CD0EFA81C6650A6361A18C8036EDF1C1AF619C95C79AE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917342, "uuid": "354a217d-147c-4b0b-90df-8eba3bcac58b", "value": "48:sPkzH76i/revBTX+pKY/coPBE8gXFV3OzLKRs6DtehzQiEXdTam8FR3CzsbN:7ei/cxdYkUgV1OqRs6DWzQDL8FTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917342, "uuid": "972dbe1d-8a89-407f-a610-86b38718c502", "value": 2901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917342, "uuid": "c348299c-119f-4744-9431-b5b9cc2a3075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917342, "uuid": "0063cd32-77a1-4f14-b9f4-9de953c6d3ce", "value": "a9b5db00bc7f94c8f01fa7465585a1244c02085747bac9981be63e70ba8f46ed.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4deca5c3-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931008, "uuid": "11b541e5-478f-4302-84d7-b90325a5dddf", "comment": "Malware payload (Mirai)", "value": "e7b108176f1410e2c28a285de7744108", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931008, "uuid": "e41c21be-91e0-407d-8765-129a09f7f13b", "comment": "Malware payload (Mirai)", "value": "a9fa883c52802ae718b305b81b0a47153f57dd65ef7601a7a69b44e8d0385daf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931008, "uuid": "441cac1c-3fef-484e-8ee5-334d442c1747", "comment": "Malware payload (Mirai)", "value": "2092028b5a9cb12f381e75b9cac28fd2c6aa9553", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931008, "uuid": "4ecfc499-477c-4c19-92cc-a923ef1f45a9", "comment": "Malware payload (Mirai)", "value": "626ad10c8aaa3b8a6abecd1fceb4abe14ea3c9ff5448619f901050439f50ab91ed36adfedb0175ff04929598d3ad21ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931008, "uuid": "b15cf4a6-4187-46ce-9f04-25f26c1c0045", "value": "T15E634C49AEA91BEBC0AFCE30462E031615DD595F63E1B33A9378DC48359E34C96E3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931008, "uuid": "44aad467-7653-4575-896b-88e5571d7158", "value": "768:LBq+2NfVTooEVW2Hrc21pVZmJRTkgpHbkldezkIjSLSK5MmbUVbUh6JEL6Y:V8+WcIkgpHInYkIW9V+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931008, "uuid": "866e483c-3cd2-4d5a-a94d-5b2ede34ef35", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931008, "uuid": "f76260c4-12f0-4150-bbf9-2b82405fffbd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931008, "uuid": "d9fee918-50b4-4a9d-9c00-715e6a8a200d", "value": "VRmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51ac110-d19a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764912337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912337, "uuid": "cfc8e953-e1f8-4c24-ba22-54299e14f87c", "comment": "Malware payload (Mirai)", "value": "254cb92eadb7617e0a8674672bd6724f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912337, "uuid": "66337479-a0d7-4180-ad9a-b5451fba22a2", "comment": "Malware payload (Mirai)", "value": "aa1c35a77ff6dd1af57da0a8af9221f87dfc7537bbb47037a75afd1226f903cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912337, "uuid": "e1b0b4eb-4785-43fb-ad05-49999a35bb4a", "comment": "Malware payload (Mirai)", "value": "5f2a042edf67c121269cc142f7c596c301cd7c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764912337, "uuid": "95f6d566-da8b-4c3b-bf17-6a61589cc80f", "comment": "Malware payload (Mirai)", "value": "8828a97d87780c35ea8e4a41a714791224f195b54a34cf155b793f6be012b1acfe017d43b5bca559cf7e54d1ca31fdb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912337, "uuid": "118c715d-fd6b-4a48-8e67-9355126008dd", "value": "T1C0D2F19DEEC4A493C87E2D38E24C2BF18D58B4F976CF5D865350744CAE1826F96A051C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912337, "uuid": "03f952ad-672b-401a-a890-1e04b9343177", "value": "768:D1u8IVuBD9jr1zehhl+DaKUQsR4AXmHF+JbKWUq:Dtus1xeIdAXh+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764912337, "uuid": "76292b19-c50c-4970-881a-971730de1e97", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764912337, "uuid": "5e8a4444-7920-4a02-991a-2146302aaf76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764912337, "uuid": "74ad367f-5ab8-4ce5-8898-33458e965294", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e08188-d1a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764916664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916664, "uuid": "751c1575-99a0-462d-89c9-47bab0149662", "comment": "Malware payload (Vidar)", "value": "67feb6519eedeabb37c487263fb91360", "object_relation": "md5", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916664, "uuid": "00a0552e-113c-42a9-9bf3-3522d906a7f8", "comment": "Malware payload (Vidar)", "value": "aaa47d79ba3bd68f095c78b039828154c227f1fd62cec5ee6aab6138190b0f0c", "object_relation": "sha256", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916664, "uuid": "1eb62045-73cb-4839-a4f5-b4e14adf811c", "comment": "Malware payload (Vidar)", "value": "3206312885973d0c9aa247d79c2e4aefe249132f", "object_relation": "sha1", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916664, "uuid": "5ce84168-b69b-4280-8e2c-0be8a2ffd0a2", "comment": "Malware payload (Vidar)", "value": "ea3e93be315545a4feb9d28c4c79a19e2b32925b980cce409366e532ec16319fc122e9dad3cfc95c3557f0cb532d0e69", "object_relation": "sha3-384", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916664, "uuid": "3a092d57-687a-4385-b3b7-823ade087f7d", "value": "T155E4234ED6BB5D38EAE7E07BCDD062032370CF2BCA162F450965931B8CB75BC1488669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916664, "uuid": "e189817d-6f09-4eb4-bf6e-c002d809cacf", "value": "12288:aJPeyO7vtojVN/lLMJAApU83SpbBBusxjgevHnu37Ks7rI183tQuDu:asyO7wNLMtHuDustnshWuDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764916664, "uuid": "02c3ed7b-ce40-47ec-a81d-8e9b748ab3dd", "value": 702224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764916664, "uuid": "03fec694-9c71-43be-8137-5a165b896103", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916664, "uuid": "91073763-79da-4ac6-b1b2-0e59dc553a88", "value": "8f16e967c982cf29c695c6d5ff866a84024c18d10c89df3f6ad654ef9a91b434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786bda75-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943965, "uuid": "f3cf122f-f60f-4c43-9d3b-a1f8d704bb5a", "comment": "Malware payload (Mirai)", "value": "b091f55ca830297ba3f90e909f9df949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943965, "uuid": "51842d64-86f9-4407-8f28-b2d76b5118e4", "comment": "Malware payload (Mirai)", "value": "ab477db4fe96fdc52c6d97b5319db16a9aaceb63a316f5e87ad2777944de83ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943965, "uuid": "b3b4b67c-005a-4003-a26e-c6dd2f13b191", "comment": "Malware payload (Mirai)", "value": "28a398b47789d27f963ff101f69af2067073aec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943965, "uuid": "3717a158-f243-4ca9-ad00-447c9692c1e1", "comment": "Malware payload (Mirai)", "value": "7c64dc02b00596be50f2fc79453911bb8dae19424bdad48a089600ddc7ccdf60784dd5b67ee9c2878573082b1b456725", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943965, "uuid": "e9707f72-2762-45dc-8ac7-ce2302b98ce3", "value": "T1220413729D4D84CAD22006B1F69F3BE6C83AFBD4573A7CBF4450C2A4D18D488752D799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943965, "uuid": "38a1ba2a-766e-4b98-91a6-2189ea71080a", "value": "3072:kjfofNdaizYrgryXVFFZUSHiLZMVZPrlTLHS/yX96ZCtFzRc92gXzvMPD8e+fL:BNdafYkVZ7HRVZPrlTLHSSY9RzvMPD8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943965, "uuid": "00ab4385-e2dd-4f8f-93a4-617269b36389", "value": 185288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943965, "uuid": "749f5285-b36c-4f12-b9f1-3e669b8cc21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943965, "uuid": "1cf6ee85-44f5-4b7f-af8b-bcc39184b8d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebe76e2-d1d4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764937023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937023, "uuid": "d81aa1c4-4b8a-453f-b5fa-c3d0a045b0c7", "comment": "Malware payload (Mirai)", "value": "fa852377047c0932a7de234a7bb8f885", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937023, "uuid": "701638fc-050c-4157-ac60-25f33b3effa6", "comment": "Malware payload (Mirai)", "value": "acc65fecad85a76b3575ee569273febb69f3e4ecd4eb7cab1a0f33963b2348a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937023, "uuid": "3b9c9120-04ce-4f44-976c-e39a244f74c5", "comment": "Malware payload (Mirai)", "value": "51060a6e50f55d0d7429d292dd689caf4bd9acdb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764937023, "uuid": "42d1ce0d-5029-4363-a1d8-793d0c327b48", "comment": "Malware payload (Mirai)", "value": "cf292834fe32300cd53c2237fd98eb95668c316c9cb28107d5b226f942b0a437a8bb4c2e5d1c91eeb9cb34e9914080fd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937023, "uuid": "79b2c71a-6c23-44d1-91da-53301a79e307", "value": "T19D1136FE28C2EA66E6B4D647BC77FD89A10A828510C47F3441CD4B318497D083E21F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937023, "uuid": "4174853c-dc4a-482f-8cbd-0c60595d3d2b", "value": "24:eamnF2oFmnF2ogmnF2opsmnF2obmnF2oumnF2o7YmnF2oRmnF2okmnF2+E:exF2omF2o7F2opXF2owF2oFF2o7jF2o/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764937023, "uuid": "90342a2e-11dd-4e45-a0f7-1de388d4d544", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764937023, "uuid": "b351c754-11c8-4151-9997-5d950f040a6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764937023, "uuid": "35e8d608-92f5-4f25-a1f7-d2a4b9e42dca", "value": "router.tplink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc1899-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958905, "uuid": "ddfa3a7a-bede-4c7c-b366-1d6f60fba6cd", "comment": "Malware payload", "value": "9bc99c88706d55e52104a69cf734a7b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958905, "uuid": "83a9c5c9-b3f1-47fa-be4b-0f1725cedaf7", "comment": "Malware payload", "value": "ae85b811960a19345765af42019cc790c2acaa1a03bfcee09717f9f7c611796f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958905, "uuid": "a0014abc-a7d0-43fc-a1f9-45feb6e0f72e", "comment": "Malware payload", "value": "adccccf5419f91b4e3ecd338b4c1410c4dd18965", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958905, "uuid": "9e2bf421-c212-413e-a31c-63d65cc9224e", "comment": "Malware payload", "value": "e07e66cc139a24c4471f33be9ad0232437c7ee5f498d340a7988ab853b130948cc75200f50f19bb24fe6866859cd8186", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958905, "uuid": "fddb1f97-4048-4d4b-a711-204f74da0494", "value": "T1D61163BE024AA998C488D43B7292850DB0B64FDF54BB8B93DD55217D30F44DE7132E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958905, "uuid": "c2852a5e-b845-48c4-9565-8096d5d789d3", "value": "24:kFRSaFl5QSaFnSaFqSaFA+SaFeSaFtSaFASaFkSaFXSaFAeSf:kKafHacaBa2aBaaaDa3aYaif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958905, "uuid": "7e12e3ea-0c88-4d38-9c43-dcec8d10a4fa", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958905, "uuid": "9ed331f8-a3e9-4450-b929-ccafaab836de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958905, "uuid": "c036bacd-5d36-451e-b568-a097f4ace010", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4577d2-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943969, "uuid": "ded696f7-dfa6-4d4e-9486-57259fe36393", "comment": "Malware payload (Mirai)", "value": "8203dbfd3dbf47a6b322655cb79d25e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943969, "uuid": "814d126d-dd9b-4021-8808-a00761bce2e8", "comment": "Malware payload (Mirai)", "value": "af906bde52fe4b0b284f9d2bd5f2d2613a3d1ba86e988829d199f3d146fe7704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943969, "uuid": "3b42bf97-ce92-4656-bd05-454d4ddefd10", "comment": "Malware payload (Mirai)", "value": "6efb179660c883ab4e22e2c28539707d6f7cd76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943969, "uuid": "7d06848b-ad15-443e-a12b-9428483b44cc", "comment": "Malware payload (Mirai)", "value": "ce63a776473be88065fa8c8bef7e1692dcdc712b6b29eb49f59b729ca04dfff63afc90fb24b5ab9d48b2e0f2f790379a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943969, "uuid": "97220225-b963-49c6-a0ff-1973166f4806", "value": "T15E2422D5063E6C79F67C50F612EE1E83E27BAEB8501AEC2A349FD5CA1BC140813A0D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943969, "uuid": "e3a65300-b7c7-41c5-ad59-74aa99b395e0", "value": "6144:8dTFkoE1aj6uZy74/Y8uX3oeEWDNiTI/M1:IkX11m44QpXYeEW5eI/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943969, "uuid": "7db7410b-1616-4bce-aedb-6a1c16682f78", "value": 223892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943969, "uuid": "5dc190ad-2560-4219-9a9c-e182695828c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943969, "uuid": "88cbbeb2-2253-4b0a-80fa-510390b79cfe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a3dc2b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958914, "uuid": "daa6b84f-cfcd-4663-a3c5-a1a3ce9030fe", "comment": "Malware payload (Mirai)", "value": "067a1562136f354c5f76f0156d1b9065", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958914, "uuid": "965661d5-c0b7-49ae-91f3-1d480bf2a111", "comment": "Malware payload (Mirai)", "value": "b02782e0164df75cdf6f9e24d107c924b08b27e7f83178dfa50ba00b82568701", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958914, "uuid": "e039654f-5b2f-4a39-811c-7441821fa38b", "comment": "Malware payload (Mirai)", "value": "2cddb0b18d2e3ac360a1f8e30e4c30f7c4f9b220", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958914, "uuid": "92f23954-5c9d-47dc-8a31-9e0c0fee3f29", "comment": "Malware payload (Mirai)", "value": "db9f48a81e52079c89572a2843bb5f752e66e6517f4f2a33f28bf49ac329fb5f1c3817cef39ee5a67b36886c909997e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958914, "uuid": "2e8a5e3b-0930-4041-8f63-a432b9567b8d", "value": "T18DD0C9B84106A5B47407B9ED717613CA31E3CB0F30768A1ACC4020B3E1C045CE022E0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958914, "uuid": "6a9c8cf2-5c14-431a-bfbe-ed1e12b85de6", "value": "6:LA5/jeAKTj7KDA5/ZWJeAbJTobJ+0TPATVWJv:sh6AMnthoMAewUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958914, "uuid": "1ff5ecfe-0a8e-49db-ab84-a2954f33b8a7", "value": 198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958914, "uuid": "091a81d9-9184-4fdd-b165-00d712fdd7fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958914, "uuid": "bcf46f25-4729-4266-bc77-fe1cd877dd9a", "value": "adi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd1f66-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958988, "uuid": "1b1a0ebc-ac6a-440e-9965-fb954716698e", "comment": "Malware payload", "value": "4db7decff640038119abc84068fc6392", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958988, "uuid": "5f3c701f-8685-4ee5-8b45-92ad14e79b6e", "comment": "Malware payload", "value": "b036bd76224ff9162403b64d0df1f49a7196d7695968332e6d8812d69224c7b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958988, "uuid": "7a3d1371-51e8-49f7-a14b-97dd56b3f4e4", "comment": "Malware payload", "value": "89d4d2ffe1cfbe37c984307ffe4d1f21369caad7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958988, "uuid": "439588a1-793d-4d70-897d-d125c0f42495", "comment": "Malware payload", "value": "6911306c6b74cf1a4a0420d7b0973cda991df64daf1b769ca8b9d6eb507cda3ab7a322adc2db87fc305f8fb55a05eb49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958988, "uuid": "643c8a79-9693-4a30-aa07-0a8115177127", "value": "T1EB315EE800DD9F36C8C0CB067A17B03D303A0AEB7E675AD82EDD68D977186A3B021D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958988, "uuid": "4d83db94-624b-43d1-bc04-9bdc1e6c545f", "value": "24:fMBKqDl5f+FBcB3FSODqB0uABP8F03BEsjcBYDZEwqBo8YB0XD4BUnABCXHuAnB6:4XZ+7cBVSZE1x5wYOw66F5QLo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958988, "uuid": "890e10c1-baf5-4d7e-a26b-cb33fce83f87", "value": 1509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958988, "uuid": "1c40c84d-220f-4510-baa1-460ffb5287f8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958988, "uuid": "e3664c12-4c68-4d19-81bc-695a23f4882a", "value": "mass.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb5d5ac-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959083, "uuid": "331066d2-77c9-4c7c-a2c8-5957c14346ff", "comment": "Malware payload (Mirai)", "value": "39c9a1105def4bdb775c8d5886a93845", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959083, "uuid": "6d256958-c2a6-47a6-9776-48803a2c3ffc", "comment": "Malware payload (Mirai)", "value": "b12f2c7dd4567f4fc5e491b74c0e0a79f41c2fb4bed365d0556d736f8f18b18f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959083, "uuid": "c101cc9c-6948-4bb9-8dfd-b76fd6aaa171", "comment": "Malware payload (Mirai)", "value": "555f71355f7af643c64af82f078c0c88bc07ff5b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959083, "uuid": "d0d685c1-3064-4980-8262-caf1c9a1b23a", "comment": "Malware payload (Mirai)", "value": "d1d2e4e1fd1648aacbb87a9b83d9512eab433a6ad7ebbb10d7227c943d18a00ed6d652c8da8df791208daa075e6cf7e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959083, "uuid": "e7504eea-8345-47f7-bb6a-6ae421d9d537", "value": "T1A2C04CFD502A6256C1056E096069B859F273C7D762B18B069ACC7427F58E520B623E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959083, "uuid": "24234f78-80b9-4ab7-9334-a7958cb8639f", "value": "3:LMFtyg/w8NBzSa+ANjavjMFtyg/pONBzSa5Ap92:LMFt5/wkPj6jMFt5/Myc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959083, "uuid": "d2087f7f-b9e7-413f-8c4c-5d80bb76885c", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959083, "uuid": "e3847eb3-61a3-40c3-be04-fd16bda37de1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959083, "uuid": "94277c4c-58c5-4628-bb47-910f59057870", "value": "phy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d291a98-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958468, "uuid": "b30a0fd7-9ac6-4379-bec1-d5b4001e0727", "comment": "Malware payload (Mirai)", "value": "21b92cacad01964b89f7e4dc469e1484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958468, "uuid": "2ebb1db3-e1d8-4082-8f70-6f4fa5236989", "comment": "Malware payload (Mirai)", "value": "b15964e67c02066cd46bf49e72d87a3faa34fc78a5acd3907713d315df670b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958468, "uuid": "3eb27fe6-f93f-453f-a5cf-080aab4170a4", "comment": "Malware payload (Mirai)", "value": "8904b6a28bd201a9b2881c973468d48dca6b1587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958468, "uuid": "171cf3a3-b613-446d-b45d-34406620e444", "comment": "Malware payload (Mirai)", "value": "d2cd2f39558b2fa2c8791c6b19dd01e795356bb6085d3d495598d91a0b5c2b9b22e8583c2fb984eb5b952b216d789b1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958468, "uuid": "d96ebc39-1c55-4ce8-b8d2-8affa92b0630", "value": "T1C8E33A26757A1B2BC4D098BE22F74761F1F157DA26A8C90E7EB30D4FEF212106507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958468, "uuid": "61757cc2-f5a1-4953-9163-0756e81fcde5", "value": "3072:632Jl5RND8zlxh0aigEsjfU302In9ml8Fpfop:I2Jl5Rl4lxu8jcKmmFpop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958468, "uuid": "cf3aff8f-2316-40c2-bea1-3c281c80b56f", "value": 148968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958468, "uuid": "ec6e07f4-d1ce-49d5-a06d-857e90f84949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958468, "uuid": "8eeb5f6b-eb9e-4e0b-830d-33ba14df22b6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02728706-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908548, "uuid": "16960eb7-57fc-4b63-add3-82b0ba71c830", "comment": "Malware payload (Mirai)", "value": "5a22126a5099d4ff7a0a00c7983804b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908548, "uuid": "a2e98d66-6324-4a71-acc1-adc7af904651", "comment": "Malware payload (Mirai)", "value": "b19f79e89c2c1cceef54f7203f6077c0baef5e7febb230ae0a9629dfbaede34c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908548, "uuid": "2c5334c0-ab35-4ac1-8a98-1731dd9f699c", "comment": "Malware payload (Mirai)", "value": "b0c4b44555a52539714aa40d89eac80cc92efcc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908548, "uuid": "93b73783-d83a-4f9c-9bf6-d84b2a21d3bc", "comment": "Malware payload (Mirai)", "value": "07af839a9f558c2254ae7528fe89f7fbb62cdec0c48361bd245b1cba5ca4b8b9ee7c59e8c97099cf24da36d0e94cdf8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908548, "uuid": "85aaac84-c2f1-4231-9f8f-db05a078359a", "value": "T1A482D158519052B1D5B01839DFFEC943BDD98275D2EB70A054142A2CBAC531EA27C6EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908548, "uuid": "ccfdcc84-73f8-4d6b-97f1-bda376154cec", "value": "384:7T+sPlI1PGzI0jkm3MkUKTk0KPwDoTglL2zhymdGUop5hte:OyWPGE0Ym73KPJTNzs3UozLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908548, "uuid": "3807e763-be12-45a4-a029-68a93837a449", "value": 18444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908548, "uuid": "9a2aabbd-1a31-4030-bff1-f203dd76395d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908548, "uuid": "cfe8f765-4e90-4a8c-8519-ca26f30d3c4f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570ca48b-d1ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764955505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955505, "uuid": "716e5a9d-7ac7-458c-9b07-d8b30288e09c", "comment": "Malware payload (Vidar)", "value": "4f09669f0c66d1cd4c33e65cdd3bd6ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955505, "uuid": "bacc0e1c-0b74-4f5f-9e97-ed161076409d", "comment": "Malware payload (Vidar)", "value": "b21638e6dc0d08386d9ef2fe8f7a0e2dcfcdbbad5ab2cc7c2f773f4d96e9a3e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955505, "uuid": "479f0e5a-40ce-4c53-aa6b-b7f7f0d10394", "comment": "Malware payload (Vidar)", "value": "404a6f3974ff49f1bda9f658956747577dd5bb2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955505, "uuid": "9ec9dc5f-815e-407d-998e-0df0ce97adeb", "comment": "Malware payload (Vidar)", "value": "61ece7d97aa97868ac1ba451eee6bd0da4c20b5416c766ae3aa3f67e1152cbb5729731764fe32097f36475b51682ed19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955505, "uuid": "a0eea8a2-a047-4104-aa27-50dcccc59158", "value": "T182861742B981553AC56AF2349DB1A25077317D0943323BD72FDB1AA60DFABC0273EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955505, "uuid": "9dc53d12-6047-437c-9d97-fec0a4efbf42", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955505, "uuid": "4751b41c-d7ad-4a43-a0ab-bb9ad696db40", "value": "49152:rRfldIE43uFrAGizchK1bc7/bSVRrq6YMB+m7G6Qvweq+a4azof9JXm2K7qU:Z43yrMVSzSVpq6Y45ewT+avzofK2K7qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955505, "uuid": "78816827-8450-4dd9-87e9-53b289441b42", "value": 8443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955505, "uuid": "db68934c-2a6e-49b9-94c7-52e04cd3040b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955505, "uuid": "ffbe0d25-bb31-4d30-88c0-63d23c1b4121", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071c1a5e-d1d8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764938621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938621, "uuid": "0543cde3-1e42-401c-9fcf-42ae24a5e27f", "comment": "Malware payload (Mirai)", "value": "204f2fe13e24079542bd4f85981d37f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938621, "uuid": "96220893-1c4c-4448-a6da-914bfc5d7252", "comment": "Malware payload (Mirai)", "value": "b2e5946c09ce51e47f6c80303a1567dbcb91864c7e51e0e80d78c3f107632668", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938621, "uuid": "6a081662-3e66-421b-96b2-53055779a058", "comment": "Malware payload (Mirai)", "value": "906e34c750d44a4f64cd8e1a1c69622d42378197", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764938621, "uuid": "e8af1362-26ef-40a1-82f9-d7cddad330a4", "comment": "Malware payload (Mirai)", "value": "9459218f384bb1b1eaad6604d8e03222343bbe091bc4536f22a92e0905de2fa2aa9ed1886836fe84996ba5fda941614d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938621, "uuid": "e15da726-ad4a-44f8-9afa-6854213295de", "value": "T1E9110C9F30112081C1F4DB487967E93C7349C2C114D83B2A9BCFDA33C4D9A143AA7EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938621, "uuid": "4ee26fbc-46c4-4c06-a6d0-61a769d2a9f4", "value": "12:78ZHPZOPZhPZpdPZXWZPZrPZ7ZPZ7WPZ7RGtN:exobpnSl7DkotN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764938621, "uuid": "2e7e5db2-fcee-4736-bb16-e7dcc398dbd7", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764938621, "uuid": "a2a1be3d-bc58-4210-97d1-f6b38aec73e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764938621, "uuid": "97f0cf45-d75d-46b8-85f2-f162d5104e9c", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0eaf070-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958340, "uuid": "3d391f0b-5757-4c23-bac3-9049dab1e538", "comment": "Malware payload (Gafgyt)", "value": "543af9bf24b3c0df052fabc760541d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958340, "uuid": "53ab0a29-0968-40fe-851a-b4a8ce24e962", "comment": "Malware payload (Gafgyt)", "value": "b3109d487236ec91db256bd3b35e2e92f16f4c9029c5667a8eb393bb21845081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958340, "uuid": "5016b5bd-73a0-4cbe-8d99-e235b459e925", "comment": "Malware payload (Gafgyt)", "value": "6122bdd18dae12b5d7b9c62ce121ad665b850b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958340, "uuid": "9f111bb9-45fa-4701-add1-5c67525c2a01", "comment": "Malware payload (Gafgyt)", "value": "3367c3145e78dd243bf39c0c047161176540d0ff523f726ad4199a6a824f4aa268ac6a87e7b59bf64e6fd4470e0c1520", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958340, "uuid": "b42103e9-5dc5-4032-ba14-77e92b4990e1", "value": "T1F8A33A41F841871BC3D327BAEB8E479D3B3956D467D733116A386EB42BC27C82E29521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958340, "uuid": "0a11bcac-e26a-48ec-b047-65747504c59e", "value": "3072:YhDJsL+PzGznwTzPmt9UmZRqQmDPRXXkQX:GAkzGzWzPBmZRqQmDPRXXkQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958340, "uuid": "5ba85ee3-ec37-4951-a0dc-855342666043", "value": 101980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958340, "uuid": "325e4492-6057-4fb6-a550-9a68b2d32c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958340, "uuid": "a584aad8-7f32-43bb-901e-dbaf43e2ee59", "value": "Fantazy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e184bbf-d201-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764956242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956242, "uuid": "a6e883d0-cf69-41c3-9c9f-cdf83bcc6873", "comment": "Malware payload (Mirai)", "value": "476c24a2a6e093f93d11d59bb92962c7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956242, "uuid": "2c3bf424-f61e-421c-8a3e-d13b0768d4fd", "comment": "Malware payload (Mirai)", "value": "b366c23543658b08cf134350e5ca38731221e7d4e1c171b69ad08268bf343be2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956242, "uuid": "ffe37138-6450-46fe-83f6-ae4c26b785bc", "comment": "Malware payload (Mirai)", "value": "e7cf88f249a7a24b66379928b4ef83ce4fc1fc96", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956242, "uuid": "ca07fde0-a6f2-4f29-be6d-727dc3bb7f94", "comment": "Malware payload (Mirai)", "value": "31efb2f69b4c96b63eb29be61b77df31691903444164a5746e96306430636d6d0befb592bf8ff8092f8fa57112127658", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956242, "uuid": "bf9657a6-876b-43c6-a7ad-6dc76adbb78a", "value": "T16C111FFF2841DA82C524C780BD77F900B11CD34D11DC7AA5E2DD67B1809A9247A02EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956242, "uuid": "ab336cf4-70f9-4ade-9d5e-bdf3f18c85b4", "value": "12:78Zp2IQ0ZI2IQ0Zr2IQ0Zp32IQ0ZXWD2IQ0Zd2IQ0Z7D2IQ0Z7w2IQ0Z772IQRmE:ep2mI2mr2mp32mC2md2m7D2mU2mv2gE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956242, "uuid": "5eb744ef-8dd5-4754-a389-1f74eec61831", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956242, "uuid": "54838c8a-1752-4666-b85c-b8c1ee8f0e7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956242, "uuid": "1be5f15a-c095-4ba6-ab22-a5bbd4ea8f39", "value": "router.tplink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14267b-d20b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764960639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960639, "uuid": "0530d187-f4b3-4c93-b19e-50661c33dff0", "comment": "Malware payload (Mirai)", "value": "baee4a62e12d79508fc7265885de6964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960639, "uuid": "e38ba478-5c5d-4905-8e5f-e20907733943", "comment": "Malware payload (Mirai)", "value": "b36ed21f035f47e0f7edc57b8f81e712160af37f4fdb440ae0c88f817a5ee919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960639, "uuid": "b07f3134-0852-4b42-bf76-b0976e18d87b", "comment": "Malware payload (Mirai)", "value": "4b00107f78a68c03e29c6027aa6108d7280e449c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764960639, "uuid": "3d51569d-35e1-463a-86c9-9d9d1e935c42", "comment": "Malware payload (Mirai)", "value": "3e83dbfab8b2c247adf5311dbf4679841b849b363a6116d1b787d40696385525468f25b1a80155b1dc7f60d47a6337bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960639, "uuid": "853f28a5-a06e-4276-a185-b051a0b6d076", "value": "T1D9830279332ECEB0C92771740A86400FEA1565C7D28F1EF36D6875A68E7E9482E4DE31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960639, "uuid": "17227c94-b867-4c36-8c7d-a08cf7948952", "value": "1536:pVM0syAIQ/zWq7OIW7uOz/OMZYUCo6zrycTUFDBqDVS++ukN+Ohamyzkxzao:4yfc1JQBnYo6zmqD8Gu+Sykx+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764960639, "uuid": "435d4531-bc13-400b-9ff0-8618ceb1d035", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764960639, "uuid": "0bb1e5ed-10e3-4e42-9e16-4e5e11153a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764960639, "uuid": "7d454a3a-f135-434c-9c94-84a0708eac31", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8dd23d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958873, "uuid": "99fcb4c4-37b2-429c-b9cd-974539caef9e", "comment": "Malware payload (Mirai)", "value": "1cee4c1a01bef0900001f41d135bf09c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958873, "uuid": "365a8aaf-60e2-493f-a559-b6234901b2c7", "comment": "Malware payload (Mirai)", "value": "b3ef77492751b0051fc092f9c1fa464eb3627c5e2f66990f1314098de33a7ac0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958873, "uuid": "2d73cfea-2fc1-4ff3-8862-7fed32c7d0ba", "comment": "Malware payload (Mirai)", "value": "23fa552d28f2cbadf4f4d60421858be887f8d4c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958873, "uuid": "53fd7782-e866-4529-9d67-fcac03db00ca", "comment": "Malware payload (Mirai)", "value": "28d607d82558c22df27687c55e878d8cfb8f88848e8ec8011b8ca1aff5d76ca6770893e5544ce907f8c08c409352b938", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958873, "uuid": "04323bc2-47d0-4a1d-8cdf-de8897143c87", "value": "T144F081FD4025FF16C5482E4F7659783E507A47CE40A7DBC46DCCB42E72A45A07322D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958873, "uuid": "08a5c411-09b4-4d94-b521-596fb232204c", "value": "12:6hAFlphMQOphQphlaLB9DphSNITBOphf+Zn:IA/XMQOXQXlaLB9DXSNItOX2Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958873, "uuid": "6d57f1b4-ff40-4d26-866c-06673d2108c2", "value": 612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958873, "uuid": "417f9bfd-e72e-43cb-8e89-793d5f12ac65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958873, "uuid": "7cd5cda4-300e-4feb-9704-537a2d62ee55", "value": "vbn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1f0d88-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958411, "uuid": "cb8abfad-ed26-4acd-b96a-b7f739998ac3", "comment": "Malware payload (Mirai)", "value": "f66c8000113e574a2f41860b6f4ed95e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958411, "uuid": "25d5b92f-3c5a-453c-b8ef-8e128a9dcdf5", "comment": "Malware payload (Mirai)", "value": "b4313f41aef11b106451c7a2301510eb4360f28f2439265e3c99e24970b30786", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958411, "uuid": "542dea8c-1126-43a2-b705-9547757f9ecb", "comment": "Malware payload (Mirai)", "value": "1a1b5c18d2246b8c7168a707e628ab2fb5ec9ccb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958411, "uuid": "4bd6a0c1-d250-4f6d-bca1-21ba312c08f0", "comment": "Malware payload (Mirai)", "value": "b6afb136fefc77ec0e8f8e37c3b58be154ab5cd623ad228cec63163073b34bf43f7e17a3e30b3aa67e5ecca6bd87ada3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958411, "uuid": "8406023e-711c-4f94-87a4-bad5ff42fd56", "value": "T1AA0144CD2156D6832E4D9E49F17AC21C7A42EAE07078CD25F89648F2D8DC2703164F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958411, "uuid": "22aa1203-c43b-40b3-a852-a44a2bdf2944", "value": "12:3J3MjQKqQSNIl5zAQf0LKjQn+OsQSCQM/Q+uSEQJytaKAQKjQ2JiAQ2cyfAUR:3J3M7sNI7OKFrKluttBqJfcMHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958411, "uuid": "982fa3cc-6992-4337-bd6d-296a2112a321", "value": 778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958411, "uuid": "669862ba-952f-4266-96f8-67d505b52042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958411, "uuid": "c9384752-806d-4549-948a-cbc4a1a40d3f", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45872a51-d1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (DonutLoader)", "timestamp": 1764943020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943020, "uuid": "af9f19f9-dfdc-4478-84b5-fc55202c3a6d", "comment": "Malware payload (DonutLoader)", "value": "299192ff2431b32b353053118e220d8b", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943020, "uuid": "a3fa38ec-9b01-40dd-834d-a5c06a9d36c3", "comment": "Malware payload (DonutLoader)", "value": "b4c0fb08f1de646da49b98400e67c2a6d5d6ad6e5fe816e37244fd9d1da00074", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943020, "uuid": "5a34350b-7850-49cf-9b05-dc7a0be94af5", "comment": "Malware payload (DonutLoader)", "value": "e1fe948be1c47e8b50b0125e5ff16d26e61b0543", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943020, "uuid": "8cb171ab-ba91-42e3-bc77-a4841b816536", "comment": "Malware payload (DonutLoader)", "value": "2837a56a2234720435ccfd7a8b8c7894aed76a634935b9e911d24d5d951bef09bf36f04141a34942a272fbf5debed04c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943020, "uuid": "18cb4099-67b2-4f90-8458-c91c2193e96d", "value": "T1ACF36C5773A820F9E077C17989920A06E372B87657619BEF03A0477A1F376D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943020, "uuid": "c58ce38b-b57a-41eb-a3c0-b23bc6bd5fbb", "value": "efeb5d2e785b956a774e5a38aa6509fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943020, "uuid": "9ada5f7a-d477-4670-a61c-1aeb10217105", "value": "3072:PLN/PnSLs+FF+gXWrzDwFakFiixQO/aH7H/1JSA:PLNn/+zdAqaYUHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943020, "uuid": "7a02e183-ad41-46c1-840e-f72c7cfbf4cf", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943020, "uuid": "e3074375-232b-48b5-acfa-931b2bd5670d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943020, "uuid": "f2f79a6c-31bc-4adb-9eca-3634bb4e1037", "value": "b4c0fb08f1de646da49b98400e67c2a6d5d6ad6e5fe816e37244fd9d1da00074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f442af-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958381, "uuid": "22872fb2-f7aa-4867-b10c-10277afa32f5", "comment": "Malware payload (Mirai)", "value": "1c1ef3d40a615aff85798d992b9fa840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958381, "uuid": "b4d47d52-9496-4da5-aea6-453e2790161f", "comment": "Malware payload (Mirai)", "value": "b51677fae75f2b11a3785a1468751ee1b5ea44364b7731486a9e280f34d0984b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958381, "uuid": "4134f013-2b74-4a59-91d9-90a189ec1b98", "comment": "Malware payload (Mirai)", "value": "13770e936c0a2634959855c368f37ccf000943cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958381, "uuid": "ac87d96c-ea37-4c94-b858-ca5dfbcc95cd", "comment": "Malware payload (Mirai)", "value": "32e0e721b79e74f42225316dccf80e84dd43b8f08d88afd50c0e50b87e076d31dbec1c3773abe784fe82d44961f7e1c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958381, "uuid": "d33fcfc9-b6bc-4a60-b56f-c1089004e976", "value": "T1DC83F74AF8819F11D5D926BAFA1E02CD335357A8E3EF7202DD105B1477CA92B0E7BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958381, "uuid": "7fbfeec8-e39a-4209-ac7e-ba72b36c8e40", "value": "1536:FTpnmoASKYsQS1naBRjyLO/DWOAv+JTx6r8ZIC3dl6mi5MxoPquybVR:fA1YknAgLhOE+JTx6r8ZcBMxyquy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958381, "uuid": "a7913c95-fdf7-49bb-87dd-8d31f47c15aa", "value": 82172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958381, "uuid": "86a9ce51-4feb-4414-9a4f-e00172541a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958381, "uuid": "2e23361f-bd6c-4a18-8e42-dddee3759ddf", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c41289e-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958386, "uuid": "1e269ee2-e7a5-4442-a901-788c4f4d9584", "comment": "Malware payload (Mirai)", "value": "a03b9be602ebb4a6712f0050262d3843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958386, "uuid": "28730e80-b94d-404b-b0c3-d4d03a49d398", "comment": "Malware payload (Mirai)", "value": "b52071390cd13d158851febcbc150d5255305bbb27d47aec10e4cc16419c718c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958386, "uuid": "ecf73e1b-9540-4a34-a345-4dbd50bba311", "comment": "Malware payload (Mirai)", "value": "0b72738403cb58d083b25ab6d350bce29defab01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958386, "uuid": "88cc8fbc-9865-4ac2-b9d5-8842b28a5b3c", "comment": "Malware payload (Mirai)", "value": "43c3d0f2575e08e6c89ad96dd7705bfa0199d0b739b6519d9ed752d8ba7578049a14ff055d0d31bc2eb99e1c34085a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958386, "uuid": "4fd87751-080a-4170-83b7-bc3e07d638ba", "value": "T1F6A3E691BC82562BC5E023BAF6BE568D336577E4D2CF322BC8214B257B8550F0D63B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958386, "uuid": "8ab4aa9c-075a-449a-bb0f-8b7654ca9f1e", "value": "1536:Xd+5YuuF/TgXJ6erRocYrzLQy0D8PCrV3qILB+ofOVtu9vvLzAe:t+5Yf/eQHaq9Ntu9nwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958386, "uuid": "9abbcc9f-e38e-421c-95cc-9172aaac6274", "value": 99816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958386, "uuid": "877c756f-1adc-46ab-be11-7547cf843ac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958386, "uuid": "85758ecb-909f-4671-adf1-c8991573b99c", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb3f1a-d205-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764957979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957979, "uuid": "a0097312-5676-4399-9a9f-649e752dd5a8", "comment": "Malware payload", "value": "b1aecfc83e5df6a6b29be7efd7c0343d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957979, "uuid": "aa0fa0fd-571f-4ef1-8f41-7c8d4f065850", "comment": "Malware payload", "value": "b5588ea2f98d661192c901a59bfad2975d1a1ead2e45eaadbf7815892fc009a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957979, "uuid": "69aa1c82-defd-4cd1-96f2-967dacc62ae3", "comment": "Malware payload", "value": "d53e0d19b5d41653121841fd6ad3cf721328ac49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957979, "uuid": "b87b2046-c676-420b-8628-aa590706c6e5", "comment": "Malware payload", "value": "46d412f02e78f9765fb21f73726496836605948b5f7790331bd2b6210fe654702ae319a808b566cc1e6dfec4c056ed2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957979, "uuid": "0313a8f5-3f94-4a4b-99fb-620e6f052a9c", "value": "T179545C4937A440F4D9679239C9A39A46E7B2B8550770A3CF036443B96F3B7E19E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957979, "uuid": "47919ed9-c535-4bc5-a223-ca8fd8c597f1", "value": "b95e73ad92c2049315610876e4406ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957979, "uuid": "6bd57cc1-0ce1-43fa-be57-81bd24dc59bf", "value": "6144:xhzTLdWUF63UDlkiy2x2/hSTyC2fPJyTpg+q9k1s:xryg/x4JSg+q9kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764957979, "uuid": "74c6dc67-d781-4952-825a-7e53ba101eb0", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764957979, "uuid": "58be6398-d030-4dcb-8faf-97cd7b2503e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957979, "uuid": "52c2ca58-e2e8-4069-85d4-fbe026709c30", "value": "b1aecfc83e5df6a6b29be7efd7c0343d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491ce8ce-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958918, "uuid": "758b8ecf-a7ac-4b5c-8085-95f7044bf918", "comment": "Malware payload (Mirai)", "value": "a642b6364b9d009653f5e3083c233d56", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958918, "uuid": "37ef99fc-60f9-449f-a694-66c4c77443c7", "comment": "Malware payload (Mirai)", "value": "b5c475c24ccccf73d4876d68de030c562a1f2fc640afc4456438372daa7165c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958918, "uuid": "f0698ba4-054b-4ccf-a69a-b364500d09f6", "comment": "Malware payload (Mirai)", "value": "66c4502bf3443a05e3973d27f2d96b9b90d4e834", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958918, "uuid": "421971bb-f5e3-4f13-bac5-e233ba964673", "comment": "Malware payload (Mirai)", "value": "2360dc76a45a8d8b5a661658f9953cf8713454286e0316fad4c7a6417f89dd0d382d16594ee1510649cbfbf7b94fe7f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958918, "uuid": "b992f5bc-8ebf-4ec8-9556-b344bdd3c04a", "value": "T1FDE092FC030B589480C9D83AB2A1C60CB0B25BCF6C779A802C41387DA0B04DE7032D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958918, "uuid": "fa7fd829-179b-4ec6-b2d5-6231dd1a0eea", "value": "12:JGmTjh/40iXVajh/nkiXVajh/3iXVajh/WiXVn:HFgdXVaFfNXVaFqXVaF3XVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958918, "uuid": "756c8776-afb5-4fb3-8d74-40cba2e4a1c5", "value": 392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958918, "uuid": "a99f5593-1cab-4240-bb14-c8c712367284", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958918, "uuid": "3243646c-33dd-47ce-9f7a-9badc26ec570", "value": "camera.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2d99a-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917682, "uuid": "46aa7a12-c353-4dbf-815e-6762e543bbe3", "comment": "Malware payload", "value": "b127ee3c010a70ca66cc8d2f8b4af4b7", "object_relation": "md5", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917682, "uuid": "70e3d415-765e-4eac-b0c3-817ced3489ff", "comment": "Malware payload", "value": "b636e56c0afe960e7009b5a44425950f778082e60e35f15a2bb3dff85b1721c9", "object_relation": "sha256", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917682, "uuid": "067237f2-83ff-4dac-8dc5-b7311116fc68", "comment": "Malware payload", "value": "a7954fbf1e1cfdce4da8078885844af2ae36cb26", "object_relation": "sha1", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917682, "uuid": "64db7e78-f1c2-4c48-9b6d-fa0889fc497b", "comment": "Malware payload", "value": "36e4861ad7ee83e552ca14e56842df950f3f720f91b645bb516f41f65a469b444c137cb19087649378f5b943dfd3e68f", "object_relation": "sha3-384", "Tag": [ { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "212-232-22-136", "colour": "#F6F53E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917682, "uuid": "52ee0c1e-c5cb-4803-a099-3dd7c7902973", "value": "T13CB2E1CD27471D06687108A9F253CE602D1C2A9D512DE7C2CFF8BE2D60D705B4A0FB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917682, "uuid": "9a1bf813-3099-4833-8f7d-08325d78ecca", "value": "384:Fl+3sl4rjX7Jjw6ghStfiifIQRwNGdGP7t+Ss9Ikx6jEPno+8IFxK:UjX7Jjw6gMtqiflMAu7t+Ss1xYwxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917682, "uuid": "257e99ac-d615-4a44-873b-cb43b96ce4fc", "value": 23727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917682, "uuid": "94157e29-c66c-4d2e-b74f-4f79073864e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917682, "uuid": "27febc7e-07f0-4572-85c3-35aa2e4d69d7", "value": "17c6c687947cb27297017896ba777079cddda211987af2946c7838d00941a404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17adbaa0-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958405, "uuid": "0a290d0b-0df3-4e3a-8ab6-f8e7dac36698", "comment": "Malware payload (Mirai)", "value": "74bc7df7987f0547aaaab04c2f103675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958405, "uuid": "0885bc6a-3bd7-4b55-9578-06f1efa8d0fe", "comment": "Malware payload (Mirai)", "value": "b64d62b373caa4995ebba0b7b1677d6027ed6a50a6addbe673cd142164c29e55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958405, "uuid": "b4262afe-f87c-430c-a253-b57e0757135f", "comment": "Malware payload (Mirai)", "value": "cd268a941c7bb21ddd7448e2bfa8b1ba54174ca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958405, "uuid": "1b6fbd53-4b5a-4889-ad18-bb36d6ec89fa", "comment": "Malware payload (Mirai)", "value": "1abf50ffcc16b5c7b4bb2452febe7d57c0eaf37d363bdda1208abd9389d961aea633fb113f364f565d66b24a1a6aa217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958405, "uuid": "3ef94931-d96b-454b-83d5-239af5924640", "value": "T1DCF23949D953D8F5EC141EB13863A7729F74E97A04B8FA83DB55E931B803241620B7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958405, "uuid": "527c6ad1-0e86-4bfb-8587-61cc800920a4", "value": "768:nri1+Mmq/zSqk6aLOMrbZ6T2uB3jclX0ljJykcypodN:nu3mq/zSqALOikiAjclX0lNncypY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958405, "uuid": "a7c0ac30-63df-4173-9821-5c11744213bf", "value": 37504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958405, "uuid": "762fc812-6f1c-4212-b9f0-29a0714b54e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958405, "uuid": "56469d57-100b-4881-845f-d5477c268a6d", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0da65e-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959490, "uuid": "add74b12-6955-454a-b2c5-57477b1908e1", "comment": "Malware payload (Mirai)", "value": "737ffb48ad8a515eb1975d5eb338e78e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959490, "uuid": "2c1a7376-62c0-4d08-a808-679d986310c9", "comment": "Malware payload (Mirai)", "value": "b6b0dcb15fc562da7a96142aa66c0d8050bc73a00e0ef150555364ba091ee232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959490, "uuid": "6f840ee2-9466-42d0-85ab-3d140821c58b", "comment": "Malware payload (Mirai)", "value": "6a55452851698c67b71f95f2716fe4f001127aed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959490, "uuid": "5c0de90f-b92d-45bc-b024-32843697132e", "comment": "Malware payload (Mirai)", "value": "353080b09d527506bffc05369307b99a60b4493e593e7b5b7520d19365909a998adc94ef4cb764b9dac1ca8006f3bc10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959490, "uuid": "6c474df8-b77d-426f-9a13-5b9506b56ce2", "value": "T13E43951E6D168FBCFB59863447B78E219A5833D627D1D542E26CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959490, "uuid": "754dc4a6-2a66-4554-8934-cfd3698f4876", "value": "768:YIo/qKBExCQZvj5rhmuLbFNBmSnoh2L4S3uAOK1YZaD7IfyMnN55HsETAFwM1:Yp/Qlvl/NP1OK1lDo5MgAeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959490, "uuid": "a66b1c7e-6db5-4485-8142-8bd46e1c756c", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959490, "uuid": "3667e93e-f9ce-4842-bb9b-d8e636b7f75f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959490, "uuid": "fa0f21d5-f8c3-4703-b1f4-1c378b799664", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0e8d92-d1bc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764926788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926788, "uuid": "c0b6871e-ad1a-4354-bd18-3fe3af7f9842", "comment": "Malware payload", "value": "e8c4b3186de885a5fa783de115c73828", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926788, "uuid": "65bf1130-6a7d-444b-8f2d-cbbb39860097", "comment": "Malware payload", "value": "b757381f750d0069f663a29fe61a57aa922795248a54488982dca12d7421f54a", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926788, "uuid": "b4d34c51-fd02-4281-9050-726fb7fd3327", "comment": "Malware payload", "value": "31a73281a27ca6b5993c0770470b69081b4dcc1f", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926788, "uuid": "2e133a21-a572-400e-8532-788174ba7ccd", "comment": "Malware payload", "value": "89d589566affcf129a405bf85f5d8bcb55017dc03e3b963ceae8328b3d9fc814cc7af03f79c289a5d3462e38ab5c3c89", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926788, "uuid": "a74d18ea-1f52-4834-857b-84ad313e124f", "value": "T13DC02BE0B78783302422222758B2C38178F8484940A2E4F3130E8A3FB581CC1850F29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926788, "uuid": "85c4a910-72ec-4d3e-aa0e-a3e75ed1b72f", "value": "3:lP/Ered4aHDMcnf618P53yXMLlV7W6WXiRyVQRlXV:lP/EredBHQcS2pycLlKQTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926788, "uuid": "de20a320-e838-4c4e-8da8-29df471be8b5", "value": 138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926788, "uuid": "796b1664-d12d-4e1d-ae74-c7dc3fbde7a6", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926788, "uuid": "d7338486-ac3b-43f6-ba29-1beb982b84e4", "value": "po##.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f674fba3-d1f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764952766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952766, "uuid": "7f234a2c-1153-4d73-a4f2-4a68e61e14be", "comment": "Malware payload (Mirai)", "value": "ce60f4d4dce06d2246415d7902837716", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952766, "uuid": "c042e94c-0a13-40b7-a926-e56de0f98311", "comment": "Malware payload (Mirai)", "value": "b7ab926b5f81f65f690c7ba946f0eec4ef5d263fa218e4fa850f391d15c40d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952766, "uuid": "baf5a336-dfe0-4b04-a073-bf5316900fba", "comment": "Malware payload (Mirai)", "value": "3157c6903753ccf40680869a301849d3367909f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764952766, "uuid": "a75e5097-1247-488a-8f42-62a8a2e2eefd", "comment": "Malware payload (Mirai)", "value": "aa61dee81595ab069f2f4eac303abfbbe1e22b3ed35176eb99682df2c3e44e8893d5e9b0cd500581ddad0d7610247a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952766, "uuid": "9f314d0e-2692-4b03-8404-bcfacd0b359f", "value": "T1AB442B46F8818F21C5C016BAFA1E118E372717B8E1DB72129E245FB477CB86F0E76A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952766, "uuid": "f79f4bda-4047-4837-9c19-96ffdbb6f0a4", "value": "6144:lzbLcNF3u7SNaTEzCkc6X4RtayirwHSFm+kmQ:lzX0F3ueNaQzC96X8taxMHSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764952766, "uuid": "a38c44cb-ec2a-425c-9498-a6d5159bde92", "value": 265180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764952766, "uuid": "ac44d588-9df4-488f-ae7b-d76437233877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764952766, "uuid": "2692a699-86dc-456e-9707-38fac9bda4c2", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fbbe72e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958956, "uuid": "c606b1df-c2af-403b-a32c-7ad76d6df6f2", "comment": "Malware payload", "value": "08b4f60f11ff9ceb4d846d533e3ef1a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958956, "uuid": "1f42bab2-50f9-4112-b9fb-af66640f0054", "comment": "Malware payload", "value": "b7da03112af2b1691fd1685d494cbb5a447a9231f724102dfa85c5fdde1078c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958956, "uuid": "42e89cba-ffce-4aba-a0b6-7f42023c5304", "comment": "Malware payload", "value": "339b6388a074ec64a576a7302b70edac2999a662", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958956, "uuid": "97e7b217-fc70-42dd-acdc-0b76b31257c0", "comment": "Malware payload", "value": "7f809c52f6fd9a0b3a9de7d5133c895bbc7ea97ab3fa9d241c9207f147ee3e241d1b611031de7ea9c946285b5974b190", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958956, "uuid": "b78a53dc-0db0-49c7-ac32-caa194e54141", "value": "T18BE075BD006BDF57C5589D15B06B6873B032DBDBA1A1CE0AAEC4A436A198D307233E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958956, "uuid": "45c7988b-16cd-4027-9b95-1757131d41bf", "value": "12:shfcJVzthXjzOzthlaLaNgIzthSNIE6szthfLK63n:efkVPXjzOPlaLaNgIPSNILsPDK63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958956, "uuid": "4b13febb-efe4-4669-89c7-fc87743b2768", "value": 390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958956, "uuid": "4f2f8cb1-cca1-4b3a-817e-a735508939b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958956, "uuid": "eb0ab652-f0a5-4d23-9d18-18d24b6e8f3b", "value": "sony.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6a8354-d1b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764924454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924454, "uuid": "e78614f1-63d3-4e36-8a4e-8ce32f9b0a7e", "comment": "Malware payload", "value": "984ae4f139b7da1574a57501061e1eff", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924454, "uuid": "6b93ec6f-dfb5-4f1e-bf4e-2bbed1e79787", "comment": "Malware payload", "value": "b82179a96d47de86e60ba65ca7ce97f6424f08e637c5e4127c6c08021c417d8f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924454, "uuid": "ed57d2b1-0f3c-43a8-9f51-8cc59ff2e3ff", "comment": "Malware payload", "value": "e9704ce3abcd5740f6e61bde877a14137704366a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924454, "uuid": "151d1062-1a37-4ced-94b0-08e38ad7d548", "comment": "Malware payload", "value": "c82953795956d5e8a234ef44d6384a93a21b129c581ec91ae1bbc0df9229064b05750d6922c4dde579ea2cc595b55041", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924454, "uuid": "e5b5c448-eb4b-4dfe-9a00-f1f6336af497", "value": "T1500523D23C8991A2D1A2D8B25F9E71B990E5C397401D8B5ED7756F2C05E48F8323FA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924454, "uuid": "809904cf-acfd-4a30-9f35-9154a73f098c", "value": "24576:9hsOQGbeAGQQ+xJQ42fADu2KZSlj9PWbLt:9h1QGbRGHVklJPgLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764924454, "uuid": "41fdc541-41ad-4937-aac1-5a93e411e7b4", "value": 829072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764924454, "uuid": "bae18e4f-0e79-427e-a769-abf0ef7c918d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924454, "uuid": "321231ab-e2ce-4fdb-bdd5-f957f4a0ee80", "value": "Bestellung BE-25000640.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2982d02-d173-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764895529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895529, "uuid": "9a96fbc7-6abf-4552-bd21-d5c1f0083af7", "comment": "Malware payload (Mirai)", "value": "03332d21b21cc27eeb1c002786c8c79b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895529, "uuid": "2890e9c3-67b2-41d2-ae18-dcd87d3c4777", "comment": "Malware payload (Mirai)", "value": "b8a1f482951d2a928b15efba5d320f64041699621dc59526a69e2a1cb9a2a415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895529, "uuid": "055b06bf-b3cd-4a9b-a7ce-646bd9f4a438", "comment": "Malware payload (Mirai)", "value": "7ca9f779327143c593268912835f094e51e56aec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764895529, "uuid": "2ec6386f-1658-49dd-b386-c8c99d1819ee", "comment": "Malware payload (Mirai)", "value": "29e0f252cfb95292611c97950ec7ac3074e372e0fef04287df154037aa8d239c72792428257d3e282346de33f8b0db19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895529, "uuid": "cf8b41e6-033e-4542-b497-2a044120d7f3", "value": "T16783074AFC819B11C5D922BEFA1E018D33635768E3EEB212DD111F15778A91F0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895529, "uuid": "97382c04-9b84-4741-ac0d-c7ed0ad7f411", "value": "1536:ORnBp8831elklflHwthqi4m8lHCpqienFeKZoq3sNlEniDPyno7ttu:5m1ZflHwtg5HCpRenFeKZowuPy+ttu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764895529, "uuid": "98e60b8f-9e63-4488-b655-90ae975a279a", "value": 84268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764895529, "uuid": "73048267-3870-4df5-bf3c-0f7e6f0067a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764895529, "uuid": "c463e58d-420d-467d-bbee-3685284db8fa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc15ec40-d1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764922174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922174, "uuid": "6891eee0-b351-4cc7-ac85-079a91c9a769", "comment": "Malware payload (Socks5Systemz)", "value": "f4c07126eeccccaab7aae9de04e8f4a2", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922174, "uuid": "dd229ae8-9504-4122-946b-137e5bbaa6e7", "comment": "Malware payload (Socks5Systemz)", "value": "b8f307403eeba4275b730c30ec00392fc5c1065eb08b80fa9ccca4f112e68e3a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922174, "uuid": "ff3a1b3d-76c1-4467-a27a-d43fdb89ae0b", "comment": "Malware payload (Socks5Systemz)", "value": "ad2afb7c99bf124067c1e92b8b17c2bb4a29705c", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764922174, "uuid": "2a0ed422-33e5-4bcb-b700-be80c4de71f0", "comment": "Malware payload (Socks5Systemz)", "value": "0ad2e93244896a89409d7e60b176006312534400a8ca41a70c80a021614dd5c506d9b0937839b36f8f34bd494e033a43", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922174, "uuid": "b20a0fc2-81a8-458e-ae25-e01a6e862cfe", "value": "T1ECF5335E721980B2E6A67B726E26422A10F75D7794B4F8241E4C79CC3F5723108BB37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922174, "uuid": "ecde9563-d502-47b8-a33b-549977e75a2e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922174, "uuid": "202bbd29-7c38-4afe-930c-5b2c12d11a8f", "value": "49152:C9jMpHwTX83uaSj3OgBClIInDQS1B9NVtAl3GCD2D/Wr0iZvutXy/LwcNro8V9DJ:MjeQD8+Xj+1DdbVu3HyniZYIccvbDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764922174, "uuid": "af0bbc1b-dda6-4fdb-a323-77451194ebe1", "value": 3488523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764922174, "uuid": "74bceb0d-1b2b-499e-b827-c43617957276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764922174, "uuid": "cea6c8dd-b412-42ce-bf2c-193b69101b4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a47056f-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958463, "uuid": "8c13d248-bc76-4868-ba3a-65e8336b35b6", "comment": "Malware payload (Mirai)", "value": "14a596f95bdb7e5a347f99bc6aa57626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958463, "uuid": "d7d9d6e0-620b-415f-9693-6c707605a87b", "comment": "Malware payload (Mirai)", "value": "b956e1988208afa3a223d24de838f4134459b70c21f34e8bf903a1411e91237a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958463, "uuid": "52fe59da-6521-4dbc-87f5-d48e9084b367", "comment": "Malware payload (Mirai)", "value": "a127c2e3e981eca9f6ef5c30bdd3fe2697860646", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958463, "uuid": "7df926a0-47c7-4649-98c9-5d5dd7457691", "comment": "Malware payload (Mirai)", "value": "65d2cda527e869147e77305126fdab21f94a0a481370932d0820e7dcf0e3214b2eae29cea8d96c901c413edd4d0befe5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958463, "uuid": "a0f23096-7f17-48e9-b931-b69d8130ad84", "value": "T1F03337C4E583EAFADC0505351877E7329BB2F1791118EBC7F799E933A852602B64728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958463, "uuid": "38b76100-23af-441a-be0d-019d743d244b", "value": "1536:Duqsy5faKac5K37HID2/eGDQ6H0wNghrA3tRR8:Du7GfaKacAjID2/eaQUdNc03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958463, "uuid": "94203456-861d-4ccd-b2f7-e7f32818278d", "value": 53892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958463, "uuid": "bbb2947d-e7e8-4068-bf8d-88f84450f884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958463, "uuid": "457590c2-1782-4e55-b035-176a3af49d89", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79daf91a-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943967, "uuid": "bfbde710-be0b-4343-88e0-27d4bf7a54be", "comment": "Malware payload (Mirai)", "value": "0ee47ad2c67e9e38449f6ae35d8b1104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943967, "uuid": "eb87b7e7-f17d-4abb-9aea-455e810cde49", "comment": "Malware payload (Mirai)", "value": "b99354421709694a1ac2bde63fff7441ae61a85ad9c04f57295eaedf020e75f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943967, "uuid": "16104a6e-f3ff-4817-92d1-9d8935d97c84", "comment": "Malware payload (Mirai)", "value": "64482204b8ca836193f61c0d96945dc065b12507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943967, "uuid": "357d98c0-4b07-48c4-8d08-cd2d700c5b41", "comment": "Malware payload (Mirai)", "value": "6b7584bb4f9084789815cc4aabe69259828224cbcb757cfbdf2716156036f01f2a1b33afd9daaeb34e588c3c0673fcce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943967, "uuid": "2e345840-800e-46f5-aeb4-cf20acfcbb60", "value": "T1133423E4636569EADDE33CA7F4C76127E201660BE3226CF877847A442E153071DA8DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943967, "uuid": "58c05e68-1334-4e29-b320-dcea1f920f3f", "value": "6144:I753SRx8YEzCw8YnnmySPfMOJKMG9cKbUiVxt3an:I7of8fzT8YnV6MO4p9RUg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943967, "uuid": "aa3d8e7d-0a3d-485a-a2d1-904156a5a881", "value": 246796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943967, "uuid": "04d131af-1811-4618-9e63-f9264c557800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943967, "uuid": "f040f662-c71d-4be3-919e-caed9f2a9199", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a327694e-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959498, "uuid": "3a720b77-96b4-4693-a2b9-9ac6d5119d92", "comment": "Malware payload (Mirai)", "value": "48d987feebbe5a13b4296701975efe3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959498, "uuid": "89e6f063-9d57-490b-8e96-18e7762052e9", "comment": "Malware payload (Mirai)", "value": "b9d411ca4a365f3f9b0760e9b13747da5d8dd6033e5fe98027f0bdb812a7c7d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959498, "uuid": "ef5d643c-5df2-4ef0-a16a-b161039422ba", "comment": "Malware payload (Mirai)", "value": "96b87d57fffa7976e66f21209afb8f30788b4591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959498, "uuid": "dc7c164c-ae7f-4143-8da8-189e0f973e55", "comment": "Malware payload (Mirai)", "value": "c976d366d5a97e5f962381ad5bc3c0663fb0d3d43dfc67afb5b80ec00904c3ad94c68ae904566802db84e1ad0939f9c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959498, "uuid": "463d1a1a-b5cc-490b-b62e-18afb63ff60e", "value": "T10EC32A46EA409B13C1D61777FAAF41463322DB54E3DB330689285BF43F87A9E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959498, "uuid": "6aa4c741-ed99-4d66-8b27-6fadff756cea", "value": "3072:4ZMu4C+u2dLhLRE90bYK5h9T96NOCb5/YtM/9jV/:uMu4C+u+RfbYK5hb6nb5/AM/9jV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959498, "uuid": "d52f55d3-bb7d-4e6c-8f10-7bde9c147631", "value": 128097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959498, "uuid": "9cee235c-7d5d-43a7-97a2-053ab33a3a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959498, "uuid": "2dccc1ca-effa-40a6-909e-70efa4f80903", "value": "Omni.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cec2bb-d1fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764954730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954730, "uuid": "a749a08d-ba2c-4663-aed2-0f73adb03297", "comment": "Malware payload (Mirai)", "value": "397fc15607929046974259b784326677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954730, "uuid": "8861bee8-aa78-4eff-a7e3-fd9d47a84033", "comment": "Malware payload (Mirai)", "value": "b9e7d4f2be1e68f3c47dac1d59edef69ce21ac3af8a27c0b8d3b3310a0024727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954730, "uuid": "751d7eb0-5ebc-4f95-9182-f71b65a3ba79", "comment": "Malware payload (Mirai)", "value": "ca98d7f0b9e2a1b4d208b2d9a297ebf7e67ea76d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954730, "uuid": "a0c4c01c-f956-4b43-a367-57d463b83690", "comment": "Malware payload (Mirai)", "value": "a0f7b2d78ce22b0b7f9060f961d09237c7906e4aaf82e2cdc6be7d1582550f9443aeb8d73c302c8da906c30fe75f0222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954730, "uuid": "cfebf6ac-2f88-448d-b32f-88ac87d620f7", "value": "T16D9302480B92143AED02D1B21BB78E717AE00F7CA743E806397A5E956E5C0DB7C42777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954730, "uuid": "c2286bc9-0425-4595-b36a-ee77e0e5b7a1", "value": "1536:JrIyS3LrnhTmuNEclnmJIFRqNGFY9ANX2kGVIC7ySEE/C7j9ztVgaVETVJuV:JMyGLrnhTmuqc9mJAEN+7ETEE/ClwaVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764954730, "uuid": "14460c24-9e45-4b22-9684-ae3497a756e4", "value": 88968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764954730, "uuid": "91cdc613-d01e-42d5-8cd4-1b38a05ff8fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954730, "uuid": "b60c5c21-a0ab-4132-81ce-335f0785d15a", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a206c73e-d1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764945752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945752, "uuid": "e949cb19-125f-4f31-adeb-05ee426f5795", "comment": "Malware payload (Mirai)", "value": "452de03f3d49e83fe1014bbc212d6134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945752, "uuid": "5e591840-e171-4718-a969-9c9a7cd4e0b4", "comment": "Malware payload (Mirai)", "value": "ba79c7a30338ac4a106f3a1d6be8d9b25cd405a2f8b54f5e201855234c2fb9c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945752, "uuid": "de456e3b-967b-40ef-8fc2-e7282a2fa65c", "comment": "Malware payload (Mirai)", "value": "c81af728cd11e9a5b1e804b5ba63cb937ab79ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945752, "uuid": "8db33728-ea9a-4ca5-816c-b514efa0e318", "comment": "Malware payload (Mirai)", "value": "58062b937ba801c6923027a18df63585e6d1533529101281a167d2f7f09d75e6f7e9fb8f49d92d708aadb8a4189c3872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945752, "uuid": "f9e7e60f-7a24-49c1-99e8-799a2ad8b03c", "value": "T1F4B32A4AFC80AB01D5D525BAFE5E118E33530BBCE3EA71119D145B2163CBA5B0F7BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945752, "uuid": "96930146-6165-4990-9a7f-79ceb97699f6", "value": "3072:vbo5XppubzB8ygeO95ndSGJbHUdmK9PtcOaJVG8r:vZSygZ95dZJbHUdmKdtcOaLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945752, "uuid": "52e3d0cd-f273-4139-b2c6-89a4fe5a0858", "value": 117632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945752, "uuid": "56fb55df-3484-46ec-9423-cc595d059ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945752, "uuid": "f70d628c-9981-4154-b7de-eff03f7cd852", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c6f2f0-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951830, "uuid": "12f494b1-38ab-450e-8589-49c1f293e3bf", "comment": "Malware payload", "value": "27d0158309644ef372cdcaa965322cb2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951830, "uuid": "9e53c033-1c77-4616-ab41-f03de6152c3d", "comment": "Malware payload", "value": "bab77b5b6fdca36b0cc93dd050e4abe6ba8bc338fe6f8e9a7b71f22cd7be4442", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951830, "uuid": "c9c3980a-0d8f-4236-a8ab-1735353ed5a8", "comment": "Malware payload", "value": "05d1061e3da911df36399be7c69820d1aa92f19f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951830, "uuid": "09b86399-64a6-4c43-91fd-891c3cc401ea", "comment": "Malware payload", "value": "faa2ad78fa1f23f2ced2740485f5052742c4df1a8f455eae95925185d6ac6c4d00a535da70460a8b4df03213dc99d6bf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951830, "uuid": "46d1b326-548d-4fca-a22a-5624de2fae5a", "value": "T1D1732F580ECB89E85A37745C8BEF8D03E3E58813065CC6D4FB9DA6A12F2143CE5E56E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951830, "uuid": "8023f823-6253-46e3-982b-0f7cc78ad03b", "value": "768:DXriBD5SxtpUDXMEAaok6NsNHsn4b4uumMkQBxQzQX01c4mQk/tRzXYhh0tTK0sO:DmSxETgSNHs4Umi+hh0tZs8sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951830, "uuid": "6f7a375a-feb7-4856-b942-def42ed03faf", "value": 77400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951830, "uuid": "bb3bee02-8cc7-4c27-a076-dd66a98ad147", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951830, "uuid": "8a864f89-4ab7-4e36-b8bf-160277391a48", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04923dee-d1c3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764929597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929597, "uuid": "a0295750-1d84-4086-8e8c-cac19a769fbc", "comment": "Malware payload", "value": "176d620b9994bcc604985ddf103c0556", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929597, "uuid": "5a0a8636-9a05-442e-84e9-8e0345a997ef", "comment": "Malware payload", "value": "bacdc57e889593f4a4018f34c140e3fa5f0c547cac5aa9e28f7c82bc9253792a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929597, "uuid": "3aa443f2-17d7-48fe-8311-93bc40562dec", "comment": "Malware payload", "value": "0117c6526c6dca6b59f776d0ceb424ff3ec7e968", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929597, "uuid": "51d57277-b963-4a1f-89d9-3d760ad79d5f", "comment": "Malware payload", "value": "1016b449552831832bdd91ae2cef631f28a8a39759fe2ccef19cfb7a77d78b16de03d2f3e2877033338d5dafa1691a93", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929597, "uuid": "48f13cc4-841a-4282-98b2-e095addf204c", "value": "T13C7333C91ACB44E9AE2779D84AEF5E01F7AA8503151CCDD4FA5DFAA02F1183C91F85E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929597, "uuid": "914b3bc7-4cea-45e3-bf32-2f5385c833e4", "value": "768:kJnr/5ASH54RB5mYZzeE/+CW7v5CP+TjS5fnr/ww/htO0IdFgcfwfBEOac88xTaJ:z3uxZjSVnKg2kOp3kF72QXl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764929597, "uuid": "23bc28de-77ef-49fb-a271-42eeda8ebbee", "value": 76816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764929597, "uuid": "d7c712d0-a847-4888-bea4-6ca7701676e9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929597, "uuid": "fc40820e-1775-41b9-a3f2-bae18903517f", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3e6043-d1b7-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764924456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924456, "uuid": "a3a9dc54-6c99-4352-8290-866a73b6038f", "comment": "Malware payload (GuLoader)", "value": "c453492c4210d4f932fc73e9d16c232b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924456, "uuid": "0383415c-b298-418f-9592-b3ea49c0eef0", "comment": "Malware payload (GuLoader)", "value": "bb009e0d5d8fcb16bfa5bbc284bdcf507ae3383d5d66d6304fc9311087c34082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924456, "uuid": "8a187c18-8ccd-4f6a-9ea2-302c80df982a", "comment": "Malware payload (GuLoader)", "value": "9d48a24d3227ab906b1951b0780d959d76cb428f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924456, "uuid": "244ad479-cf38-496a-8dea-0385d4361dbb", "comment": "Malware payload (GuLoader)", "value": "fdc2aa733e6d37f75a420e2245e3310ef1dbcfccae85ba7f1d3529780e97f263e475a2fa6037fb6f175072a89528f794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924456, "uuid": "27b8fe04-5e57-4bf2-8a02-b7c3fa34921c", "value": "T11505F1FB3A418768C8E207F0D922D3A0D163FDD6D5E5D383165AFE79193248A82C5ED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924456, "uuid": "8e4ba82c-7808-4baf-b28e-a92fc651f7ad", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924456, "uuid": "35db120f-229b-4723-90cb-fd6475ee6d76", "value": "24576:cFA7BZvzIL0vzmtoXpbTlhd3LvB16vgjBLoa:cA9ZvJCqxLvBc0BLoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764924456, "uuid": "8e72a3d8-6fa1-4619-98c2-2ba1d1e800cf", "value": 867936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764924456, "uuid": "b58c2b3a-c228-4a91-851e-da7e6ff32409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924456, "uuid": "4bd08674-ea3a-437d-a021-5adefff41beb", "value": "120548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e734de-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958431, "uuid": "ef70031a-cfd6-439b-b8be-8cd892f4360f", "comment": "Malware payload (Mirai)", "value": "b5d5b6cdf6af90f39ea26a28911bb4ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958431, "uuid": "d17f3163-9dcd-41b5-b5cf-3c2505f99e56", "comment": "Malware payload (Mirai)", "value": "bb2161d2a43c5a27bb3ffe4223573198ca00c3a6b533258e72e81dd24351096b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958431, "uuid": "e8df40fb-761d-49cc-ac3f-f73679ab3127", "comment": "Malware payload (Mirai)", "value": "dc26a77de49d38999b237e7a1d66f859165d4b4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958431, "uuid": "4a13e2aa-e965-4a8a-a607-eb391566a890", "comment": "Malware payload (Mirai)", "value": "763d1a284f150e75586c22d40afe09de6f2fe5ad63f0bb75535a3e8ce501d4d217eb48e2d8886b99ab0a346c59f75197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958431, "uuid": "bbc137f3-2fec-471c-813f-17105a54b326", "value": "T172B2D03C1B111B98DA1EC1BD839D0B603CB81B3491829D8B6206EDD79F9A8B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958431, "uuid": "74e94edb-f7d7-42ff-b79f-dae475fdc7f8", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiXwmdzJgGlzDpH7uNj1JAv:neD8ZSWvZHZbs1row697qohQvg9AizJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958431, "uuid": "c842a9c4-1f6e-44ae-aa46-3e04dc14b0d5", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958431, "uuid": "f9f76d07-9abd-4a09-a8a9-7618523f71b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958431, "uuid": "9e032b72-9301-4c40-b4f8-3f74bf917e99", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b571f680-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951798, "uuid": "0f005ee4-ea60-4317-9af7-67b52fba97c4", "comment": "Malware payload (Mirai)", "value": "35f3fcb752a96c885c85d752b26d8739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951798, "uuid": "ea7b2fad-462d-4844-8dda-7be6a2ef6949", "comment": "Malware payload (Mirai)", "value": "bb3556a97697999245368d1e700ad4563c477c0a5201ca024753dc4c0879cd05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951798, "uuid": "686c9976-822a-4718-85b6-4e9a32ce8cb3", "comment": "Malware payload (Mirai)", "value": "b76f631000588384121bf9b16b4540196eefdcdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951798, "uuid": "6766230b-236f-4915-808f-9eacfe15e4a3", "comment": "Malware payload (Mirai)", "value": "50d2b73ef46825f40fba907d6a0d9706f999068f6349ad479c7da546c0bbc0cd79fa6fee7a8eaedc916fb5d502f0a05c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951798, "uuid": "c9159913-79bd-4ca4-a436-35e82746a9c3", "value": "T1E55423F6603EADB9D1B88C7F20CA4184A9E3F619061528771ED887DAB4971437F22B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951798, "uuid": "63cdf75f-976f-4ebe-b690-b032861a720e", "value": "6144:qTjxDIkt3i8DzbChS8ZHKYFqfJzTnLEMqNJim5ZB:yjxDIkt3i8DP+SqZ0fJwMqNJb5ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951798, "uuid": "05a7d8a5-c4c3-419d-8ddd-0af051304e69", "value": 281304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951798, "uuid": "176c6717-0a10-4d86-a019-82b54913bdf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951798, "uuid": "020daa78-5a21-4971-aab2-7481cf8602d1", "value": "SecuriteInfo.com.Linux.Siggen.9999.17867.17793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038bbbf8-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958371, "uuid": "860cdb04-d090-49c6-819e-b59905f27fac", "comment": "Malware payload (Mirai)", "value": "538b352eb823722ccf7c07862406189e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958371, "uuid": "bd19fa04-3afc-48f7-9ec3-f6a256718b23", "comment": "Malware payload (Mirai)", "value": "bb77093d509b419c6e74ddef82b3fcb36228debf1f01f21a4f55328fab227e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958371, "uuid": "4472f86e-c8a6-4906-a294-25cb811e18ce", "comment": "Malware payload (Mirai)", "value": "d9e1d221f8d54aaedf96204931aa1c75d597f40f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958371, "uuid": "1e93cb5c-aa30-40ac-915b-33d5e349e17d", "comment": "Malware payload (Mirai)", "value": "36700da4bec9b2fed5f6dcf67db7655acdd181e61e60aecc99ddf413e17fa64de4b38b50be0e9fcc2e591d5d7ece8ed5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958371, "uuid": "638381f9-ad3e-44dc-84af-0083c7c3faa7", "value": "T10504C60E9E158F7DF798833847B79E21975837832AE1C546E1BCE7105E6028E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958371, "uuid": "5a29b79d-7629-4163-bc72-dacf301d126d", "value": "3072:X+sDz/eOI+/hXHiT5RtCfD7dUUrMi8hUJwL3zwdgQMwBN2MX8+iDd6NJAs+yvDzU:X+sDz/eOI+/hXH+5RtCfD7dUUrMi8hUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958371, "uuid": "bd701fd6-f3d5-4b5e-88e1-a3b058f3bd21", "value": 176212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958371, "uuid": "b80c3b4d-b8ed-4971-b70c-1b66e302f764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958371, "uuid": "57b8b216-25a7-45d8-83f4-4094d0ba8899", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947765b8-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959044, "uuid": "44f0f991-a076-4a08-96e2-4aa64b2baccb", "comment": "Malware payload (Mirai)", "value": "3e074f3a2b30463f2f21e0868042854e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959044, "uuid": "291d4d3e-8084-46a8-bfa1-d6249a300172", "comment": "Malware payload (Mirai)", "value": "bc5ac19079bd24ee5d31f00cc1d2443ea0ecef91fdf831b85cb7489a42fab024", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959044, "uuid": "6fd83389-09ee-49ec-ba26-8b22ca89e798", "comment": "Malware payload (Mirai)", "value": "ede39de17da66fcdf834d85bc48a2b1815979c75", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959044, "uuid": "a129b125-3b04-489c-ab60-8c9f0de0312d", "comment": "Malware payload (Mirai)", "value": "26a00ce05be4a85372360db01381da411253962ebf41b3373d57e7e907698df54fe59e746a140cf041bba473be77ff0a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959044, "uuid": "ab06037b-3fc9-45b6-bd82-6ccacf994a04", "value": "T12FC04CBD102B6695D111AE116066385AB273CBD771F18B0AD6CC7433F58D520B662E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959044, "uuid": "1c2a01c9-fd89-4eca-87da-6adba51377ea", "value": "3:LxAjtyg/pONBzSa5Ap9lACgxAjtyg/w8NBzSa+ANjapLAv:LA5/MyHgA5/wkPj8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959044, "uuid": "f7e7dc9b-fd94-427c-aaae-e9412a9d7d50", "value": 159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959044, "uuid": "18de4a8a-c470-4b21-8a41-7d7fca214ef1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959044, "uuid": "f3a6d76e-dc8a-4f2a-a848-9a5364ea0ba9", "value": "vnpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685a3758-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958970, "uuid": "76a8aef7-28c9-4a80-84cc-508204601ebd", "comment": "Malware payload (Mirai)", "value": "ae7913cd5f67e9bce6218ad335daf3a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958970, "uuid": "84ddefcc-e0d5-4c93-96c5-255084bc3ab0", "comment": "Malware payload (Mirai)", "value": "bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958970, "uuid": "3dfaaa48-abfb-4dea-96fb-6186503a8e7c", "comment": "Malware payload (Mirai)", "value": "41324fb8c25f64f99fe689d57b55f4002f47c53d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958970, "uuid": "b31a1af9-1f62-490c-b3cf-ba3a26680d70", "comment": "Malware payload (Mirai)", "value": "4cf6a9a20c3c1194a61c18986658118ab99acad7d9b6bdcddd436497969182b69e3694940ef8900f3ec3c1c0fb646cc0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958970, "uuid": "132de608-7797-4edf-909a-964e9d5f128a", "value": "T1E71163AC4572FB02802C0D2DF0BB8455713287DA6CBACA58BDC45939B2C85A4B823F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958970, "uuid": "8f0e3a8f-9735-47e7-bc02-20a770a939be", "value": "12:shdBsghaqsghJ1sgh+6JsghlOBasghn7sghO2TsghwDMsgh51sghcDRWs7:eHr73lYsnf9Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958970, "uuid": "bb5ae06f-677b-4160-a800-bdacfabe0dad", "value": 952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958970, "uuid": "bfe7b616-b535-4fe8-9685-a003034730ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958970, "uuid": "24c12f92-6d26-418d-a8c7-91cef6a9cbaf", "value": "Ffdgsfg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a676b6-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958877, "uuid": "0de4b5a3-977c-4e2c-bce1-aee166a71bf2", "comment": "Malware payload (Mirai)", "value": "a97077432ea2ab564989a4c817794c8f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958877, "uuid": "55fa73bb-1bfb-4571-a6f9-ae5f445cd4f0", "comment": "Malware payload (Mirai)", "value": "bce40b8a0ea30bee0bc0270faf46454f7dec876db188047141a8b0a6b6e8b582", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958877, "uuid": "7301e133-fb43-4af9-b3ea-0629af66e61b", "comment": "Malware payload (Mirai)", "value": "c72450e60de882f279de0493ff67c049a1c7457d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958877, "uuid": "b1f38fb5-f56e-4382-b445-de6979da7aa0", "comment": "Malware payload (Mirai)", "value": "e59abe1dad3f3ae225ff7e065ad9430e24d4bb0f555611e88a14d53d8ada3d1870ec3ebb76c881e637e584fdae94f0b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958877, "uuid": "bf6f95f5-9d87-476a-a6b1-b7e0dc401e16", "value": "T14AF0ECBD0129FF17C50CAF0F7619703FB03297DE56278741AEC6A0AEB14A5517231D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958877, "uuid": "cc48df42-0e83-4311-8f40-d19b201f5c4c", "value": "12:AhAV1uhM41euxh6Xo1mWhlaLBh1S/hSNIT/1Dxhf9o1U:6AUMAPUMlaLB2pSNI1P1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958877, "uuid": "4ea1a745-9913-43d3-be90-de739ffa617c", "value": 588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958877, "uuid": "117f4f12-2e1e-4985-92f3-f3f2e69c7aa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958877, "uuid": "0e01d393-b96f-4d7d-b84b-581e062bd31e", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e1ce06-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958909, "uuid": "d0227390-0398-4137-9401-97bfe1bdd397", "comment": "Malware payload (Mirai)", "value": "4b10f7ae97de7d5dc8aedeba1af0a2f2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958909, "uuid": "d0454635-2701-490d-8e54-4df5cbfc840d", "comment": "Malware payload (Mirai)", "value": "bd1d6736f50b135c4b54b86bfdc143258c1bdfcf11fb533f603e4c2ac4907c64", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958909, "uuid": "9b26eef4-9f2c-44e9-b916-9f1518613da0", "comment": "Malware payload (Mirai)", "value": "c8bfc69f6ac95ece83301d24a8227dbbbbf5b254", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958909, "uuid": "faf9b8fd-0ede-4b3b-8b56-2cb372d690ea", "comment": "Malware payload (Mirai)", "value": "e25af20adf9ee0cbb10205466243387418666ca1a2fe391c0c802632a6d4f17ac1117d8b51ee8b1b71e5b71a00fc1dbe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958909, "uuid": "158eca84-71a2-482b-aa28-a0045774059e", "value": "T106C04CBD102B62D5C510AE156066385DB373CFDBA1F19F0A96C87433F58D531B222E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958909, "uuid": "46489a01-c721-46c0-9413-608b590d90d0", "value": "3:LxAjtyg/w8NBzSa+ANja4jzgxAjtyg/pONBzSa5Ap9Lv:LA5/wkPjtzgA5/MyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958909, "uuid": "bf16a233-52e7-48e6-9874-09c7ba4d6839", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958909, "uuid": "357580ab-c2d8-4df9-a8cd-41775b4c222d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958909, "uuid": "157d60a0-c3ca-49a2-b5cd-d4df9f330c1b", "value": "gpon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7ff888-d1a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764915219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915219, "uuid": "bc2c51b8-adc1-410c-8cbe-e294d6235611", "comment": "Malware payload", "value": "cc052973253e103c17ffa6d585134175", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915219, "uuid": "d2ef40ba-bcff-48ea-8ba7-492e5b097227", "comment": "Malware payload", "value": "bd671879db2d0c7d8924b919cd4ff6f8780eaa440a1ee45f22003373136d8711", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915219, "uuid": "9343f1a4-4f2b-48bc-816a-790aec10b410", "comment": "Malware payload", "value": "6550087acaad58a00c475e15a8500c97e5d8947c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915219, "uuid": "1eb5d890-95ac-4959-a67a-74a78a8f2353", "comment": "Malware payload", "value": "ce105b63b333b92b5188127e7778359c4bd93b2d5197d900fc3fcf6b2f037a83f2920ad6311a32641ad917b9c33d3414", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915219, "uuid": "9d19308c-5f78-437b-a362-0ec5762e8371", "value": "T11673848A0DCB86ED96A7BC5849DF6C02FBE58D1B061CC780BF5E66606F2193C91F49D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915219, "uuid": "16d77403-cf2e-41c0-aedf-cde7c3e0de8e", "value": "768:NPAHbm769SE/AMyyCK5htVdtgl94qIHtV0rAx7gtRnFAPFuPd21b8oGukv76b8Cw:oB7NV17EFFdOOgfotgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915219, "uuid": "3b73148f-57d5-4a99-8fe1-e3af42f2597b", "value": 76640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915219, "uuid": "ba491f1d-242e-47bf-9efe-36ee368ec3d5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915219, "uuid": "95f18af7-5e80-4470-86ad-b47925632712", "value": "1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d5ddd1-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764956010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956010, "uuid": "10db0fb0-7acc-4281-9e68-e497ed3c46cf", "comment": "Malware payload (Mirai)", "value": "a7c14c2485afcc80c78d0da4983ce751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956010, "uuid": "439e49f0-b09d-4007-99a8-a36d965d2031", "comment": "Malware payload (Mirai)", "value": "bdb99e92c4b9bdba55dfbfdca6c388b07d4ae151035e65e525382629fa63dfe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956010, "uuid": "c217a622-24af-414c-a81c-8279fe4305ce", "comment": "Malware payload (Mirai)", "value": "a8bec4b0fd99211bf0a0889615b825664f3e3e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956010, "uuid": "2b55e198-779e-482a-8bf2-9d0d73dcc7b7", "comment": "Malware payload (Mirai)", "value": "fa826248f956422600deb3902abc750bc26b61bb04628033900e74ee49419db7fb861f8a9d0dd9a4fa6a0f14aac6f556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956010, "uuid": "910de897-27e6-4e38-813a-2e7a2234d04a", "value": "T1B2342985FC919E26C6C512B7FA6F028D371A13F9E2EA3102DD251F60378A95F0D3B685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956010, "uuid": "81c3a55a-0b3b-47cf-9a5f-1825229709c7", "value": "6144:2aHfT1nH3bvccqvspdARsk1n4HiAe36P8dD:2kThRMsi4HDkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956010, "uuid": "1b8fff80-e3a1-4567-8ddb-24407be1b102", "value": 248864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956010, "uuid": "c0128638-1d33-43ae-86ad-9c8aab066c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956010, "uuid": "f964c3a7-9cee-41c6-81bd-7678f5445493", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdddde4-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959005, "uuid": "ab3095b2-be7f-46d0-9c1c-6a316393f494", "comment": "Malware payload (Mirai)", "value": "6bd26aeeec8c086eb2e05ad4e5814ecf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959005, "uuid": "2ec08a8b-b150-4a85-886d-a88c6119ec2d", "comment": "Malware payload (Mirai)", "value": "bea4e974f7eec0d4c962a6b3a4c4c5ae1ddf33b5654be219eed3b0317756e347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959005, "uuid": "9895f37b-3c30-4048-9089-19af28b58c13", "comment": "Malware payload (Mirai)", "value": "e2e9c58d7c0fe9d1788c2b17ba3ca7bb309be033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959005, "uuid": "2ab341b6-0ba9-4fb9-8e05-0e55ec7b1b8d", "comment": "Malware payload (Mirai)", "value": "be6c24a7a17866756ee287925e6ec9fa3320f4a2d88f3b5c80515abd56ec84a555c837a757ca53f695dddad255df9366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959005, "uuid": "f83731e2-5d94-4bca-a80e-7e814064a237", "value": "T162338E76C47FADD8C55842F4E8318A746FA7F144C2531EBA1E4589AA8043EBCFA493F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959005, "uuid": "148fff66-0f50-4d55-b5d9-c0c88015b13a", "value": "1536:Aa/wtD4S9WkKpp6rQJyWJUKkYF94C1lu:AIXSVs8EJuKkYF94Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959005, "uuid": "440cafe3-7bc5-44b5-b075-943978442373", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959005, "uuid": "89174a2f-c283-40f4-b8c4-6f7632708312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959005, "uuid": "a4f938db-8b88-408f-a0ca-ecdaa607b29a", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b24c4c-d229-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764973490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973490, "uuid": "b7d4dbc5-1afd-44b9-98ad-0507e9e6e7f1", "comment": "Malware payload", "value": "e2692f87156e9e79d1e3a901e1607f44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973490, "uuid": "4189b8c8-e5b4-4ad8-a5a3-7b9aeeaaa3c1", "comment": "Malware payload", "value": "bfca123b2c2b3ef258e7eb05b4017efc2568064376377d7714a05656f1e11d07", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973490, "uuid": "3c76051e-b033-4050-83b3-7669ebb2508b", "comment": "Malware payload", "value": "761af386ded21cb426fa38c213cb417bd936e242", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973490, "uuid": "c7fe6b08-8395-4547-9bb0-1bf5fc2b8908", "comment": "Malware payload", "value": "08edde708a110fe47daba899b54c39581b74aa841763f122900fc301efbaa62e32b16644ff524915101b69a1f78e8839", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973490, "uuid": "a280807c-32ec-443d-b50a-19f0208cfb15", "value": "T18E111CFFA8049E66D12ACA60BB6BF510B208E74130C07B2485CF6775C2DE9583902FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973490, "uuid": "3e213a16-5094-4413-9559-decef90029a2", "value": "24:erl0qful0qfRl0qfp9l0qfkl0qf/l0qf7Jl0qfKl0qfVl0qrE:erl0Uul0URl0Up9l0Ukl0U/l0U7Jl0UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973490, "uuid": "9cead39c-ae83-4b5d-9da9-f44e79b38a0d", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973490, "uuid": "3f008eea-54c4-4615-9ec7-2a1d82525c70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973490, "uuid": "8b9a73d5-2988-4ffb-a71f-43ace5d6177b", "value": "router.tplink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4c5bf6-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959007, "uuid": "4735119b-35e0-4720-88ed-902dd759e442", "comment": "Malware payload (Mirai)", "value": "354ba405eefc708e44343b6f70511e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959007, "uuid": "668422ce-f290-43be-be70-8ce63117ad4b", "comment": "Malware payload (Mirai)", "value": "c08fd5aca4ce694fef14cf8b824db9e5b32da9b6ab157afaa8144f244f899b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959007, "uuid": "a5ff7328-8c3f-46bf-96a1-27d792663268", "comment": "Malware payload (Mirai)", "value": "8b947ab87b3ddada332b7e2c2c80a4b8bdf406bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959007, "uuid": "d2cd62ad-a1fe-4187-a790-f83806645ea9", "comment": "Malware payload (Mirai)", "value": "77b13084f127d3edc5d541c1a933d80a965a1407f3c81bf191e26d33e90b61dfc5adf1248420fe44f26991f50f8813ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959007, "uuid": "4b835f50-8728-4161-9a53-a40326e95d08", "value": "T187036E01B31D0503F5635EF0393F2BE1E79EAEA021A0E245651E6B8D81B5E336547FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959007, "uuid": "309ceab5-3a49-4d5d-ba24-dbe33b133668", "value": "384:ORUUWTVhTTL/YnhUaZx8moN0x7pp7Khr3kGhrSNMVZUH8H3YTiz60Dc9kfYF3kJq:GUp6EsHS3UyN7PpYQrPPa6T8+pu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959007, "uuid": "ecaea3cc-4480-4712-becd-f846df0c33cd", "value": 39288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959007, "uuid": "784beac4-d23b-48ab-a4d9-5d95ca52b915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959007, "uuid": "a107158c-88d6-4827-af5f-4905e59b3f80", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fba78e-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908551, "uuid": "8326562f-d405-48c2-833f-efa55aaa1b67", "comment": "Malware payload (Mirai)", "value": "dced8c9c989e0cc40fe2ae52f4f9d1a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908551, "uuid": "fbae9603-44b8-418c-9755-6cfc5a242e68", "comment": "Malware payload (Mirai)", "value": "c0ec5a01a9c6c13da84c70a6cf60becb5cff158f305f54187296136ba8ff90fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908551, "uuid": "235c7ae8-fd5b-4ec6-8099-f69776c57e95", "comment": "Malware payload (Mirai)", "value": "e24f674b17d232ec178ea62e8d4c282d7e2869b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908551, "uuid": "fcada861-cec6-40ed-97ec-740ee0328700", "comment": "Malware payload (Mirai)", "value": "e587e44fec305fe0f49c4e092293156b4aa0c7a3779b5039c55370791b220afba3a160ca75101274cc3d24fc43929aa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908551, "uuid": "7332db9e-078d-408a-a2c3-7fcfda0c4c7e", "value": "T1DF23F2247D43486199E0DD37F6E5CEC319FF56F8A2ECA61620B2178C9E88E0574F9242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908551, "uuid": "55915f05-1d62-493b-baa2-c278439849a8", "value": "768:aFeEtqUBOWaBAF5ouUNXNhK0xnxi9q3UELNJ65SVmcf37Jcf5dCxpftuWs/E:aFeMxy+5MK0xnxXL64mcVS5cxJt6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908551, "uuid": "9c97b9cd-998e-4b02-acf2-1f23cd3f31fc", "value": 46508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908551, "uuid": "f012b501-52d5-46a2-a4e5-968db2dd0b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908551, "uuid": "9d00c8de-fe85-4ca4-a4ae-1dedd1a990ce", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708af1cb-d21a-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764967144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967144, "uuid": "6ac5178c-c4d5-463e-96d2-adbebd72ea14", "comment": "Malware payload (QuasarRAT)", "value": "fd162023916bb64e2af5db7e8b5434fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967144, "uuid": "1792d544-2563-4734-bc72-480ab11e761e", "comment": "Malware payload (QuasarRAT)", "value": "c19b9a5c933f2a33d44e1fa3d491832a2f541d1fb7da2b22c6cdb69e919cace3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967144, "uuid": "2b5457a1-aa64-43c4-adbe-2937bd88e3cb", "comment": "Malware payload (QuasarRAT)", "value": "16c9dece4eb201e93c8a0b5d0ad3b3dfa41c402a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967144, "uuid": "e7627249-8ca1-4e0b-82f8-9d8756a0eb50", "comment": "Malware payload (QuasarRAT)", "value": "ad73e3cafdaa0c3d0d97b5581f2ca06ffd7559a66b460fbc458120bef52dca8aa5853f44773eac6e970d0e3f9fa1d665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967144, "uuid": "b7fd8e52-46eb-4af4-b546-dd575d3b32de", "value": "T1CA75F101B3F9820AF1BF5B79B57650980737B602DA3AC78F198C609D1EE7350AD527A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967144, "uuid": "687ab877-0065-410f-8111-616c2ce9e954", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967144, "uuid": "be08ffc5-175a-43a5-be21-9ed7f54291db", "value": "24576:G+6CS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9ETNVHHB9d+S2T:G+607wR2EgKKm77LrwCB6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764967144, "uuid": "3e2b3f28-6235-40ea-9cd9-a1286c862f86", "value": 1652736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764967144, "uuid": "6199bbab-dfee-4d8a-91ee-12fc5318968b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967144, "uuid": "8533cb39-c963-4d40-8991-03e6db584b09", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378db1c0-d201-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1764956311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956311, "uuid": "2c5c962a-5001-4a28-a247-854c3980d4ea", "comment": "Malware payload (ConnectWise)", "value": "5e141b979518437afba86e28b13453c0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956311, "uuid": "6e091159-fde0-44c0-bed3-acccd3288957", "comment": "Malware payload (ConnectWise)", "value": "c19fba32108f9114265522f1873e9f36f9dec679eb43a67c392b296c7973935d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956311, "uuid": "da8a8ff8-9908-4d29-a30b-5b455e2b24fc", "comment": "Malware payload (ConnectWise)", "value": "10f8972dd92d1016e9346b40ed7000430f3dba4d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956311, "uuid": "74e5755d-c13a-4ed9-a46c-375a64560077", "comment": "Malware payload (ConnectWise)", "value": "fde120e67f9b274e4f0d9f1a1c9dcc05cceb48b86a2b33cb03ac43a874c55fff0a5520557d31920fe31c7ae9a2dfc1e3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956311, "uuid": "7a270223-7d89-4d94-8fc6-40868e406e15", "value": "T14721211FEA1BE23139A5A223C3AA5D1DCB48126A57008851BBA87518AB24734DBB91D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956311, "uuid": "e366e99d-f132-4e1f-a005-efe6647308a0", "value": "24:Pb7z/Gc+YDLUd0s3MWK6KJevZROMaARkIIMPTQ/FdW2AwU/G:j/1DL48N6KJevZHREMc/FdW2AXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956311, "uuid": "b18efd3a-9b50-4e05-a83f-76abc2590748", "value": 1210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956311, "uuid": "4c932d91-ba83-4c04-86bd-ce9c9452c7d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956311, "uuid": "a9813d96-6eef-4d07-b988-f880c46d94c8", "value": "invitecard.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca971da-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898284, "uuid": "897b52fe-5c8e-426c-9717-c1c9e2ad15f2", "comment": "Malware payload (Mirai)", "value": "bf4bb2b8e6c311a57eb8296ca9616a7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898284, "uuid": "9af8a6c2-4b69-4a89-a4f6-1b26eefca475", "comment": "Malware payload (Mirai)", "value": "c1d98789de07ff74daf8a14b4e0dddb14156d234443662133ba2b32d7f948b05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898284, "uuid": "ad3811da-15fe-4732-9054-c7ee7e6e8939", "comment": "Malware payload (Mirai)", "value": "6fe76a79cc1260b82f951cb0a7db46411c5ee5d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898284, "uuid": "75515edd-1bdb-4b4f-a079-fe4fac2f332f", "comment": "Malware payload (Mirai)", "value": "c1f0a8275d5500b625871d7f679def69c6161afac79287fb7782cfa39b870350c1d16d14f88b6e13f707923380f4cb3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898284, "uuid": "7b13b4cc-3d73-4e5f-a88c-e0b0d999caca", "value": "T1935309917CC29A6BC6E423BAF5AE518D332063E8D1DB322BCC516B1477C551F0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898284, "uuid": "1b72413c-c1d0-4fcb-b4da-e1ef804d1022", "value": "1536:YdBG3AMkNm3wofDZzNd2TmBzEGILP8nYj2io1+Snu8ubjXE7lUoh+gjrieY:Y+3AMkNm3wobMjMVgU7lNhLj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898284, "uuid": "17917cf4-c697-4ad6-9678-be3c2bfc4cde", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898284, "uuid": "672ae0fa-26da-428c-9ffe-a2c01f3ed571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898284, "uuid": "404a6a7d-460c-4b0f-a6ea-48754bac35e1", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f583d4f2-d1f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951476, "uuid": "46d89724-dade-44b3-94fe-ce2c5792c9d3", "comment": "Malware payload (Mirai)", "value": "b9f4b021c09411f5313b1e480f9fcf60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951476, "uuid": "758c2391-4084-4b73-8176-d318e3a7c1a1", "comment": "Malware payload (Mirai)", "value": "c21f72e3fc6ef22d22a86b45157462c22da0ed3eaeaa126db3a283912d81562e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951476, "uuid": "c78bea75-b358-4da7-aa56-c332151d3d9e", "comment": "Malware payload (Mirai)", "value": "1dd89ad1105839948b2b4ac819dc9790bba7deeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951476, "uuid": "e39f89d9-db83-4da0-a2b5-aeeae74cc6d4", "comment": "Malware payload (Mirai)", "value": "b57c26b2465756f26e30abdc7c9152ef329ca666c3bdf6d8e5c9bc59e767069d5b5eebbf958400a05d08655fc90547b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951476, "uuid": "ccf9559b-08ed-4865-9450-7180e45a48bf", "value": "T11FD33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E5AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951476, "uuid": "f90d051c-6151-477f-94a4-6424e518ccfd", "value": "3072:tGtwnNiaOnUT6FiPT9OSQ7AOaogjV2iZlBWCgaiAXQPdL:tGtwnNiaOnUTAuLyCXQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951476, "uuid": "9023f1f9-df02-4b36-bf74-0a93b04d860d", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951476, "uuid": "945462f8-0da6-4871-b357-f2fa0fbd3f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951476, "uuid": "9c495f87-2760-49ff-909d-640372d611f0", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91076d30-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908787, "uuid": "7bf4b058-bdea-4511-9e47-f65227c5bf0a", "comment": "Malware payload (Mirai)", "value": "8bcbb46438025a6e5382e6251c559dc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908787, "uuid": "84232bfe-1146-4df4-8966-332f36042afd", "comment": "Malware payload (Mirai)", "value": "c22ac7581b24d7ff2e76554a75c1e5fffab559648b6b7cf1b8dc57b36ea70707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908787, "uuid": "3e37576c-6dd7-40fb-926a-080b76d736f4", "comment": "Malware payload (Mirai)", "value": "25347618cce52f6a374ffb5b7bf3f6d448cd0a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908787, "uuid": "717302c1-3ed5-4a58-87ed-4905ff8ab24b", "comment": "Malware payload (Mirai)", "value": "233344012cf5a185cd81201ca2acab24dfa8d44de9cf124fbf2ef5e52cb229b8473eae6c0066c8284646e4e99bdf2c2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908787, "uuid": "337f9974-0d5d-4004-b1bd-358242962c65", "value": "T171A2D0B4C5809F86FBBEBDAA2EC6D99277C28F453329C99121C4C7525A1B935B325CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908787, "uuid": "19f1113b-e1e0-4642-b29d-94228643a356", "value": "384:YHo+rTtBGgpzf7h5fDCp4K7W9hee5VdPTRaWSpzNTDLM4uVcqgw05VxJQ:Yf1BZpz15fa4Kq9EgV5sWKNc4uVcqgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908787, "uuid": "df221a4e-ed63-4c6d-b4f8-addc2c36bbf5", "value": 21840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908787, "uuid": "64caba2b-5ce3-46e7-a29d-3c54884fb1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908787, "uuid": "bbe287d3-99d4-490c-b743-927c5a6a23aa", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d781f1b-d22f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764976185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976185, "uuid": "e22044c7-729d-4d19-a4c5-5b174efed3a4", "comment": "Malware payload", "value": "e194d92456ee495cb16b5e612df4462a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976185, "uuid": "632a70f0-cc9f-400b-b16b-ea46629b8344", "comment": "Malware payload", "value": "c2a1efb65598cfe829302c175c9b096473cdadca0b125ff1142cd67183e47b5d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976185, "uuid": "5d65a72a-fabb-4910-9e11-ed41ede5e92a", "comment": "Malware payload", "value": "016baf6525aaf5927c7824d4b93cef7b2c6f89e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764976185, "uuid": "17722838-6f1b-4af0-a69b-8b9ccf09b383", "comment": "Malware payload", "value": "e90967a32c61e011cfde15e6a59769488f8ff7cd5bb0785abb85e714f1341244d0aee98756e60388b2c41bf495b6306e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976185, "uuid": "374bc7f3-4e05-47e0-a4f2-b53ec89b6501", "value": "T14F11127F2C10AE52A258C744F973F501A644F2A912C43F2DA2DE9B3180F9614B616FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976185, "uuid": "a411992d-ffc8-411c-879d-d4d02cbfc197", "value": "12:78ZPAlYpGwZwAlYpGwZJAlYpGwZp1AlYpGwZXWBAlYpGwZjAlYpGwZ7BAlYpGwZr:ePLwLJLp1LaLjL7BLcLtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764976185, "uuid": "adf4358d-3438-4202-bbe6-f3892db112ba", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764976185, "uuid": "e6a6ca0c-2b15-445a-9276-95b07979e504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764976185, "uuid": "8178ca9d-fb48-4636-8970-14af757f1a87", "value": "router.dlink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229e45f6-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898294, "uuid": "c0ea99d3-300f-4a29-8bfa-c2288031b15d", "comment": "Malware payload (Mirai)", "value": "1cecd5bddc7e8ee7e9e9f9a9c73047f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898294, "uuid": "3b5847f1-82f2-4f90-bd7b-69f337be24a9", "comment": "Malware payload (Mirai)", "value": "c2b6577a08f7aee28c79ee4ecdda564ae1838ebbcd1956609841bdfdb7d80b2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898294, "uuid": "4da47531-1c74-45b4-ae57-b437a443ec98", "comment": "Malware payload (Mirai)", "value": "4985c8e170643fbe204a59dc9e7b9fbbc7c66218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898294, "uuid": "1d29c4a7-4b12-4eaa-bd2f-f3a91a048afe", "comment": "Malware payload (Mirai)", "value": "9551f43a11edca9440f30a38359d712cacdf0e6839c776f7eeab4c8e4e0d27c4cf9176a63c9c0a3202ef12716ecdb591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898294, "uuid": "1f5f9c1c-1a71-4c85-bcc8-00ed9356c372", "value": "T1B4D3F646BF210FF7EC5FCD370AEA1705248C991A22E97B35B530C828F69B25B15E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898294, "uuid": "86e0d261-c5c5-4638-9f94-9767ba30c61f", "value": "1536:QyNqViP5Y6IeeremuWpZ3D9qsinjbOrWJl7xy6GVjZ67MtmSNAtK:QydY66remuWpZz9TijgD6CjzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898294, "uuid": "623d880e-cbe8-4f4a-a3fb-bd2d4b1d3486", "value": 130240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898294, "uuid": "a38d5805-a509-4c02-923f-1f870b4e501c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898294, "uuid": "73c34864-9daa-4841-bbe5-e27e3e213af9", "value": "UnHAnaAW.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60e150e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959074, "uuid": "f342bcb8-dbdd-4951-a595-6aa63c55dc1e", "comment": "Malware payload", "value": "a8ff56ac3c9efd715f3fda4ffe4a8ff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959074, "uuid": "0566431f-9e22-454d-aab0-21054a9a80ea", "comment": "Malware payload", "value": "c2ffb0ae8ab4132e06188ee5b05457553523ba3af5d657316f9691241266935f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959074, "uuid": "e347fad1-f23f-4421-9a21-5b28c555225f", "comment": "Malware payload", "value": "ea1638fef9ca1a2fc5967fe904bef139db92abc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959074, "uuid": "4634e2eb-2aa9-419b-82fa-e4b2daf37d16", "comment": "Malware payload", "value": "b1869f384a5095f9021853266183ba5393ef329577c953e35b8a8381472598490719c467252abe0ade4910e8562c8a2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959074, "uuid": "bd16bd50-bdc7-4822-8861-724fb6701707", "value": "T1AC438DC6A440DE7CFC4BE37FC8524A05F865331561830F3796AAFDA31D721994C6AD8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959074, "uuid": "4dc6af48-efb3-45bb-8ac7-303dc779a92e", "value": "1536:GigY+F3HPeEERTew8BYM8uPqR8tfGV1o8p/:GigYQeEGew86wqqGL1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959074, "uuid": "1aa14a23-e00e-4350-b6ae-1e1b2f8895bf", "value": 59948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959074, "uuid": "26424496-7fe8-4a59-80ce-a537897b6557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959074, "uuid": "8a54098a-4a43-406b-90a3-b701fcca99f2", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7745e23-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958351, "uuid": "e6b8de9c-e9cf-47e8-9dba-702597cd65ab", "comment": "Malware payload (Gafgyt)", "value": "2140ecf12d97a95583960f96cf65d1ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958351, "uuid": "f7d839cc-a006-4943-8d0a-7a73c0c0e6a4", "comment": "Malware payload (Gafgyt)", "value": "c3865910ddd700b630e215b4db48c37b5ee78222b30dfe4e4c4b1a194e105046", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958351, "uuid": "7e0e70ec-3367-49c4-916a-b6d35e507372", "comment": "Malware payload (Gafgyt)", "value": "e22e9051a2ecd3183330900d3afa9c27386933a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958351, "uuid": "c00bff37-c217-4582-8ac3-0c73449730e8", "comment": "Malware payload (Gafgyt)", "value": "bf423acc23501fa564bb26d0c54b67db3f14a2d3464b4c142198d4eed1387902d31189f948bc01df4aadf2e7e8234ef3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958351, "uuid": "cfddd606-ff5c-497c-8db2-e13eb2623bfc", "value": "T17711978E2214764A0019CF45356A4694B6F5EAD4F4B88E5BDCC478BBD884B07A17CFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958351, "uuid": "81734bfc-8ed6-4589-8c2a-6ef08a0075a9", "value": "24:6pE5AeEcbMNIZEtqsEVKTZFEHMcEOtiSsa3E3eMS2EKPPzEz6xE19GmEkrxn:60AobQqDQZcMEtiSsaEezePPU6E44rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958351, "uuid": "8c1de937-3b5f-45db-98e3-a19c8afc621a", "value": 1093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958351, "uuid": "439482bc-28f5-4d93-83a4-67ad4ec9e09a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958351, "uuid": "cf0e0694-b388-43d6-81bc-ddd28be980f5", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9d74a3-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958363, "uuid": "260974ba-67bf-4890-9ca0-1111e28ee68c", "comment": "Malware payload (Mirai)", "value": "994f113a746d25015eb2d7b5d7218f3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958363, "uuid": "29bf93de-80fa-49d8-a057-2443b7bb374b", "comment": "Malware payload (Mirai)", "value": "c3873944370e50a3421c79d2be16be1b12f2344febb2975e62f9ba7ea6046d02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958363, "uuid": "98e5e7a9-6afa-45cd-a32f-2a2ca8ef6ab7", "comment": "Malware payload (Mirai)", "value": "40f99aed8ad0c1c99edd309787ea3dd704d7268c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958363, "uuid": "7cb6799b-5ec3-4fb7-a54e-4998ece7eb14", "comment": "Malware payload (Mirai)", "value": "5bbaa14883214f0c8b89969d6211354e211c52ed79160092dbcc7bd2b1e95674aa863aeb79c82d4bfa37d55f877d2391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958363, "uuid": "9ee42c50-4de3-4304-ab3d-7009455db38e", "value": "T1B74317C49543D8F9DC050A36157AEB725EB2E17A5118EBC7D7AAE932BC43B01F60728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958363, "uuid": "a6a45052-1e7e-434e-9f9b-d180de0cb070", "value": "1536:QI1fa/slh1Ek5SAhuXH1AgndZqEiqQnrAK/oTgbRR:QIxcslh1n5oXH1AgnDtiTrAkeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958363, "uuid": "93268716-efeb-4574-9d3a-15d66b9150ad", "value": 58240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958363, "uuid": "7b64e380-56e3-4461-9428-81ca41952c25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958363, "uuid": "0d438631-4962-40ab-90c9-30f76c592016", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4c5650-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959057, "uuid": "40c919f8-cc38-40a6-b2fe-ddc3811c6976", "comment": "Malware payload", "value": "41952904f81bd780beaad7945e7471b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959057, "uuid": "f1397b15-bcce-49f8-9ad5-0cd32d1296f3", "comment": "Malware payload", "value": "c3d40b304f7d55a1ca63ac2115201ae7e25d4a548c2c3efea0ac699ea0c0f911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959057, "uuid": "60fb371b-e3bf-4006-9e85-db97a49e7ca8", "comment": "Malware payload", "value": "ffbc93ae5d133986f9048b7a599fce333421b5ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959057, "uuid": "12e27d84-4477-4465-b071-9885a7a1a25e", "comment": "Malware payload", "value": "ab5d916a20d2b8dff9eaa06a00bc142fb53c1d79973d1383be05c7918cfe49c63f8a8352cf3a93adbb4d0a546d8d0ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959057, "uuid": "7b7bc474-9732-4f8a-90ba-c66ae3f6fb2c", "value": "T18D531745BC919A16C6E422BBFA6F41CD332623A8E1EF3217DC215F15778A82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959057, "uuid": "30f9dbd3-470a-4279-bc39-f25939ca63a9", "value": "1536:o5Gw+VS+PeqYz7aI1HYuAvfc91fguIMtu:o5Gw+DI14uAvK1OMtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959057, "uuid": "b4ace333-72df-4db5-9e30-3bb745934ae5", "value": 61352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959057, "uuid": "f46b3f7d-cdda-4724-8c3a-84d7b35efa6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959057, "uuid": "38c873c2-0884-4c73-ad7f-9186e8d9874b", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2553c1d-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959497, "uuid": "14baa902-7233-4710-a02d-98f1e367185d", "comment": "Malware payload (Mirai)", "value": "f56e9e94a6589d2bdc12f7b006b51d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959497, "uuid": "6c5bd09e-c1dd-4726-918d-8cc9b076d528", "comment": "Malware payload (Mirai)", "value": "c4c4aa71151afa0d88067ece5e516bfb234bcc58a6cb99bbb8dc919a963eb749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959497, "uuid": "ce5610d2-0de1-4b1d-bcf7-82e8ea651044", "comment": "Malware payload (Mirai)", "value": "bd5b828c072456c4320b980df1990d34f0461f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959497, "uuid": "8afe653b-24a8-4cef-9871-7105d69f0165", "comment": "Malware payload (Mirai)", "value": "df150c784ba83f84244bd65ce67796ed64f66dc567a89db674bfb2e9bd2c2309de1fad49ee45e7678446f22095d15cca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959497, "uuid": "1069f9c6-74b0-4e60-9083-a646be7bc238", "value": "T149B3D71A7A668FBCF64E823947F78A31465527D52BF2C084D25CEF102E213CA6C5FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959497, "uuid": "d229cf44-7dab-4fb0-8670-783322631745", "value": "3072:+BfxvIbpC/JZybKqLMoflN7weJQ2XUXnk0qNd:+BfxvIbpCBZpYMClNRRcEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959497, "uuid": "d5877c95-23a4-4740-a9a8-460ea38134c6", "value": 112759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959497, "uuid": "2130ee4b-603b-4bac-9b0b-8f093f7d4d00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959497, "uuid": "60a4df97-5760-4aa0-8fce-fc8c5b975dcd", "value": "Omni.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bee6bb8-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958466, "uuid": "7c767cc7-b3ed-4a30-8281-eba75f204efe", "comment": "Malware payload (Mirai)", "value": "db649738dfa5acbc4d22fb7cadab87aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958466, "uuid": "97fd6fd4-9047-49cf-bef1-37ebb6453930", "comment": "Malware payload (Mirai)", "value": "c4c6c4b9b47d227d42c3dbb04955d4eaeafa9eeab8b6afa7b7446ccb9f26398b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958466, "uuid": "de5bf3db-e47f-433c-869a-c6b8ae041cb4", "comment": "Malware payload (Mirai)", "value": "837dee377954af3afbdb33af923de3816a59c49e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958466, "uuid": "c43c3f9e-032f-4df4-a959-4d22f311c91e", "comment": "Malware payload (Mirai)", "value": "a7f26164955e9c693a3c7602ac745076b23cbae223d5de00695e168b646c6e64f5709f0dbc77bf8c3bdf117dad62463d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958466, "uuid": "b8266171-a93e-4d29-baa2-698a7976a459", "value": "T1EC2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958466, "uuid": "aaab5ea7-de52-4c2d-9902-51657d669737", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iOe:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958466, "uuid": "52634e44-73ab-4909-84fa-80909b9b204f", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958466, "uuid": "eb5e0b6d-2a7c-4f19-8333-af98a790ab30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958466, "uuid": "5907c17f-cba6-454b-bb6c-07de6f9ff6a8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209545c0-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1764958850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958850, "uuid": "5e7448fd-62c0-4513-80a7-4e00671c233d", "comment": "Malware payload (NetSupport)", "value": "e7f7c65baf68f6118c82b8dce0e39012", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958850, "uuid": "34668afc-118a-4c5f-82b2-38372542ca80", "comment": "Malware payload (NetSupport)", "value": "c4dfadb320db6460a84425bac94b45b6742ca0e4389755548513723bf8a23cf0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958850, "uuid": "a8f5f642-4ac3-4aa7-9c38-ca0aed61257e", "comment": "Malware payload (NetSupport)", "value": "b061ecad874193d944950f235836fc4222ea0a84", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958850, "uuid": "7215abf6-3645-4107-9623-e4e87e6f1c8d", "comment": "Malware payload (NetSupport)", "value": "69de38b0c7d7efa81ef2a52b5f197c172738e1875b7bae113dbe2f0f9ec32f0948e50c16ae194ed2c60d77e17e3eb452", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958850, "uuid": "f71dc1ca-c82d-4e1c-ae37-16bef96f18fa", "value": "T177D43BEC31ADB6265EE342F5106F1507B2782823580C8860F121EDBD37B999951BBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958850, "uuid": "19b9111d-88ef-4edf-9815-1d71f186def3", "value": "6144:T69o4f0ENXYoBTwiZ+N30pzozzGql4erLnQEsDFx6FuPuuNp1m8LcgigN2kI/:mZfxNXa930pzoZlzo7IFudN+9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958850, "uuid": "e8af8a51-31fd-4d70-b8c5-9a4f010f484e", "value": 612300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958850, "uuid": "8e51637e-6398-457c-9875-c76704255d48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958850, "uuid": "fb38751a-baa2-49b6-9013-869069247ed7", "value": "trr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ee40a7-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959067, "uuid": "53143466-f37a-4759-bf73-e75243d086ec", "comment": "Malware payload (Mirai)", "value": "7a8f21090753ec007c08497d12d604ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959067, "uuid": "9a02ae0a-c165-4036-b1c0-6906d27de1bc", "comment": "Malware payload (Mirai)", "value": "c5621a45d187a906281a2aa2bcd515cddb17f5f671e0f7020c0e68eaf4f1277f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959067, "uuid": "da244ff5-f5ca-4101-bc76-f8b9fc9f5e8d", "comment": "Malware payload (Mirai)", "value": "046368b3a74ebc6d9148fb4f5b0af1dc6943200f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959067, "uuid": "7a17246c-49a8-4e48-ad85-11c37d2cc304", "comment": "Malware payload (Mirai)", "value": "b8f6ceade808bd666d708e8bdf37215fe02f58825db4f478f4cc1bfd05247d28026e172702cbf6c536623b13305620e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959067, "uuid": "550cc9fb-dc36-4f7a-9fee-7f6b5b2f3eba", "value": "T11701DE79001EFF27C54C5E1EBE29B47BB03163AE80278B846DC464BDB48C563A232D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959067, "uuid": "0eae8073-544a-4e5d-a537-89c870aa0497", "value": "12:/hAJQDemyhMc+HXhooQWhlaLBlyKhSNIT5DXhfRz:pAJQDCMVxpQMlaLBlyYSNIVDRZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959067, "uuid": "6f1c1a71-0cfe-40aa-8904-e78d908ca994", "value": 681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959067, "uuid": "cd3d9d4a-f34e-4ef8-88ec-e9d40fc4f3cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959067, "uuid": "50402ce0-4a24-49ec-aa0e-a00b3e3f54e1", "value": "buf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1627d949-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909011, "uuid": "d67497b5-645a-4101-b44d-767620ad2e86", "comment": "Malware payload (Mirai)", "value": "e655478d5ef016c0c61fba2deaf5bdab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909011, "uuid": "fe9335af-89a8-428e-a4c6-b5eee91bad2b", "comment": "Malware payload (Mirai)", "value": "c5685803fe668f58fe9b9493cb46497e51e6a8a4dd1658eacffd7ef7542d2a2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909011, "uuid": "98b472b9-0365-4fc9-8d31-2d587dd3fa89", "comment": "Malware payload (Mirai)", "value": "a2da8677bf7225248859674ccefd8217a832a2de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909011, "uuid": "f507c187-c1ef-47e5-bf16-877be1099537", "comment": "Malware payload (Mirai)", "value": "f94a2c455c2cd59c51a9f2bec58a5a83db0830db54c2bd1c2af4f680fb038858be55c7d0340f4732de76c0826cda0496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909011, "uuid": "c4d407c8-fcd8-4134-990c-46882ced2bfd", "value": "T18F539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909011, "uuid": "51c94e71-5eec-4a93-a482-244f8b4038cd", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909011, "uuid": "6bdb75b1-db12-4b2f-b81c-22d7d1a11db5", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909011, "uuid": "cb13d319-3227-4cba-a512-4718ebc847d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909011, "uuid": "2fcfc416-d6de-49f6-b64e-45c52a60cb57", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d66bb0-d196-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764910399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910399, "uuid": "4f1021a2-e753-4232-8fba-f75b3c420e45", "comment": "Malware payload", "value": "58edbb61040d8d1731a34e73cf582f4f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910399, "uuid": "42471abd-53b9-4402-b34d-c4e5f1a7505c", "comment": "Malware payload", "value": "c667d1496ad2e52b63c8e5c24784ab4dba676c08fb105811d8611f9b29f228de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910399, "uuid": "8a20e512-059d-43ec-aa58-2c87afb29526", "comment": "Malware payload", "value": "c9b8a7a4a610695b9e704c6bea7dc84fb422a275", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910399, "uuid": "f23c5560-9d7b-4512-8df8-92737cd87352", "comment": "Malware payload", "value": "8c4899b40c251604a9a9f4b268da7a6281c9613fe3ee8a858c2da3749da493f299e23db2e3b70c079b421972aaf06f19", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910399, "uuid": "e456a965-4c68-4709-8709-a2ba0035bd1b", "value": "T110B66C8ABD964865CA6EF1349060631177357C1943713BE76FE91AAA0C3ABC4273FF18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910399, "uuid": "f731599d-e1d0-4651-9db7-3e76018101ab", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910399, "uuid": "67d42404-c673-4a16-afb1-e4f60328d474", "value": "98304:ItsQL3LGXfcC8IywJ3LlbtwUrZUTHWIa0Y39QJXDMyTmYe:SsiSXfccJ5twfTHvar3KPm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764910399, "uuid": "f55472a6-fdf9-41a8-9b22-70004e1c7779", "value": 10440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764910399, "uuid": "cb1e7e94-3d33-42cf-8f9e-eef926d02a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910399, "uuid": "4b1cfd06-6a44-4f8b-8693-5f8a1c766fc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cbec3c1-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764958038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958038, "uuid": "5adc2554-7e78-49d9-83a6-9ae8d29c90ba", "comment": "Malware payload (AsyncRAT)", "value": "91ffa5e56370e0993ed52eb3f41bad5c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958038, "uuid": "6a4fa129-0c29-4042-9e75-2ba4e28fdc2d", "comment": "Malware payload (AsyncRAT)", "value": "c6abe591d14e71895799775f7e2fe0f963e653eb6ad7277e1e621cd6a16f4304", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958038, "uuid": "93418e0c-93cd-4fd2-9580-2a6931c3ceb9", "comment": "Malware payload (AsyncRAT)", "value": "bb2edd18627661bb8f71a91d0b2307e2c5b93421", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958038, "uuid": "453e737f-3e1b-4416-9a81-123c46eae080", "comment": "Malware payload (AsyncRAT)", "value": "5fe3d286d523840e4831f5ebc2710c740d44142e7bab64180ab170e6e2556aa29a47267a0c5a3d154c36ed795056051f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958038, "uuid": "c924d359-0bb4-48f2-ba51-e8857df9a128", "value": "T18E235D0037E8C136F6BD8BB5A9F296058276D2576903C65D6CC824EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958038, "uuid": "55ebafbf-7191-4253-8bfe-5bc1ab2a673d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958038, "uuid": "aec89708-ffd0-4f5b-a7ed-eb894d317476", "value": "768:dOEuILWCKi+DinObi/bYbogeV4BdHjMz/vEgK/J9lZVc6KN:dOtmnt0b/9tmnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958038, "uuid": "1f59a777-2599-4369-9cda-895cce621ba9", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958038, "uuid": "845e4a14-cfcd-48b5-8fbe-23a343e445cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958038, "uuid": "5bf3d7aa-80eb-4065-b44b-22cdadd2b742", "value": "91ffa5e56370e0993ed52eb3f41bad5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81253b24-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959012, "uuid": "4bd30b4e-381a-4f0e-9479-44d78b86c19c", "comment": "Malware payload", "value": "81dc9927de2be6befd215db449e853ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959012, "uuid": "e6cbe88f-a709-4932-92fe-4bb2261b31d8", "comment": "Malware payload", "value": "c6eda4a047d49fb36eb6b7fd4b9dc7e44c490f8d09709a8fe5c3cebe7a3ffbdd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959012, "uuid": "de6af1a3-1cdc-42f2-95aa-a4a0ca363973", "comment": "Malware payload", "value": "353b2166ec77230e6db53622e0e8da8cb8554d9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959012, "uuid": "925aab43-c8f0-4d0a-86f1-cd48004db106", "comment": "Malware payload", "value": "46057b66564ed3fdc1edf2e442741243264e698f3ca157f1d9582deeceefcdab8eb34cd81e733149d8f6d70bf090a1c2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959012, "uuid": "49ee5042-9727-4161-8eda-72b31de36e6f", "value": "T1C511667D018AB9948848D53AB291811CB0A34FDF557FCBA02E55117E31F06FE7133E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959012, "uuid": "8c040b80-f35a-4d93-b66e-b7f82057f872", "value": "24:kFUWaFl5fWaF6WaFhWaFA9WaFdWaFYWaFvWaFrWaFKWaFAdWs:kiWafhWawWaPWauWaPWayWadWaRWaMW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959012, "uuid": "7655be2d-07aa-4e4c-b38a-65d5625f882f", "value": 1083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959012, "uuid": "0de8732c-502e-44b5-9b16-c5853d48507e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959012, "uuid": "1964a959-f44c-4693-a6d5-e658e79b48fd", "value": "bork", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1e5c2e-d1a7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764917964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917964, "uuid": "300d4b9e-f2dd-450f-9601-bae858b3a917", "comment": "Malware payload (Mirai)", "value": "de4b77325e1cf4b3f64455eb6084db99", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917964, "uuid": "b24a48e7-27c0-46f2-92eb-71483ab088cf", "comment": "Malware payload (Mirai)", "value": "c7515b8c7c0e30288a7100ecdb59012dd2b7f50907c168559d604dfb5bc42e56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917964, "uuid": "56c236a0-326e-4849-9874-9867b12454b7", "comment": "Malware payload (Mirai)", "value": "57c888c6cfe3215546543afb572b36c8f018313f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917964, "uuid": "76094e76-1810-4e7e-ac5a-f5b58271a385", "comment": "Malware payload (Mirai)", "value": "2221b8ca96c888cd494965e1f77ef19a101adf0f6b7663bf80b9d8224266fd85293bfee050a83b6541ab47f900d1ccbd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917964, "uuid": "0546d872-1cf4-4a24-8f95-adc80549f89c", "value": "T1BD11FE9E3460A9D09158DA14B87AF9106248828166D4BF39E9DF1B39C0FF70C7E02FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917964, "uuid": "08664770-0e05-4ff6-b792-37295e7ae394", "value": "12:78Z+nEZ5nEZAnEZpUnEZXW4nEZqnEZ74nEZ7BnEZ7w1j:e+S5SASpUSTSqS74StSM1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917964, "uuid": "0c123109-60e8-4829-99b4-d00b57c22205", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917964, "uuid": "06235c5a-d63b-457b-97a5-e7e6882f5d2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917964, "uuid": "74aef941-46b8-46c9-b6fe-45c3305409ae", "value": "dvr.tbk-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e188260-d20d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764961422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961422, "uuid": "5523b8ad-3d71-4039-a6a7-b6c1b315e8cc", "comment": "Malware payload (Mirai)", "value": "c6be7cc8d1fdd2c49754057e73fabfda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961422, "uuid": "64d1d676-49be-4b8f-90a3-3c385a28d776", "comment": "Malware payload (Mirai)", "value": "c75f8cc9f894c7fee5743a4c820e2779e30ccf5d7275b8ac0ed48bdea4aa3d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961422, "uuid": "79c62fe6-51b3-46dd-9f96-ce9a8fd591da", "comment": "Malware payload (Mirai)", "value": "5d2915b4ef744bd1e22b673305aa902ba52a6a0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764961422, "uuid": "78a5daf5-a91c-4680-bc56-9907dac7325b", "comment": "Malware payload (Mirai)", "value": "3e7abd7fe470d3e18d4b3f84fcda48d4941eb9d62115d522cff4ef34111dac69666ff9bf28b4b4af06b6ae856c94cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961422, "uuid": "df44f30f-ae0d-4c9c-aba4-7cdc4f2638f0", "value": "T18373023197E52F06E23C58FA0DBD86064E217CF6307782DBDD48A43354D97B86A0F69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961422, "uuid": "fa763014-fa41-424e-9d5e-2a7959806cb9", "value": "1536:PtbUVnN+t2iyuXcfklEnlTYFDzBGLHOsai930Tk0PO38fBX70hthVnouy8GyP:xl3XcslElTYFD4SW93pe0DboutL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764961422, "uuid": "99fdea0f-a9d0-4c83-ab5f-c5c41413a818", "value": 79720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764961422, "uuid": "f29137de-b977-4150-b105-0198cf319fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764961422, "uuid": "dd378b52-3315-4b17-9166-a5ce6540790c", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ca91b7-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958421, "uuid": "f7875ac6-6380-4e3a-b933-7840e55d4334", "comment": "Malware payload (Mirai)", "value": "184bfab946a4a6d81b0de9e6953701fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958421, "uuid": "fd27c847-02c4-4cbc-9981-e76f20023de7", "comment": "Malware payload (Mirai)", "value": "c8735da18015e73dd043cfa5a3d562f425ee4fc58752bc19d87cdee2dec4b5a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958421, "uuid": "40311d0f-8262-4477-917c-7228d07e943b", "comment": "Malware payload (Mirai)", "value": "6e8513a83839144974ec1b48e71dbad9e74cbcc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958421, "uuid": "5b4a7fc6-1361-4f98-aa84-5080daf7a7e2", "comment": "Malware payload (Mirai)", "value": "5f38259fe0e9df07d1a8d39990f270d846316558f006f3fae24fbb7e976b5f3e9ff15c7ee2fbd068cb42886bc44c9a28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958421, "uuid": "2ff6ba12-23db-4b0b-9118-ad5dfe44e8af", "value": "T194336C36E029DED0C6560234A4E88F751F03F1C893536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958421, "uuid": "a21e1ce4-445b-4550-a721-8f47051a9e5a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958421, "uuid": "60f5ba07-9358-46b7-b844-b98608ba174d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958421, "uuid": "243eef20-67a5-4bc2-82b7-126fd052913a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958421, "uuid": "92f22158-8a0d-43fd-a35f-e7a4e9503172", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899d086c-d1cf-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1764934974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934974, "uuid": "86b2dcea-5ccc-48c8-b57c-0b69350a41b9", "comment": "Malware payload (a310Logger)", "value": "8d67638028a66cf778acee0e08b22f40", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934974, "uuid": "89e481d9-5ed0-4450-ad56-a2e3d7d2c989", "comment": "Malware payload (a310Logger)", "value": "c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934974, "uuid": "7c0661ed-83b4-4902-b4b1-3abbf3f55ad5", "comment": "Malware payload (a310Logger)", "value": "21bf5f9a37e4ddadd68ddef8baa83227738f4363", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764934974, "uuid": "3dc79a50-a617-4307-8418-b07d7280c668", "comment": "Malware payload (a310Logger)", "value": "c7881f0b9502c5e637222efc0a40eefcebaf2e3c2ad7f4fef2f867382b9ed854c5746fd36f6dbc54e272d6cd90361cdc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934974, "uuid": "473c6370-4a26-4035-963c-316cc7a76839", "value": "T14555CF027381D062FFAB92334B5AF6115ABC79260123EA1F13981DB9FD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934974, "uuid": "29a4ac96-1317-4354-b5d6-b5824f88d285", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934974, "uuid": "24311d15-ccad-4d6c-b86c-3b0eec803cf6", "value": "24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXda7wWiwW1KQRdwAhVw5u:RPVt/LZeJbInQRa7MRNbwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764934974, "uuid": "69ee7125-f0c5-4d9e-b73f-bfbd1dace13b", "value": 1362944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764934974, "uuid": "8de58334-5e16-4f28-b973-e2d3322dacf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764934974, "uuid": "14fbac6a-5d38-4a16-b02f-f7341ceca231", "value": "proforma Invoice Sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9e1e2b-d205-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958333, "uuid": "e072b25f-fbdb-4c34-b4c0-b2cd0881175c", "comment": "Malware payload", "value": "2bbdd32bb0d3213b32b6514db70c47e9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958333, "uuid": "16cef9ae-5f6b-4b5c-87c6-5674bf4f427c", "comment": "Malware payload", "value": "c9cb689039fbc49bd0182c82357b1d3763606e3c544f801722316f23f443e963", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958333, "uuid": "00b71b0f-7c51-47ea-8423-c74e492124d2", "comment": "Malware payload", "value": "7bdab88b6e4e650efb234afc0f45a408984f401f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958333, "uuid": "7b17face-ac71-459b-9587-036437d86d8c", "comment": "Malware payload", "value": "cd9e4dce386685bef10e487938acf43ac7a0dba9a497094e1eb37eebf55390f2ddabcf1f1d56943d00da530620ef851b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958333, "uuid": "feaf2a3c-0b12-42d0-a6bf-7b209eec1f8f", "value": "T160D502BB98F2A8575A504667EB0F1C1E335B19D03A14D342EA51A0AC6F7B0D38F92737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958333, "uuid": "1e572076-f9da-4cdb-9416-5879a0595d93", "value": "49152:MOc2yD4lTP3uiqK4xH3ng+vUjK9V4stBV8U3dT6ru5mPMkds9p:MoyEFP3RqKCH3jcEnWST6CYP3ds9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958333, "uuid": "f18e6d0c-3e95-4f53-b83e-9941fd5f4bff", "value": 2944882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958333, "uuid": "c5f7b794-778e-4d38-be6d-7b0764b3c4d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958333, "uuid": "381ef2fe-74ec-4c2c-a656-e51689f408df", "value": "INV.76854221.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be56208e-d209-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959973, "uuid": "98cefef5-b5ae-486e-aa6a-75f20241a0d7", "comment": "Malware payload (Mirai)", "value": "aa71821d0aa5c615d703428a5b499a65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959973, "uuid": "153bf6a0-41ef-4cb9-8cd3-e86fb66e7bdc", "comment": "Malware payload (Mirai)", "value": "c9d6d1ce2f1a6776b487ba8560a001b23508c4be4f8869baa52d54f92e0361c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959973, "uuid": "ee051489-2593-41ef-a728-906d398b97b5", "comment": "Malware payload (Mirai)", "value": "083b21cd376f6e078bf92d3eb73ff859ca4d69bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959973, "uuid": "15003fbb-e6e5-4cea-87c3-6c0b9d02fc93", "comment": "Malware payload (Mirai)", "value": "e956d53899684479305e42aa5b693f230d672cc929f3edeb6995f72e16546eace3e156e64602649f3a59c01ec4000711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959973, "uuid": "f2eefcc0-28b8-4305-846d-fa6579e7b81f", "value": "T189E47D637B21DF61E3A5D27005F3C6915AE424A21AE290A6B37CC31C7E2066D2D5FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959973, "uuid": "39987dc6-5db8-45fb-8678-4b3b46d69c6e", "value": "12288:KWQNmbM2AqDwbpW71i41mG5Tie0JRIgpjytv2zSC:wmA2AXE041mGBidJRkvTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959973, "uuid": "b65e7a2d-9a7e-497c-adcf-5ac83dd4b555", "value": 695820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959973, "uuid": "4a48ada1-d936-437d-a9a0-038c386a4ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959973, "uuid": "d28c2254-cd4c-4abd-98fb-bb493f8e705d", "value": "SecuriteInfo.com.ELF.Agent-BQZ.12576689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70689651-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951682, "uuid": "6aedd680-2fa0-41db-9d1a-b36dfc97c23e", "comment": "Malware payload (Mirai)", "value": "1d9dd4d0b20e7b929a60051085d56436", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951682, "uuid": "88330591-4ba0-4b96-8012-6e1484807f70", "comment": "Malware payload (Mirai)", "value": "c9f118f08c550131a1beb11cf64eda4f3690fad059db420d5b3e4ffc8fef0ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951682, "uuid": "c8fa068a-7e80-4a95-81a2-f7eaff67edc3", "comment": "Malware payload (Mirai)", "value": "aef97a30a4f4c0b77863a362898a046665ab754d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951682, "uuid": "e13855a7-c4a7-4fe2-9366-0cf41b6aed0f", "comment": "Malware payload (Mirai)", "value": "5af8dfd9ea49ff3143930469b0dcdffc5da3d70c74f2d229390dcd8baba740c4daff15be04b7782836675b08eee83dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951682, "uuid": "7648f910-2e77-44b6-ac63-847af94d33bd", "value": "T193445A02B72C4947E1D31EF4373F57E1A7AFD98220A0B641395F9A4E8176E370989EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951682, "uuid": "5dc0bf67-f66c-47c8-b5c2-36ec9b52c0ce", "value": "3072:mUfOoVI8fIGcfvxVe4os9iBxPe6oqIzjZHBBstvp6hh1Rr2C:mUfOoVmfDUFxPe6oqIzjlBS9ur2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951682, "uuid": "e44a8af6-94d9-4490-8ec1-1b829130d89a", "value": 253504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951682, "uuid": "9d5881d5-9a97-4bd8-8575-9a1bd57d6129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951682, "uuid": "c0708406-51d8-44dc-bdb6-1d5d1f45e4d2", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfc7d9a-d1df-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764941743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764941743, "uuid": "14ec6562-12f1-416d-ad43-80ecd3c62d31", "comment": "Malware payload (Vidar)", "value": "d2f93855621514f3ba1b29c4489dc380", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764941743, "uuid": "6e36ee01-81fd-4bea-a679-62bfe0f5edd2", "comment": "Malware payload (Vidar)", "value": "cab9b3d1eddba6ca9b7d6fc5a6e929192970c37a8e26cf19d7e2254448d87f51", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764941743, "uuid": "3aab12e7-8ed0-4f96-9abe-84165dae29d4", "comment": "Malware payload (Vidar)", "value": "0011efa8f9de72f62414dbe9a346ac127414350c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764941743, "uuid": "e13defeb-beb9-40aa-a9ae-d1adcd1b9972", "comment": "Malware payload (Vidar)", "value": "89b2e6dbb71731aae2e7b45ef13fa2389a55567be5c7144c464216f5777bf9f5e6517afc3b9b6b18d89da876c4cdd934", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764941743, "uuid": "993599aa-3461-412e-b6bb-e1873647f718", "value": "T1F1A63BB2B9414567C6AFEA34946022507F30BD4D43313AE7BFD806690D2AAC4973FF99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764941743, "uuid": "6db3925e-66a6-4317-b98a-c73d15f244d6", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764941743, "uuid": "b6199367-4bf9-42d5-a4a0-a5164c13694f", "value": "49152:N17QZxe3mVf31jIczClcp5692s6QWQEYYOhROs3j71EDN9a/QleYhjRbbBEK1DAq:voe3GyczQcp569+5DOhROdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764941743, "uuid": "14edcac0-7280-41c8-ba27-63f1dd4e5579", "value": 10108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764941743, "uuid": "32eba128-2390-4905-8116-a6c833939e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764941743, "uuid": "2013be0d-d87b-4a41-a4bf-12afbfa2e1ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d9deb2-d1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1764928881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928881, "uuid": "e6e4c114-f137-4481-b02a-bde52dd062c7", "comment": "Malware payload (GuLoader)", "value": "dbfba4c1c64f1db5c9f6b7be413803ce", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928881, "uuid": "36940168-f467-4bbf-b1d3-5d93799f611e", "comment": "Malware payload (GuLoader)", "value": "caf6f0fd17ffb06e09611427914be8fe4cc2792d106d1ee7ef0daf3585d31e67", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928881, "uuid": "100ad649-afb1-4bdc-a510-d6f384b94542", "comment": "Malware payload (GuLoader)", "value": "385998c99624a0c767580cad7886cfc68570ee36", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928881, "uuid": "7a6d8ffd-0e72-4bbb-b8fb-f3ccabe05e76", "comment": "Malware payload (GuLoader)", "value": "ef5d5b492037d07bdc70ae437f1e8070df50f67febb383874ac23463744a6d08b32e9e9d4edf70a6dec69a38fd88dcd6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928881, "uuid": "562dad41-a63b-452f-b37a-d0e47c32f81b", "value": "T100844C20DE24067A4F471B99FCA90B628AFC8609462650F5F6DE430D71069FCE3FE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928881, "uuid": "3e57d41d-6f0d-4fe1-bb96-509b12a33062", "value": "6144:gu1GlSEfBhWC7sTbTI218jf5oVvKCt/SrX9qFXx/yGeWle0keUw:fWNhWC/IW5qDeNqHaGeW0Vej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764928881, "uuid": "d124f9a8-bc82-4eba-a70a-eff91c1d7588", "value": 399846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764928881, "uuid": "9d93ddcf-097f-4283-97c6-79ac7c4e0a83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928881, "uuid": "6ff84ce0-93f4-408f-b3b6-f599a83c7b52", "value": "rnoviembre_2025_N__minaFinal_30-11-2025_pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fda8db-d1cb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764933327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933327, "uuid": "936a24f0-7508-4fb1-a8cb-b7a7dcc9ae31", "comment": "Malware payload (Mirai)", "value": "f0700cffa6ba30f4123c85fb53e08ea9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933327, "uuid": "ef7d384b-5259-42fe-8b27-53b3689de7a3", "comment": "Malware payload (Mirai)", "value": "cb743de82a12ee0c7947f7c08c8f5ad963662136b1725a2beaac064ae00a670e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933327, "uuid": "69c0eaa0-a878-472d-be27-545cdc8cf05a", "comment": "Malware payload (Mirai)", "value": "593201ff34cbf30b14759e21c1b1a9719ec99bd7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933327, "uuid": "0bc28480-73c3-401f-a513-7103a489fb08", "comment": "Malware payload (Mirai)", "value": "7e694d2db7900cd4e1b4e79d7d95aee5a5624e757858a42c809a4be161a5af757e5faba4b30206d7c1774735c4df1d45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933327, "uuid": "38633921-d277-412b-a3d0-7816576d9ed8", "value": "T14F1142AF250034B49668DF20FC26B211AE66F351D4D17FA657EE6F6274DA4083D02E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933327, "uuid": "49d59721-3484-48ae-9f03-940b4f07d96c", "value": "12:78ZKf7fDcZLf7fDcZEf7fDcZpYf7fDcZXWMf7fDcZmf7fDcZ7Mf7fDcZ7Df7fDcG:eKq7qkqpAqtq+q7MqnqIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933327, "uuid": "8b2924a3-a727-4c19-bb7d-4128564adea6", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933327, "uuid": "d660cea5-9c44-42f6-ba5b-825233840d3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933327, "uuid": "5fa68af5-8652-4d12-ba89-7e0c21c3d896", "value": "router.totolink2-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf43924-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "44e3e0b0-ff40-45ba-b8a7-53471809f09e", "comment": "Malware payload (Mirai)", "value": "61cd1c8351ee1747c8495669e3fd81ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "1ccd80ce-1ada-4be2-8100-885f58a8a1a3", "comment": "Malware payload (Mirai)", "value": "cb9277056e95083b4864c6265df08d7ceda1152b61f8cb65873f48c455c457bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "11a38445-0e0c-49c6-9156-40670779d932", "comment": "Malware payload (Mirai)", "value": "1680081f1e997d0b4fe9628686fbf12edaeb5fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958441, "uuid": "dc67bee0-88c2-4c68-b203-259e13d663d5", "comment": "Malware payload (Mirai)", "value": "bd110467ee3122d4e41b7996c2dbab456d12cb23e87363abb715d43e47aaee11da0de1264820ffd1d16648e10e390250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "07f4d453-2039-4c8b-bd65-ac1b27a91b1e", "value": "T1E5230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "17dfa475-1f8b-4af6-a824-b6423c45c953", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THz:5DmKF7Gxyk8cqoHAmWurAufsG5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958441, "uuid": "5e37c9c8-6ca8-49ce-b89f-0dde63f3c22c", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958441, "uuid": "8f10d8de-9876-44f2-ade0-afe19a4047dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958441, "uuid": "6c6e6b6d-3e9f-46ff-85c8-a9c13ce07b3f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d1e88f-d1a4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1764916635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916635, "uuid": "acdfee12-82a4-4cc4-acc3-fc14b092aa7e", "comment": "Malware payload (Vidar)", "value": "b0b0898ec2f208b5ad04d181c9595830", "object_relation": "md5", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916635, "uuid": "d11434cc-80d8-4ccf-8fd5-9b902390a715", "comment": "Malware payload (Vidar)", "value": "cbab5c167d7ba213a9c1634ce30a2b66a365895d8d0b84ad56297843ad0350a8", "object_relation": "sha256", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916635, "uuid": "9f559e06-33ca-4bcd-be09-88efb519f446", "comment": "Malware payload (Vidar)", "value": "5ea8cf8379a6b845b83a42ce3d6d55fe3a934a8b", "object_relation": "sha1", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764916635, "uuid": "8e4945fe-7acc-4a05-a736-7d51d2a167a2", "comment": "Malware payload (Vidar)", "value": "f272ba1b6fc04f96e74f5982dc7e12ede2c007ca855fb0a2f3ae9fea44bb4ea2af46e80e68193f3511d0ebafc09ae4b0", "object_relation": "sha3-384", "Tag": [ { "name": "49-13-39-101", "colour": "#EDC50E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916635, "uuid": "2ed48298-8163-4448-ac0b-f6b2605d19ac", "value": "T1B7942343E5EDEF10E0A46DBFDE178BEB0BA8D04F8A6D930919109CC7838B956B94F414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916635, "uuid": "3dc41655-de63-47f0-8315-f29e87137cf5", "value": "12288:+3nlghPjslRegrkeL5IWvBzsnJwCRWy+P4kq2DUPO:+3ncjslggrkVWv1smusDUPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764916635, "uuid": "912f786f-561c-4aed-b249-7bc7efe0bfef", "value": 434656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764916635, "uuid": "e44555fb-9f28-4e12-b2bc-174796634bde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764916635, "uuid": "274db1a2-dff7-4f2c-aa92-80dcefad3613", "value": "13462088f316c1cf88b2483ac5c7b096e740e70e059f2b8e6a3d594a2506ff76.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de892476-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917507, "uuid": "6589852b-a710-45de-89e1-b92a68f68283", "comment": "Malware payload", "value": "3a823303dd3a750c65701305a2d2e6a9", "object_relation": "md5", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917507, "uuid": "b82951f8-d3e7-4cec-a9d9-4a2bf540de8f", "comment": "Malware payload", "value": "cc163d8f85d6170d18582da4ab86af2c5f1d7a27dbde86e3ee191fe13fdf5d19", "object_relation": "sha256", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917507, "uuid": "22dcc224-bfef-4d02-9486-7d6f9e42d51f", "comment": "Malware payload", "value": "1ab8a30aefa0ac52298b53618d456a3200aa1505", "object_relation": "sha1", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917507, "uuid": "e627b25e-5c0a-48e0-9ae8-287e9658e2b1", "comment": "Malware payload", "value": "f3d8a5ece41e017a2fa898a37ae0bfcea1fefad6bef19fb8658b95f1e795354f1d439bd846892bc7cb86041e506743fc", "object_relation": "sha3-384", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917507, "uuid": "a311fc7b-acf6-435f-a658-16724d78c1bd", "value": "T188163A07EC9145E5C0AFD23589669252BE71BC485B3023D72F90F7382FB6BD0AAB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917507, "uuid": "534c7ebc-10aa-4ecf-a8d8-36af036676b5", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917507, "uuid": "411e5dfd-9207-4dc9-b3d7-a90652ea50dc", "value": "49152:Ajp0psoGPl0tL1Kf7QplJG6EZnkc56FjS5E7JlqDlYc23:6c8fbxE7y5Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917507, "uuid": "25862007-af1e-40d7-b2bf-eed42bc62ca9", "value": 4271104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917507, "uuid": "45db157c-3ed6-4f74-986c-392f613e5aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917507, "uuid": "30df42e4-538f-43ac-9431-d15b474e6d91", "value": "cc163d8f85d6170d18582da4ab86af2c5f1d7a27dbde86e3ee191fe13fdf5d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d8da45-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958916, "uuid": "ac792366-d9cf-45cf-94c1-d223bb87075d", "comment": "Malware payload", "value": "2e4b6b9e7b6c2a68aad1f31a7fa0e921", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958916, "uuid": "a6c9b58a-7180-43d0-8b11-9524c3c0ee74", "comment": "Malware payload", "value": "cc7801e27465b7cba5bd7cf15cc314c6c6a6e00bb2ea2237279c3f2c98275555", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958916, "uuid": "039ad3d7-e886-486b-9380-a8165a7b2870", "comment": "Malware payload", "value": "2fe5e03b2d304c532aabf730e1d1724fe5778e0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958916, "uuid": "92b650f9-0442-420b-9439-61220db3be21", "comment": "Malware payload", "value": "7da41726d49c6077b69bba2d0b56ead800a4788f6c019566aa8be29a7c0a4b3213ffbb1c5cbf571dee7debab603e71a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958916, "uuid": "c45d4dfd-1132-4df2-94be-ebbb23fa7d1d", "value": "T1F61133BD0D06B9958848D47A7291800CF0E74FDE19BBCF909D45123DB0F45DE7236E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958916, "uuid": "97826491-7f1a-48dc-a430-64a0fe7ad55a", "value": "24:HOFGgHaFl51gHaF4gHaFjgHaFAHgHaFngHaFSgHaFFgHaFZgHaFIgHaFAngHr:uQqafjqaaqalqaUqalqagqanqaTqauqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958916, "uuid": "7efb9e85-f938-4800-89c5-d42403abf5f8", "value": 1060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958916, "uuid": "6dbf7dbc-ea71-446d-aea6-5f4841e00d0a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958916, "uuid": "dc690865-405f-47ab-b228-01c9bc602d15", "value": "cnr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba208dd-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958868, "uuid": "714e664f-839b-4ff1-ae20-ee4d84305634", "comment": "Malware payload (Mirai)", "value": "576056096874b3959d3a35549b409745", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958868, "uuid": "bc2375d6-c49b-4e7f-bef1-fa01dde31093", "comment": "Malware payload (Mirai)", "value": "cd90d0835105d2f3215c592c593a9a7a0e70df9b26bf1e0aface34fa3850f8aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958868, "uuid": "2e22b202-ae66-437a-9df2-b09603ce932e", "comment": "Malware payload (Mirai)", "value": "523352e1906508686d3e8ab2f6d8cefb26c33a3d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958868, "uuid": "c0bf7620-7586-49f6-a3f1-5add886595b7", "comment": "Malware payload (Mirai)", "value": "5f2a3fc6fa68606dcebe1c1d90944a56566b1b0a9b85b45649a5493e571fcbecbae9b999b8b13aeb9b0bf951b6a0f699", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958868, "uuid": "fc633410-498e-4dd3-a4ab-52865192a0cc", "value": "T164C04CBD102B6255C110AE1160653859B673CBD761B18B0A96D87437F58D920B222E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958868, "uuid": "d72ed6ee-a991-48a4-8173-1913779b9535", "value": "3:LxAjtyg/w8NBzSa+ANjaxPQvJRDxAjtyg/pONBzSa5Ap9J6n:LA5/wkPjkADA5/Mym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958868, "uuid": "a097f7da-82f5-4119-a792-7771c1a30ae0", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958868, "uuid": "9a0fe20d-f893-4e3b-ae71-28fce982a343", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958868, "uuid": "5f207dee-79a8-4e2a-a6d9-e74c36a0868c", "value": "f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508cee48-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958930, "uuid": "0fac36ec-9d1e-4a21-9238-f47cbc9ff0a6", "comment": "Malware payload (Mirai)", "value": "1488e7aaa02c98410c55c7d61d466b8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958930, "uuid": "48ea5b74-8a9a-49fd-ab14-7e97c393af66", "comment": "Malware payload (Mirai)", "value": "cdaa2ad368083ce51dc13c4abbecb6fdbf281256376e8af07c2a607f66622ac9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958930, "uuid": "2cf19dca-ceb1-4356-9ac3-09a59a11db5d", "comment": "Malware payload (Mirai)", "value": "b1327b1f9943b78ad380bb0d907f94b3c3394681", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958930, "uuid": "0268eb65-5b72-4a69-962a-5ef74be3c268", "comment": "Malware payload (Mirai)", "value": "763ee8b16d45b664ebe6555acacb2ce83138797e1c377e82f0265aedde67565f171a4d75ea7a234d0660f9bde995904a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958930, "uuid": "69433da9-7924-4013-b90b-ec5480594c1f", "value": "T17DF012B9101BEF078A2C5F1A753DB07FB132CB9E80379F456EC5603EA18C9616132D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958930, "uuid": "02e235fb-baa1-49dc-942a-b5a43196cef7", "value": "12:shAmoxhMjduSxhw/BxhlaLBCRIxhSNITESSxhfNw:eAmoPMj0SPw/BPlaLBCRIPSNIISSPlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958930, "uuid": "57601431-1e6b-4e72-a6b4-93463514a7f1", "value": 648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958930, "uuid": "d3cae77e-9ba2-417d-877d-4f62dd466f60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958930, "uuid": "9c393002-f26f-4f92-8865-12dbc46aa97f", "value": "phi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4495bd-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931007, "uuid": "71b0f028-6b69-4f79-b63e-0cf4ed2b996a", "comment": "Malware payload (Mirai)", "value": "191d84f1d2e2b066ea8081f3451e1aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931007, "uuid": "7ac2de59-cd19-4da4-a6a9-1e85f29c7739", "comment": "Malware payload (Mirai)", "value": "cdc6e8bcd375d2e5cd47a2f972b571f223d369ac3cc18fa6514c55e2ea6ae62b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931007, "uuid": "6d565f49-1eea-4999-9671-0bbe01bb74a4", "comment": "Malware payload (Mirai)", "value": "7de3f42fb0ee6798e9891a3dfbf1eef71a72917f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931007, "uuid": "627cb620-a339-4c2d-ae82-90bb68fa8958", "comment": "Malware payload (Mirai)", "value": "49660529f7a1ab396202172a4c16f37ea7ce93d4152887409630a41bca3bc0c6af769ecfeab090d8824b895463bc4f73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931007, "uuid": "f77fa13d-616f-47fc-a8ab-6ec64c0c347e", "value": "T1A7338DE1B60C7EBED49B3D3DC456169ABE1D9F3499039510C0F2FE071AB32525E23A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931007, "uuid": "f4a687e5-088c-4f45-91a8-7db16cdf14d9", "value": "768:sUM88H+IJA5N/1JQThQcGektiFMvwYzhAVDLYl1s3mgHpTCcMVMIvHYeELa5bMi:sR88eTN/QvDFl2A5L/W7cw3vHYXa5bMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931007, "uuid": "3ee24eae-0fe4-4eb4-a87a-977c9d30e9fb", "value": 50580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931007, "uuid": "b95a422e-aa97-40d3-a96f-9582ebbb1e40", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931007, "uuid": "4139c717-e944-46b1-bd14-195584a48f63", "value": "VRm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88724d16-d1a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764918651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918651, "uuid": "fdfa938d-6f85-474d-9618-27ef6894b214", "comment": "Malware payload", "value": "047ecfaf35b24ec74b523df17a745365", "object_relation": "md5", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918651, "uuid": "0175d17a-530f-433d-9950-cbecb95f5517", "comment": "Malware payload", "value": "ce1be9e4b2fd0f3958720f9bc2ae9d545bc0e27dcf1042b64a70f1fc62884610", "object_relation": "sha256", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918651, "uuid": "17469e32-ef6a-4a9b-a434-8f1c5e59273a", "comment": "Malware payload", "value": "de263d9374d90fb7f51b19a036cb75a3d2072342", "object_relation": "sha1", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918651, "uuid": "f3acba88-9b0d-49a8-b21b-98135c2c9c6b", "comment": "Malware payload", "value": "c5452e0a4d5a21450e7e7365aa55cdc88576dae91d2390c71fb26f7116de1136778e923da85265124dbf8b1d2cd5a65a", "object_relation": "sha3-384", "Tag": [ { "name": "139-99-17-184", "colour": "#9F44CF", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918651, "uuid": "a9e8515b-5652-46b4-acce-5942073da10d", "value": "T1D3520859FB5109E9F7A941B0C8731D0AA27AF59447631BDF0770211A2DB33D0A53DB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918651, "uuid": "69c843de-5fb0-4ad1-81cf-92b193d5e6c9", "value": "6d60d7971376763d433c7202309a1893", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918651, "uuid": "dfdadf53-d366-459b-8622-8c80161e0ec3", "value": "192:gYweXN3iXhhCIebA1eNkta1UGqhZSnhqA79nHL5jQ:tFiRhCNbvNoHhMAA7BVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918651, "uuid": "aa4cce18-00d8-4336-94da-f8fd94798c38", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918651, "uuid": "e94fc297-01e8-433f-ad43-7d3ec7b38502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918651, "uuid": "fdc34d40-49cf-4778-9690-ed2294a5607d", "value": "msimg32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26590e5-d204-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1764957860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957860, "uuid": "cc36a2d7-80e4-479f-826a-aa059e0c9819", "comment": "Malware payload (CoinMiner)", "value": "3c7c13a976e455256254b5921e12aab5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#A82C13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957860, "uuid": "bef90578-cd38-4a82-b091-608af50eb245", "comment": "Malware payload (CoinMiner)", "value": "ce49befb88317c929087b48a7a965f24b56712d8ca19ffffb620fe799806f2cf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#A82C13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957860, "uuid": "e99f851f-80cc-4f5f-a1e4-2ffd28f48a55", "comment": "Malware payload (CoinMiner)", "value": "b65902ac640f18a232f5f4937893a0249eac78f4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#A82C13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957860, "uuid": "382c2145-ea25-4375-a665-76b714d03803", "comment": "Malware payload (CoinMiner)", "value": "ec8e3a53d257e2c1945c385e672902db38b5f27946b3366868689fa3e07f730edfbdd01dc14275b20c083306604e59b0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#A82C13", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957860, "uuid": "4848a7fb-bc98-4178-999c-8c8b87d9d8a1", "value": "T1A3569D14A3E804A5E57BDB34CA55C333CAB07CA25635D24F0598F2421F77EA29B6F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957860, "uuid": "1022c8fe-9d4f-4923-a2d4-b8c5d8a008e2", "value": "2bf99968202715886e40b0b1fbd41b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957860, "uuid": "5c81dab1-cc56-416d-aac0-4f8e50b1e180", "value": "49152:QPB0M19RKZBSGqaTRPucg3MJL4Bo0GsvZmo12e9ZUtLvzls79nYTycs80a549I7m:5t1PuA5cmoF9YTn9Gkuf7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764957860, "uuid": "3602e694-ee30-445b-b009-cdf161dc4fe8", "value": 6172160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764957860, "uuid": "4cd60049-773d-4103-b93b-ecabfedb3926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957860, "uuid": "82b83a12-f408-44fa-9f7e-ec319061c0e0", "value": "download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9245024-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959079, "uuid": "f07f7ee6-db81-49b2-88a0-8cf344f4a249", "comment": "Malware payload", "value": "30b57d7ab62bd6b55f4f05acc95b07ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959079, "uuid": "64b5e457-c891-4570-a902-5897c8b6c903", "comment": "Malware payload", "value": "ce70c8a6816e6170c986800b7932c43802b7f09becc33c3aefcc51e82ff991ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959079, "uuid": "4662bde9-67f4-485d-b444-070ca544690c", "comment": "Malware payload", "value": "d74df68cdf409ae49a26ade01b3c48b141cc1c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959079, "uuid": "fdacb6a1-03b3-402d-b873-71717f61ad5b", "comment": "Malware payload", "value": "7b5279eb8d4289d7502c6794bd1e26187c606c139c6e5b2c83527dbd6a3d7334e71994cbbb914650b63370ff8cde4a4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959079, "uuid": "ec6e4fd9-d448-4515-aae8-e87eddb9122b", "value": "T120233A43721C0A57D4A216B4253F2AF083FFBAA021E4B688A50F6B9A4575E371486FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959079, "uuid": "fc84b3ff-4cfb-4a12-9ce9-bb5e0ba8e306", "value": "768:XOBrMlpq2NmRcSPE9EzSx6L/fr26j61ASG/N5hus:KM7qFvzN/fr3SASGlzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959079, "uuid": "e9cd7f0d-8c49-456e-9bee-9eaea82dad06", "value": 47800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959079, "uuid": "7ef5dfe7-52b8-4f0e-aeb6-a961fb57bb3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959079, "uuid": "e8a15ed8-b910-4a54-a2f5-430ccd3ea351", "value": "zerppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70339e2b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958983, "uuid": "891ac947-8fb9-441e-a11f-d0e813fa2618", "comment": "Malware payload", "value": "98cddfad96a52c260b73bec8c8102fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958983, "uuid": "7493b5e9-31fd-4c17-9697-41d815a5d786", "comment": "Malware payload", "value": "cee59c26008c11584791289f71d9b22556a03ba2569b67a7f8aa22a16c5abce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958983, "uuid": "014f903a-867d-4269-b7ef-986d771e22a2", "comment": "Malware payload", "value": "90728e3c4b969364e84685e875db70db28b30187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958983, "uuid": "91dd0bd9-3292-48ec-b546-513b97c209b6", "comment": "Malware payload", "value": "73ee7805bef4bd9a14ae3e4185b46103f0bda4364173dd5f02090871faae44feeb569a5e5dd6630c1fa9c11f9c2b50bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958983, "uuid": "c5e94c89-e8fd-41de-8af1-8cbfab6624c2", "value": "T1E403864A6E228FEDF76D863047B78E21A354339736E1D684D29CD5006F7064E285F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958983, "uuid": "64e02cf2-110d-4950-9df4-8e68a24d5022", "value": "768:730TklaLI8q3wMdPFwJwLwTaTNcEctxGco/Gbs7Ta6iJ8r+dH6L3VjFoJ5tJgiWr:gfVekC3G7opF81Pin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958983, "uuid": "8a88dd1f-451d-4689-9c3b-399dbd16fd2e", "value": 39212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958983, "uuid": "e353a2c8-abec-4225-9282-fb139da37e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958983, "uuid": "3f9fbaca-c62c-4e6c-8059-a0c589c57344", "value": "plmmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d7d4ea-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958860, "uuid": "1f7ac258-e272-4ed3-bd65-0091f757f8c6", "comment": "Malware payload (Mirai)", "value": "12cae4a5205518f419634f0b8b2f8c64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958860, "uuid": "4fac96fc-dacc-4352-87b0-22c1feb5c390", "comment": "Malware payload (Mirai)", "value": "cf39f3ff37d19d60b7c82bc873a9d47558c95dbf8e3506e2f7129b30dd48a4ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958860, "uuid": "96ee36f5-1432-4ac4-98f7-624c3195a373", "comment": "Malware payload (Mirai)", "value": "b7b802bdfde50990bfeb293d523ffadc08cef772", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958860, "uuid": "1004b110-c1fd-4864-b263-cf3afb1d6912", "comment": "Malware payload (Mirai)", "value": "a63b71bdf5b6103a77ec168b10abd7b4ccae39e2de7af7724384b8eb540fd5d2cd965db795e562a746b0e781b76c95d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958860, "uuid": "71bfb957-617a-43f7-b1c1-e6c0cdaa8970", "value": "T149F01CB9082B7116C910BD21A26F299D7433DF9F6172CF5EE8C6B437A1CC9207836E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958860, "uuid": "120d06cd-0ab4-454e-bfa1-7cc7df172e2d", "value": "12:sha8hexh0k5xhjqAxhU9IKAexhKNIxOixh3+sKGv:ea8heP0k5PjfPU9IyPKNIxJPOsKGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958860, "uuid": "64e6fbea-2abe-41a2-a4b8-f309792e56b9", "value": 471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958860, "uuid": "da589bc1-7ab6-484b-a88b-1f10d999bf45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958860, "uuid": "224158cf-0465-455f-b9fe-380880ba4bca", "value": "kraxe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c789a9f-d1e2-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1764943139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943139, "uuid": "5b1f7585-2dda-4d68-b709-11d3c5330782", "comment": "Malware payload (PhantomStealer)", "value": "809e93bccc31980649987594956852af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943139, "uuid": "7ef7b05e-d58d-47f1-849c-df7b72ec9eb4", "comment": "Malware payload (PhantomStealer)", "value": "cf6272ca1bcc5eef1169612f0e7577fde1557efbd85203f4805ff293609c64d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943139, "uuid": "6887a1bf-0f64-4ca8-9b6a-67ec1cd0cf47", "comment": "Malware payload (PhantomStealer)", "value": "71b72b1c3ce5af0e3c3517d6299a8320e07d392c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943139, "uuid": "50e0c579-eaac-4e8a-890f-4fe9651b7b3c", "comment": "Malware payload (PhantomStealer)", "value": "e928fa10a3cad8a4d63039bcbd6d097ac08edacdea7da31431ffcfabdd6c6ffa215c9d8fd1e9c07f66e1514f60161a2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943139, "uuid": "a13ef2f3-27b9-418a-994a-e8c954cdda5f", "value": "T15575E00273C1C062FFAB95734B6AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943139, "uuid": "ce2f91c7-d37b-4fec-bacf-9776f9cc0792", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943139, "uuid": "0fd8c706-b54b-4ea8-aabc-df86848657e2", "value": "49152:mPVt/LZeJbInQRaoJ3VoeUZxMHRdAvV2ujY:cTYbInQ73Ce7Mgus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943139, "uuid": "8d689b22-0d4b-4fc2-b46e-c355ff7bae66", "value": 1658880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943139, "uuid": "1c55479f-c5a0-48b3-8d1c-340f2bb05314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943139, "uuid": "f0cca387-f78a-4084-8405-bf1d7b651922", "value": "cf6272ca1bcc5eef1169612f0e7577fde1557efbd85203f4805ff293609c64d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d08bda7-d1bc-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1764926793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926793, "uuid": "58dae1f7-eaae-452a-91f1-fc5f71a0031b", "comment": "Malware payload (XWorm)", "value": "3281edcbb8d00e1975f1a3f126d5f2e6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926793, "uuid": "74c8c6cf-f71a-4b3b-9ede-716e47a516c9", "comment": "Malware payload (XWorm)", "value": "cfac9b502db76941ae94781ebf1670b185e933e6cb53af188ad03b83c8cfeace", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926793, "uuid": "a1e4dbbc-942f-4b44-91a6-0dfc36efdeba", "comment": "Malware payload (XWorm)", "value": "2e9bcd4e174caa517542413f55db49dea021e6a4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764926793, "uuid": "cb56113c-9a6f-4bee-ad4d-6a47184a7a13", "comment": "Malware payload (XWorm)", "value": "f7c29b7329a369c748e369be3232f9df7733c66166d4e98cb8d99301e41758e0946359acc3f94c5ec91c0c7ef1b31197", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926793, "uuid": "93237e3a-5b77-4832-aa93-2bd68417cac1", "value": "T1133126036224D5378B2581154E3D993ABD0B85B3701169DEF5235A789DE28DB90EFC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926793, "uuid": "490e740d-2ea6-4276-88f6-ea691b85d1b8", "value": "48:+6XD4PBjyimwjU0jDlrj4Fjcj+jD/jAAjzcDX4Ovug8vA:1IjYw5pCQind3xgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764926793, "uuid": "7d6eea3e-2e49-4d62-8a24-c6d5c22960ec", "value": 1699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764926793, "uuid": "2d90cf9e-551f-4ee8-930d-32ca06ed8911", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764926793, "uuid": "e6b6f2a4-050a-4a8e-85e5-d6cc2f034cb2", "value": "iri.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dc1d5d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958904, "uuid": "9cb096a5-8ab2-46cf-bf7f-082442e1ff45", "comment": "Malware payload (Mirai)", "value": "8bd978d6eb0f4a1d30934b994bf7e6dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958904, "uuid": "46b62c03-b294-494e-a920-557bfc1f1199", "comment": "Malware payload (Mirai)", "value": "cfbe936893a6df9acdda68069b6fab269065afb40d7b5933f862a832fc069c9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958904, "uuid": "dfaf59ac-b1ac-48e3-88af-24558e774d38", "comment": "Malware payload (Mirai)", "value": "fca58dfc7867e21f2bf8657b078e69b9aaae5025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958904, "uuid": "d08fb34d-b5bb-4a5b-a645-ae8d3cf529f7", "comment": "Malware payload (Mirai)", "value": "e0a881dac88da52aa1fa931380091022c49bc2bc6a6874c23999c6911792e18c2664b0924a4282a066a505e04bd2a53a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958904, "uuid": "eb1dc843-14cd-4e5d-b3d9-7283872fde16", "value": "T12173B70A2E26DFADF768C73587B78E31D798339226E1C581D16CE9045E6030E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958904, "uuid": "abbfcdd5-423c-405c-83b6-1ac0fc947836", "value": "1536:ltyeQepXmyxaAo6i8gDScmC5BhFS3k/3ht/33fxZTMkpJTXCuU:Kelpbji8gr5Bh5TJbCuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958904, "uuid": "06c17d81-31bf-4fdd-8186-f1b32ea11b09", "value": 79956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958904, "uuid": "24c5f540-7573-4a26-88a8-31d7c2bec770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958904, "uuid": "35241c35-dce2-4576-8dbd-88a364c4a8b2", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d9fa7f-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958859, "uuid": "d44fcddd-fcd7-40c4-8ba4-a2af8e8bc80a", "comment": "Malware payload", "value": "0d7df27cbaa75798f3b9048d406bc11f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958859, "uuid": "3595e06d-6dc0-4866-9ea0-05b51abe8e85", "comment": "Malware payload", "value": "d0883cc9b70887897675a97343928cfdff5b7671a4c672f61251f31175388083", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958859, "uuid": "5c462ae0-93ea-4026-a6af-38d98e67e231", "comment": "Malware payload", "value": "1a87cb1d859b9505a5d70325d682eadc5871e19b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958859, "uuid": "759711b2-f2ae-487a-8902-2b8076a58f2d", "comment": "Malware payload", "value": "fa37ac16b69f7e052e4af9d88b75dbf7a2c0dd50904826b2079358e3e295fe24f6ea8365427986cd7e5c223f204fb967", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958859, "uuid": "a7e0d509-2deb-4142-b66f-a1c4da37905e", "value": "T1292154BC0A06E995C448D47A72A5841CB0A75BEF59FBCA816D45117EB0F48DEB132E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958859, "uuid": "26ce475b-c2d1-4ef0-85c6-0a2b2043e1fc", "value": "24:kFGgaaFl51gaaF4gaaFjgaaFAHgaaFngaaFSgaaFFgaaFZgaaFIgaaFAngaK:kQzafjzaazalzaUzalzagzanzaTzauza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958859, "uuid": "c2ddcae9-36d2-4a5b-ad05-e81aac1f1119", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958859, "uuid": "cb6117e1-29c1-4542-a3c0-3cdd0fe78e2b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958859, "uuid": "1340f74d-44e7-4731-8c6d-9bc8eed2975c", "value": "thc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebe6d29-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958954, "uuid": "8fabd082-7fda-43f9-83c7-f9b1d6e339d1", "comment": "Malware payload (Mirai)", "value": "182da9d179cdee5793cb4b04a716eee8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958954, "uuid": "4d05d2db-5a59-4cb1-9b59-f6e1f4348601", "comment": "Malware payload (Mirai)", "value": "d0ad3110f8bb7dcc24d9fdf78defa5f7cae50f816c76f6434e31ae72a843a089", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958954, "uuid": "380dce11-97fe-468b-a178-e10797521cd2", "comment": "Malware payload (Mirai)", "value": "406f506489588ec5210f2916e56a08c7d4322943", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958954, "uuid": "4b40f6b7-4c5a-4a0d-847f-0d8d543c3564", "comment": "Malware payload (Mirai)", "value": "c018176eaab6ca1f4b333ceac769bda3f966abf3d2353f2b69f61510dd4f0f0ec5a968a59aa1197b266e14dea68c7b9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958954, "uuid": "74782efc-0d6c-4177-81d3-cf75ad1b055a", "value": "T1DBC08CFD102A6289C0017F10203AB828F233CBC762B08F0ADA8C3027F28C920B222E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958954, "uuid": "223b8696-fb00-4734-866f-aa66afdd888b", "value": "3:LMFtyg/w8NBzSa+ANjaxE6cCgMFtyg/pONBzSabAp9CE:LMFt5/wkPjkEZCgMFt5/MJApwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958954, "uuid": "f13e2670-1fa3-400f-a46b-d9c2fc8be77d", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958954, "uuid": "a81a51fa-a0c6-4e02-988d-51f622f6fb7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958954, "uuid": "e92a8f67-6723-4aad-9dee-fc724eeae6a0", "value": "nlte.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc77ec7-d1ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955734, "uuid": "68b0060a-5abd-4905-9f32-caf981118e7c", "comment": "Malware payload (Mirai)", "value": "03eefef45c1ce88b1f384d950b9c8081", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955734, "uuid": "179ff5df-daf3-4237-92c0-4bba85ecfa5a", "comment": "Malware payload (Mirai)", "value": "d0cc9b2ad499b6d0ee3e7fa9a1772dfe4c90091e12b1fffa4a389b9f06d61775", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955734, "uuid": "2c1bf853-bf2b-4bdb-bb7c-dec6e1d989f2", "comment": "Malware payload (Mirai)", "value": "cd6161acc5ccdd79e77de540f88a1fa39033c9eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955734, "uuid": "5228cec4-f836-4f8c-99a4-78e956b2296b", "comment": "Malware payload (Mirai)", "value": "7d00caa889641fc89448d6de40a29b2f9bef9cf072cf7c1780aa601f3f8d07c8c3c8383314bc90658ebcd7ef58524629", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955734, "uuid": "5995c289-8501-4907-a6d7-3d600dc790fa", "value": "T1B211309F24167410D2E8CB45BC67ED5DEA4CD6C552F43B1AB8CF893380D96883B86E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955734, "uuid": "35b83765-230e-4685-91ab-1c9e039059e1", "value": "12:78ZxxZyxZTxZpXxZXWbxZNxZ7bxZ7qxZ7j0DN:ed0/p7+x7HQuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955734, "uuid": "3795cc3d-4261-48b9-ae34-74784cc0768d", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955734, "uuid": "b805242b-87d3-4f70-abae-a5da205af415", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955734, "uuid": "f188616f-2410-4843-8531-c9035ba97297", "value": "router.epon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aec3a06-d16f-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1764893745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893745, "uuid": "fd97b323-d3f3-43fc-9b1d-8e35787df86b", "comment": "Malware payload (Socks5Systemz)", "value": "acb5d696ce8e8993cf03f458509a3877", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893745, "uuid": "1dd98ac6-2a7b-4bfd-a4d6-c1898facd1bc", "comment": "Malware payload (Socks5Systemz)", "value": "d14845fd99de0d5d0ebbe16626dbb588ae6409a494ba621670f7415f8e1efcb6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893745, "uuid": "b7ee43a4-0959-4369-a4ed-55a4b49c9425", "comment": "Malware payload (Socks5Systemz)", "value": "e70c6e839b69dc793b169be8b92b39d3b1a00a2f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764893745, "uuid": "d5010f2d-c35b-4720-ad18-ceda00b8324b", "comment": "Malware payload (Socks5Systemz)", "value": "e1dde55be81392301eacaeb3bfc0c0b058f0e6ae78c54d1f0f6252975198c9d36c4c175b6ba18efa5033b3939b5d96b2", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893745, "uuid": "dafe4a7f-9f6b-4cbd-93f8-bb262fd41535", "value": "T1A5F53392E925CD31C7029C746BDC015DA87B3D39C130E31A722D77B9EA77A9D8A23B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893745, "uuid": "c4c5bd5b-7124-45fe-9caa-1d62b0c42e5b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893745, "uuid": "7932f358-b198-4fe0-8940-3eaf63a6cbe5", "value": "98304:MyJQrnhYQ6pqMc2EbiJHkdyK2l5n5l73A:3qZVMcnmJHCyKqnLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764893745, "uuid": "849101c5-e31e-4c7a-8c3a-f7c6085fe525", "value": 3586448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764893745, "uuid": "410e61e8-29c8-4e89-81bd-edaab79d2e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764893745, "uuid": "edf97952-9b5f-40f6-97d7-e1b12cf1d060", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c61fbe-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764951832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951832, "uuid": "97b49d60-a879-4023-a901-9620b09c81b5", "comment": "Malware payload", "value": "a1a35afebb585917675534de3d610c93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951832, "uuid": "a3183c6c-95f7-4d35-8078-4d72c0203986", "comment": "Malware payload", "value": "d1886b189474b02467ed2845df0938cec9785e99c3d4b04e0b7de3cafbee4182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951832, "uuid": "a5ced6ee-fc91-4ddb-9d21-f108f07819dc", "comment": "Malware payload", "value": "18d232d04d35d31f20d4549fa5f52f3afdb5d2d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951832, "uuid": "f321fa44-cc9b-407c-a20b-33ece03a8929", "comment": "Malware payload", "value": "7c90e2bd1dbfe5ef24dd02e5d742eb644148a7c36afcde6615f84ab1488349dd5a83f566aface2bdb3543556adf00d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951832, "uuid": "b2b0153f-55cb-48f8-9267-a62c8ab407d3", "value": "T1A80633EB019F51FBBE25C5157F1E16A2FA8EF8301FD909C41E26D3D169FA6A21240723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951832, "uuid": "ea718ab3-d15c-4536-984a-49847586a9ba", "value": "98304:dw4TA7HyWTC/HEgdf7KNc5UogxUOUWkC8WiUZKn7AzciU/7qfrvCMYLrxwL:SfOW+Td2Ger5Von7AzWcvjYfxwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951832, "uuid": "f17950f4-42fa-4e1a-ade7-845ab730b395", "value": 3829604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951832, "uuid": "b403a0c5-4b0f-4eac-8708-b6358687cffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951832, "uuid": "39284cb2-9b2a-4443-8de2-2960e428b20f", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d001b971-d1d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764935522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935522, "uuid": "f9ca345f-d5fa-4041-862f-1365542626de", "comment": "Malware payload (Mirai)", "value": "b52e7f901b81f7995592a1dc85374b97", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935522, "uuid": "2a984902-0b0f-463f-9c5a-c78577d2cafe", "comment": "Malware payload (Mirai)", "value": "d19c8837391a2b1242cf6e34a086c59adfe87c65778dc6a0ab4c59777a786965", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935522, "uuid": "50cb7776-04b6-41b3-a20c-e4621c84e00d", "comment": "Malware payload (Mirai)", "value": "851cbb1010b8cf6733f5b2c9b509c520951ac885", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935522, "uuid": "d675d2f7-d592-45af-9f79-b5270e3a00f2", "comment": "Malware payload (Mirai)", "value": "23d01bfc0b4e2c1b9efa1d29837a418abcf1b4b7c976af41212b1d25d3279c74ba719c3674b2196d3fe4573ad1e447fa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935522, "uuid": "32f814cf-a21f-460a-9179-1a40e353e90b", "value": "T160114CEF68135240D328CA07B825E1166954C2E264D8FB27E1CF0F76C4EC498BE16ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935522, "uuid": "2ce01280-5e22-41b7-9fe6-8cc6fa8ffd90", "value": "12:78Z6VhVEZLVhVEZMVhVEZpYVhVEZXWUVhVEZuVhVEZ7UVhVEZ7DVhVEZ78Vhb:eJUPp7Kt73wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935522, "uuid": "54a930ef-8347-49ba-9270-108699386c1a", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935522, "uuid": "9b547e47-8b0a-4772-848c-324851c2c4f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935522, "uuid": "9f577c94-3e08-4ef7-b613-d4ded08bfb9d", "value": "ipcam.goahead-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5e836b-d1f4-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764950712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950712, "uuid": "9859a21b-5f7c-4560-8113-573bf31dd669", "comment": "Malware payload (RedLineStealer)", "value": "0e1ef03cf85f84a9798b518f70f20811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950712, "uuid": "eae82024-14b1-414c-84c0-a1b61b0d4391", "comment": "Malware payload (RedLineStealer)", "value": "d1fc6072f240470c0149a5688e8eb638b7c29cc9f210e8a5c5fc55df9b06491c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950712, "uuid": "e4dfdb32-e3d7-4fd8-8502-452608c3d613", "comment": "Malware payload (RedLineStealer)", "value": "ba7a4019c36347498b9f825b7c100c2be2d73ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764950712, "uuid": "a96b3e34-7b08-48ca-a0ee-7c524b586af4", "comment": "Malware payload (RedLineStealer)", "value": "889bddfc56986f3a2c9f070b1fc93b8dc6c0fdfa1c4061afe9445d9e3c2fceebbe405592a7cf9222a7ef28674e8abe68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950712, "uuid": "a36b5372-48d4-48dd-b07c-2bff8f216422", "value": "T129B5224DF322ECE5EE6B02BA757158032F02AC5FA5D9386D614CB6263D312538067DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950712, "uuid": "efe06235-86c4-4703-9da4-2a8f1cb0c296", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950712, "uuid": "343ce80a-b6b3-4c87-a07b-1602d3a56b87", "value": "49152:PIy+9jeyDt3dNKrU11tIvI5Uyx3z22ewwebX05/P8qU:PxoDttMIXBldw8X0538qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764950712, "uuid": "d56a90cc-9adf-4e3d-b377-9db43618a56e", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764950712, "uuid": "2b915cc7-942c-4df6-a89b-a0be2477da33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764950712, "uuid": "727dc099-d359-4ae3-95d8-e686af021e1d", "value": "0e1ef03cf85f84a9798b518f70f20811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf66551-d1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764946038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946038, "uuid": "47ad3ac8-83f7-4562-ba51-79ccc3924e58", "comment": "Malware payload (PureLogsStealer)", "value": "824566ee9c453c92635f14b263fbd242", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946038, "uuid": "a521317b-c18d-4c8e-94b3-fa989270824c", "comment": "Malware payload (PureLogsStealer)", "value": "d20d68a0f4827677ae52f3f03f80b61e3ab99c1879abc3327fc679790e3fc186", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946038, "uuid": "feb89411-e1e9-49ac-9db6-68ff26c9b550", "comment": "Malware payload (PureLogsStealer)", "value": "27056c451b2820fb653110393fd632baee25f52a", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946038, "uuid": "b907d0ca-0207-4b8e-ae3c-c8de219acff7", "comment": "Malware payload (PureLogsStealer)", "value": "e91ee47016822e307f2eef93daf0d91f0dfd6404f8f6c30a1d85b02e79b53feac492f253e032d712110a4f3fc077407a", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946038, "uuid": "3b5ac85f-d053-4a44-88a9-8ef3f1fc07d4", "value": "T120A42337A4D7EB446128281F8E085338E12B387378EEF7D667211F9EE82551628A55FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946038, "uuid": "cd0ae4f9-4451-466b-885a-6c0fae92254d", "value": "12288:DMflRMt85JXVImiVvrfO7LAnFA6KnVkYMNu+VMPDn8e:DUlmmIVALAnFA6GVnk+Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764946038, "uuid": "4321027d-6d8f-44e1-8876-061fb475fab2", "value": 488884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764946038, "uuid": "01be7652-4919-423c-bb57-8ef02705e36f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946038, "uuid": "a6b668b6-cced-44e6-ad39-6d87c3cfa2cf", "value": "CUE9Swift_XK28939_Z29001_NF738_403920MX_LO3930_XN8928_ZIL3902-30780-164732.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee6d383-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958901, "uuid": "6dafc8f7-8755-4edf-88d8-e4cb0f3fbddb", "comment": "Malware payload (Mirai)", "value": "45e88cee6d431a3786370e836b0ae193", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958901, "uuid": "b2cd3e31-b03c-4a67-850e-207aa8827fba", "comment": "Malware payload (Mirai)", "value": "d24926995bba456419b40747cdfd79516f34447b9e37e11e65b158eb974ae52e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958901, "uuid": "88f6a21b-450c-4159-80c1-00dfdd9464ff", "comment": "Malware payload (Mirai)", "value": "b4bc0595209775930f2c51c52e6a20a976f865e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958901, "uuid": "24c5fc59-a0f0-476b-9914-3809c7703efb", "comment": "Malware payload (Mirai)", "value": "fa34d672dacc48a03758aa10279b56413e4017516f98fbb13ea521b8b70da730800ab2c151d01fc04e15c3f117e45a4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958901, "uuid": "dc87547e-17aa-46b9-9df8-6eab426c7f63", "value": "T19CD012FD745E92A705005E02E0654D40B0BB97DB54B2DB146449F43EA9B87A03026E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958901, "uuid": "96a338d7-f167-45a2-9c6d-a9e4fc0ec8fc", "value": "6:St5/+JPSt5/+sLJPSt5/+6NIl56APSt5/+GFa0LKiJPn:Ah+Gh+sLGh+6NIl56Dh+H0LKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958901, "uuid": "b3631d55-72b8-40ca-b0f2-b743b9c79995", "value": 257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958901, "uuid": "124d5e2b-9520-43ec-96a9-3df742d0b616", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958901, "uuid": "ad71b38e-dac4-478d-9c41-ec896547a54f", "value": "pog.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63afb8ee-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958962, "uuid": "c7be5bcc-eb6b-4b34-a453-0fadd0466fc6", "comment": "Malware payload", "value": "1c7ccae14572168f8b33e127c9b1697e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958962, "uuid": "be8b269f-a38f-4798-aad8-71cfd95f7fe5", "comment": "Malware payload", "value": "d2954876a80595767f88e089739e3136ad148c0dadb1388458f0ffc746a88403", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958962, "uuid": "a3416a66-20a8-4424-a287-0bdca90d789f", "comment": "Malware payload", "value": "6051966891f0c1cf499dbeedaf1935e054b92551", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958962, "uuid": "7d1fd915-d11b-43fc-ac07-31411cecec61", "comment": "Malware payload", "value": "4d5d84c6390391ed149dfb341e68b4c196cd4bf7b40b4cdab28f0c0640013301ff9b94ab6a5f008c89c0353fb84d35ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958962, "uuid": "2f68c721-dc4c-4063-811e-7d07f9535b8f", "value": "T112E0C87D0017CF1FC1124D04E43660733033D7D55060CE069DC5503D61585207135E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958962, "uuid": "c6b622b0-0b17-4b84-8c4e-e70d7b33e1fb", "value": "6:LA5/rHzCa8FgA5/laLaNgX8FgA5/pFGNIvF+6L8FgA5/nfiAK6iyaJ:shfn8FthlaLaNgX8FthSNIE6L8FthfLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958962, "uuid": "05b27777-9ff5-48ed-86e2-037ad70d6919", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958962, "uuid": "899e5d97-4b2c-4468-9476-6a69a0d6fc54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958962, "uuid": "8504ddb4-5148-484f-bf97-1d0af84daf90", "value": "mob.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a28eb-d21c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764967837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967837, "uuid": "1e522642-0e61-433d-82b0-d916235c597a", "comment": "Malware payload", "value": "0530596c0903afbb772dc4836b4986dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967837, "uuid": "c5ba0aaf-babb-4104-b781-cffe452867ea", "comment": "Malware payload", "value": "d3157c50ba028d6b2e679a001088548c73905c4ec38045176cda19fa25de1247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967837, "uuid": "04442f1b-2cc1-4d84-8b91-461b7e8e1831", "comment": "Malware payload", "value": "a62357d519df3a6b95fcef26ab31b022ad33ed85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764967837, "uuid": "09a72e64-0106-4586-ae66-56b2a521fa22", "comment": "Malware payload", "value": "1bf0dfbd199abe828ff920a691883ed940ed1929309b67264324b686fd089f451ef390eb9da00d18558d7af2ce643609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967837, "uuid": "04fd9ee4-e7ae-4fa1-8ab3-ed41dcccbc64", "value": "T172C633BE6F560DA1C33C6738A6FF5F09A7024D06F7E5A636EB8575E06B63AD05001283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967837, "uuid": "7cf12989-5792-4433-90e0-1ce428b780bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967837, "uuid": "899b5dff-e857-4c22-8024-36c9e44cc60b", "value": "196608:72oK4aoyuh1mZ93ElgZUShkGtRemVLlWNZ1mkv2VrXjUbV/cq:7QIh1y9USBk0VLlWNX25Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764967837, "uuid": "2146da24-8bfd-4fff-a22b-21c58a983e47", "value": 11475968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764967837, "uuid": "c9e87fb8-a2ef-4780-b5e6-a844c13c79aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764967837, "uuid": "a61b3c3a-55d0-4c53-8c5e-9cb0e1faa77e", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f5b14c-d201-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764956384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956384, "uuid": "c8d68bc4-548b-4ef4-a122-1647be145637", "comment": "Malware payload", "value": "5526a9233c55ce08caaa96cb15842fa7", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956384, "uuid": "3839e77c-361d-4e73-bf2e-bb8bb0ead632", "comment": "Malware payload", "value": "d392d091f50a4a3dec95fb2f66108c22cba0525cd67882cdbc81fbf167a12b60", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956384, "uuid": "158a905e-5de0-47b6-b049-413b51bb2d8e", "comment": "Malware payload", "value": "1c55feb27774bc79ea42448329a67cc95559a231", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956384, "uuid": "ab01a60e-c9b0-4faf-9870-ad3ecd45554a", "comment": "Malware payload", "value": "47de9d506eb2b76731935744aff8f0a8eb655b128e44d8ad1be725ba0cea0dd583aac192bfa10ecba87397fac59a9094", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956384, "uuid": "85b2009e-7a7a-4817-a2db-c5c4593aca0f", "value": "T108936C53B5C2D872E57219311878D9E49A3EF9541E619EAF3798063E0F302C08E36DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956384, "uuid": "1b9b3890-17cb-417c-a90b-8c6b670bf320", "value": "c0a7e9ee5dea5a2966980846b4480211", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956384, "uuid": "80730909-e5c5-4c63-995a-5b2e61605a00", "value": "1536:sy94ieUgxy1QRX+ntDzL4CCaGz29iRjSSOB+hWDbCPScsWycdvaHfvYhGPP:hmUgE1QRuntDz39iRjsB6BPnvaHfvYhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956384, "uuid": "7dbea252-c115-4d9b-9cfe-4b692256a42f", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956384, "uuid": "cff68e36-de4a-4aff-a7db-33f1944b3060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956384, "uuid": "7a45a204-073a-47d6-a95c-d16d9a349bd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b153d3e-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933661, "uuid": "03dab5f2-0835-465a-a86b-bc273a5c0f6f", "comment": "Malware payload", "value": "6d3792622cff5cfc95ca2b6e1452a210", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933661, "uuid": "5c341523-f740-48aa-ab81-b5b1be6b3ce9", "comment": "Malware payload", "value": "d4498b6baef034c6134eb4fd77d1cdc260889076f80e16f2cc23f154f75bf054", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933661, "uuid": "e5c63896-8c40-41d0-999f-db8ff9dbb8a4", "comment": "Malware payload", "value": "5eaf749169884fcd32690e23e8b40ce63e80ed67", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933661, "uuid": "32a0c6e2-ea94-426b-b1e7-553a7ba00402", "comment": "Malware payload", "value": "7f720caf6259919a820e82443a07d2647f673179e4eefb746596ebd76cc7b7b6958145eb76b44b65a984b20b2dd66719", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933661, "uuid": "2d356aa3-7c09-4079-92de-7d281736a724", "value": "T15F7533268FEDEEC9F467E073E81EA846D56408D80500ECDB7E8F51C93BF996E50861A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933661, "uuid": "cbfc370e-1229-43d0-b25b-2bcb024c9c75", "value": "49152:76Ot1rv1VtOzPNJCkeANLa5m9BspWWbccBd66VKu:77td1VtOzNJCDDgohhd6nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933661, "uuid": "b255daf4-e85c-4f1b-a75d-85b8e8f72b41", "value": 1667909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933661, "uuid": "894d3458-236d-413d-a2a3-59be712caf9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933661, "uuid": "95e84de6-add9-4f73-989d-cd1bdb27bb0d", "value": "yumeng.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b914a8-d1be-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1764927530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927530, "uuid": "e1ad855c-08ad-43fb-80c9-2c127ffca0a1", "comment": "Malware payload (Stealc)", "value": "41a1cc141013bc6a4624fdf96a1e12fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927530, "uuid": "e18ec4a9-413d-49a0-a5fa-36b99f2fc630", "comment": "Malware payload (Stealc)", "value": "d5c0fa62418835bd01373456c3198c372fa3214dd9a78380013e8b2302c54a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927530, "uuid": "06fc2c09-e8de-472b-9fdf-07c3193b7c8e", "comment": "Malware payload (Stealc)", "value": "8cad22c72c45b45b1661f68b3e72a666bfec54b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764927530, "uuid": "4d1c99b7-6a78-4e01-ae6e-a01d27ba6b0b", "comment": "Malware payload (Stealc)", "value": "643ebed5c57e89ba23122fcc14fdba045e2f611136261b0ad47778e6ac35911d44ac6e184b3eeda489bf0f4cacf55097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927530, "uuid": "88539fc8-e67c-46e7-86fd-9ba43bbb978a", "value": "T13E25126AFF03B4D5C9E581B18CAA00B235215C6743A40B3776B8F6295CD632B7F36936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927530, "uuid": "da2dbd4d-27e9-4925-8c7a-67ca8146408d", "value": "313a05c8f3f31305e238ae143783f8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927530, "uuid": "8a906ba1-0064-4f87-8971-4222d39d1cb0", "value": "24576:faOnrx278WrDJJzJyb6wS9EKdcekRys5UY7o8xw:faQqzrdJzJy9S995kd577o8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764927530, "uuid": "86e45dac-2b15-489f-ade9-90c5e8abd3b0", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764927530, "uuid": "48f10b18-21da-4f37-81d5-1c8a0a79cd6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764927530, "uuid": "0f4894a4-19be-4604-991e-6ef247ff141f", "value": "d5c0fa62418835bd01373456c3198c372fa3214dd9a78380013e8b2302c54a58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108d93eb-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958393, "uuid": "8c65142e-4d73-4cd8-b5ab-1c37c478540a", "comment": "Malware payload (Mirai)", "value": "b44c3e1ddab641f0764a2d312ad44619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958393, "uuid": "687553ed-7f91-4e9e-b606-59fa725a3fd1", "comment": "Malware payload (Mirai)", "value": "d5c99bf09c452506a14b408a839f1716b78cc43853e9202a59ae890d91aa2115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958393, "uuid": "beed76a3-d4f6-47a6-854b-327434db61e9", "comment": "Malware payload (Mirai)", "value": "397857719ffb146373656bdf3586d5e46192f078", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958393, "uuid": "424ec6fa-812f-445e-82ff-ab406775c09f", "comment": "Malware payload (Mirai)", "value": "c17e180596a51c86e40e57474b4c933e037bd63c6d0b0f27e4cece77f28f5e13fe1e866d5ee668d39472132bd9aa93ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958393, "uuid": "9a6fdc30-f5c3-4796-bc5f-627725587124", "value": "T1A9E32851BC829A27C6E523BAFA6E028D332523E4D2DF32178C215F2177C695F0D77A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958393, "uuid": "6e24eea2-6c16-4337-8ed7-d6c465946e4b", "value": "1536:r3ElLgUpWxQCVXdWcpej21jRdxNShPDINlWZwar1wrp6MomHsCM6XjGyu2jd9Cmv:r3UZpCC+lq+ar1wFoesC1jGunqRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958393, "uuid": "403958ea-ab94-43dc-b6d3-2cb4dd2514fe", "value": 144852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958393, "uuid": "f2e4143b-aee0-45bd-8560-9b700f12cd87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958393, "uuid": "569bb125-1a4e-4671-b445-353257093a16", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4901a423-d1aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764918974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918974, "uuid": "68a5f561-bb78-4bb7-8603-373a5c182c13", "comment": "Malware payload", "value": "2b38f6dd64b6e8cacfaf40a1e86f0ca3", "object_relation": "md5", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918974, "uuid": "519ae391-5a2e-4f02-86ca-9fdd489bfa02", "comment": "Malware payload", "value": "d62160e659cc1218306dd664c65bd2304825f09c0b52f9700d9fb848bd3a98ca", "object_relation": "sha256", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918974, "uuid": "8a35abfc-cfbf-435c-8961-118b8fdfea67", "comment": "Malware payload", "value": "a90836dbc88a8b33f5ed14994db47e06d19e9bf9", "object_relation": "sha1", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918974, "uuid": "db639c19-beff-48e7-a5cb-52d27733bff0", "comment": "Malware payload", "value": "8458b17e6129fa2d183f59ce5b786eed0556f00793689de4c8a816a359f368e20a8f11dfaff89f7d12461fd7839595c3", "object_relation": "sha3-384", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918974, "uuid": "49c4bfd5-7115-45a7-96c9-9527949eb8e6", "value": "T1F9F4124EF9E6380E1978B7A9C7F3B05BB75AD9915F9286FD80C378C5019A3A041D28DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918974, "uuid": "3c97003e-37d4-43dc-9a70-fa29d251cd17", "value": "12288:iF4aIE9yUIVLYAgFOcRAOI/nVs6H3QRa0WLgmRg5OQKVlWw7QX:RE9yUIVkRFOt/nVvU3mEO9lWwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918974, "uuid": "5c254ced-c88a-44a5-ad55-9c8e349b3ff0", "value": 792924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918974, "uuid": "dcf348fd-cfed-4798-b427-9aa3450b4913", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918974, "uuid": "cfd3cc46-3a61-4194-83dd-9a7ea6464a88", "value": "2b38f6dd64b6e8cacfaf40a1e86f0ca3.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb31481-d195-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764910176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910176, "uuid": "dc771ea7-fb0b-4867-8b7b-c7e5e790d1e4", "comment": "Malware payload", "value": "8274b6d922ba7c7464279208d269a89e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910176, "uuid": "49b73cf0-23d2-45e7-b817-bb5b32312476", "comment": "Malware payload", "value": "d69f2aac92f18b43f639df7cecbdc52b1d6f11e11fe5570f2501bf3678b8148c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910176, "uuid": "56d6f973-e447-41cb-b68b-a29e716c2661", "comment": "Malware payload", "value": "09376afe398f94a8a0a5b80587c5380332e7368f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910176, "uuid": "88a91a48-c1f9-45f7-b3af-7689a2f69170", "comment": "Malware payload", "value": "d3b5f45d2bfa6f25af135bdf13a77d27d20d9bb4a8e0bef0f4d53b55f708697f0a2bc2e8daf5f76646c0ec48cda19378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910176, "uuid": "d8ae051f-75ff-495a-be09-6d1f04814866", "value": "T12C337CA13A8C40F2DD5414BD4A2B2EB8A7484AB389A0C743FF9A377C1DB664D5F057D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910176, "uuid": "f34a7c61-1603-42ca-b83e-c971d8c6b142", "value": "768:cT9R+MIHaf5uYDOEzuecJ7lhNSGxXWmv8eKsaemLnwo3GvaK0wknbw9mSzFTkxQ:cXI2BqVecJ7lhN7/raLLnwoSk09mSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764910176, "uuid": "d061419e-4506-42be-a670-8b534e80a72c", "value": 50756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764910176, "uuid": "0d49a824-6070-4ba1-a930-61e7e37b9ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910176, "uuid": "35c16643-4238-421a-8d6f-e1c523852355", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb28a60-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958414, "uuid": "d0cc46b4-2f4c-451f-8224-74c670243b99", "comment": "Malware payload (Mirai)", "value": "fc1ff46fc4f1ba6927f8448f067af7a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958414, "uuid": "5fe7579a-05ae-48b4-9a78-f33c29fbc570", "comment": "Malware payload (Mirai)", "value": "d6a7bf5d02af2f688561e030aba42007d0df5849ced79e3257edb4f8ede85de0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958414, "uuid": "6cb838a4-cb43-4e4d-a101-9e4e8d9b653b", "comment": "Malware payload (Mirai)", "value": "0be6df7a8cbc8102cae07be48061b571064ea209", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958414, "uuid": "a2165975-14db-4cb0-b8c1-81e2224b124f", "comment": "Malware payload (Mirai)", "value": "965b7cdd96664230ebd32c21c4b6940015917d8fde1affd5cc0b7a6311e7dad833dd93ce80e2bb9a7a1c089526062683", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958414, "uuid": "234a4c5b-cd42-4f46-a48c-78554726ab3e", "value": "T11C4183EC28B26F7B9441CF42F4324A1A624FB9E458D03FAC95AF1B6DC1BC507B41465B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958414, "uuid": "bb72cbf2-605b-40d4-be45-97b298f4a466", "value": "24:z5EMy0MB7wNKpKXRC3P35So98UgHOgHCvzPKXW1ripFpoHKXZ:z562cpCBHJHCLj1WpFOHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958414, "uuid": "7b571c8d-f02d-4d09-b617-2e1241005e49", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958414, "uuid": "cb231b3b-0c4e-4bd7-bf0e-87444f182398", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958414, "uuid": "7d6ea120-804e-4920-89d1-41e0835efd30", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f8ce6b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958862, "uuid": "0477fe8e-0fe3-4678-a3b2-2ae966f0be95", "comment": "Malware payload (Mirai)", "value": "9b562ea0f909c7828d901cb28b5ff964", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958862, "uuid": "2cc80924-2bf7-4b69-924b-12e0f3a93951", "comment": "Malware payload (Mirai)", "value": "d92c4e0d3534d46c607a9b9621a520cbee0a75b3e741b31318d299ccd8f2bf83", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958862, "uuid": "31198c71-f792-4cfb-bb2a-51011cfccd43", "comment": "Malware payload (Mirai)", "value": "3ff89be915449c3e9ed112308924c50217830310", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958862, "uuid": "99acdba1-4d54-4ac4-98c8-e4fe256bb2cf", "comment": "Malware payload (Mirai)", "value": "fc5bc523b88b3a60762826d92a1448672b83741089ada23588d62ee7731281f6273731f4019cad2f3a495141ac91483b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958862, "uuid": "5f8bcc0b-5c44-49ec-a5bf-5f6d3ea09d82", "value": "T1AE1142BDC027BB1884290926B02B9015B032C7DAA4F7CB49FDC4653BB5C4552B13AFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958862, "uuid": "b48edf85-cb26-4365-9f12-59bc20204495", "value": "12:shdF1TBNhaK1TBNhJB1TBNh+6d1TBNhlOBa1TBNhn71TBNhO2D1TBNhwDo1TBNhA:ePj7jLj/jlYEjvjXjhjHjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958862, "uuid": "a92d12f7-bbd3-477d-b0ac-3bdc51854427", "value": 892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958862, "uuid": "63282e6b-3932-4e87-805e-2e0c47756eea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958862, "uuid": "7cbdc6bc-e23a-41cd-aac8-08d00bac4430", "value": "aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fdc1d3-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933651, "uuid": "b4363515-b3dd-4bea-813e-a7a54c0070c0", "comment": "Malware payload", "value": "6e8d2c707f249a5abf4cc66670193f8a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933651, "uuid": "27c40d8b-d17b-4e03-9872-7cfccc7f3749", "comment": "Malware payload", "value": "d9b75d606803968d04015bed042da887905e9c1cb1b40b4ff11852b88c8b4d21", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933651, "uuid": "8534be9b-4aa4-4649-8eee-007e43ae0029", "comment": "Malware payload", "value": "74ad766c3028b04f7cf6d8dc29faf523f3691056", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933651, "uuid": "c45e4fbb-7fa8-4173-b1a7-26fc32f36ae8", "comment": "Malware payload", "value": "58393baedf8ca3503a69eecf8d94c1fd15ac009a8b799c93d4ba7283358603b01ee1c72c41955ddf0dacca00f397d63d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933651, "uuid": "34efecb0-afb8-4a2d-8e81-e27f071fac9c", "value": "T147761203F78E4D2ECDE2B9784D5713716A056CEC1910928B4902F318BEB76E96F26BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933651, "uuid": "900a242c-38de-4fbc-9da7-15fe04919300", "value": "98304:LDfUzbqLnAU0ZI9/P2hnWAjVOA3I/0fg1cPxhmc4aTc2s0SnlgxkK16K6Y+eRK43:3fnAPlhWY7y0fg1UV4DABAdex3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933651, "uuid": "3a6fbc5a-aeb4-4329-9d79-f7bf1080828a", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933651, "uuid": "a4db1f00-9df5-4f29-a672-54efd8991177", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933651, "uuid": "26061c73-16f4-4819-89ec-9696af7de26b", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92baf389-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908790, "uuid": "2ea1294a-4370-48ed-b21b-2419a46ee307", "comment": "Malware payload (Mirai)", "value": "d17d140563aa11f74e949d4ed5ea1219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908790, "uuid": "a8c3bac1-a2f1-4b04-bb84-450e24d0c141", "comment": "Malware payload (Mirai)", "value": "da101351895d4732b89c336d75e3981338b7bb18479edcb906fab045c59605f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908790, "uuid": "3036bccc-2c41-4e8b-ab8f-14746abe203f", "comment": "Malware payload (Mirai)", "value": "379cd5822a25989ce42c38673fd7b03eb36af909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908790, "uuid": "4652548d-8acf-4f10-bbc2-751b8a6649fb", "comment": "Malware payload (Mirai)", "value": "874c2dcdcedce2e489aff3e8187823d72fe735196f156301fdff0d2775cbcdd234deb27cc5500517700f556de12d371d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908790, "uuid": "bff6ea28-4c8f-4d63-9490-8c14649ae050", "value": "T15C33098AB802AD3CF91FE6BE54164E09B92177C151830B2767BBFD936C731945E02F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908790, "uuid": "06a054f3-96bb-4690-ab70-b8c414a4ac8f", "value": "768:znPWGGMhofhmJ+i3Dos8/X0etTq8M6M1OYLzYoYXOYgqWGsGV:Leq+i3f8/Eetq8M6MNYoYXdgqDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908790, "uuid": "4bffa96d-d29b-4b1d-9ec5-9537b2cde8da", "value": 54820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908790, "uuid": "d448fa58-eb2c-42d2-b719-098fcbdebedd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908790, "uuid": "98586ad7-62b1-4bd1-a52d-15adeaed96d1", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a915cc5-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959484, "uuid": "f9565533-9a48-481c-bfdc-cbd49e131353", "comment": "Malware payload (Mirai)", "value": "302a096058b0da5667ae86424e2e9fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959484, "uuid": "a45dc151-be21-4142-b7c7-f7386ab4b3d9", "comment": "Malware payload (Mirai)", "value": "dc5a374ffa5bf4f3079dc0663aa765387ddec2403401aa580d66eae0dbec2620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959484, "uuid": "4717bd46-e83c-46e4-8cf4-8b8a5e58d4f9", "comment": "Malware payload (Mirai)", "value": "12e449fca3cf528d792f7893ea45a407df3f6812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959484, "uuid": "8e73eaf5-37af-409f-8822-1a8251996a69", "comment": "Malware payload (Mirai)", "value": "1485fe09d3fbfb7767147ecc89d1aeb7d0f75c54c370f5aa9c59d8b32150de594c59c9640a87cb688888aa0c981c3ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959484, "uuid": "e2e82e7a-04b6-4ebc-84b0-c6a609fd924e", "value": "T1EE338DA6D5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959484, "uuid": "6c79ea29-1b70-4d3f-af64-754d80b92b62", "value": "1536:5aR5ewtQZut8GdcPs3q/aKlMLEm0DOFCn:5k5eDM2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959484, "uuid": "9cc96011-9ffb-4694-8729-710a90dc2009", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959484, "uuid": "074d75cc-4ad0-42e4-b89b-07b2dee73104", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959484, "uuid": "17d9efbb-0da7-483b-b2a1-b47469b803f1", "value": "Omni.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9099cc-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920059, "uuid": "b2c18841-91f5-4d9d-af49-58f8441b2a2e", "comment": "Malware payload", "value": "715c55b44f762dd280fd7a817c39371c", "object_relation": "md5", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920059, "uuid": "05f17302-e0ed-4be0-a781-ce579cc77676", "comment": "Malware payload", "value": "dc9e6d1ca060d99bc3d7741437844fc6f8fb2bfd39438df595213bf3d8e66599", "object_relation": "sha256", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920059, "uuid": "fdc618da-f4da-44b7-be9a-0eea8c903279", "comment": "Malware payload", "value": "83782652771fac503080e6a111da3155aa2e12cf", "object_relation": "sha1", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920059, "uuid": "22b215da-316a-40d7-9455-7bffa9ab1ff4", "comment": "Malware payload", "value": "d6a3f706c85b0b64a2bdab735b8a75b6edab4241a40c2e5becddfe8c083241de7627e3e0d264da78e92be6bdac76eea3", "object_relation": "sha3-384", "Tag": [ { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920059, "uuid": "01ab777e-75d6-4388-a665-3e7b539a1734", "value": "T1723502118AC42FB9DFAC151890BD161EA3F05A8A946B75CEEB33BD07AFF794442071C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920059, "uuid": "a1521de5-abcc-429d-bf49-0d06e68393c6", "value": "24576:2YO9c4KHOQXMPBpP6l1vtYX1ESoQop5nsEzCR1UAIrRj19:2YOWtNMuGIrTsg7Acn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920059, "uuid": "113aa37d-7d69-49a1-b45d-95e519a8d006", "value": 1112088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920059, "uuid": "307fb543-8af9-43b9-89b9-063320f1a46d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920059, "uuid": "70d025cb-9325-4a5f-9c63-30e95514f46d", "value": "dc9e6d1ca060d99bc3d7741437844fc6f8fb2bfd39438df595213bf3d8e66599.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda67a5d-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958362, "uuid": "46397cac-2b63-4be0-a1e9-71492c5a97e7", "comment": "Malware payload (Mirai)", "value": "45828367b900e0e283ba19dd10246b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958362, "uuid": "d8d5b845-badf-4ca1-a0ba-927ac7144ff3", "comment": "Malware payload (Mirai)", "value": "dca07817747ac3bf580f59f6dbf5b20791a133053bfd332ae9af80e30c78c005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958362, "uuid": "ac4a8b90-4eba-443a-8f02-00bc1f3b3529", "comment": "Malware payload (Mirai)", "value": "b127ec057bc97b6e450ccc95cfae47d812d71398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958362, "uuid": "0736743f-c4e6-4b6e-adb3-09528eb521cc", "comment": "Malware payload (Mirai)", "value": "70b5c42c806c95fbb8336a40fbbfd45af5b4c5e8c8085ea8ce5c6dc74c51582449ab1ba6ce1bf81a9d4624123c7811c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958362, "uuid": "72c70694-51ae-434f-9fa2-7f0c5e67f6ca", "value": "T164445CC7F803C9BDFC0BD676082F0A09B970636104535A37B397BE6AAD3A0D65917D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958362, "uuid": "4e4e1df6-8e21-4589-a796-d4a115fff761", "value": "6144:jsm4SGXrwrLqgZyYzvcararpuTtLXF7ua9:jsn6qRrwT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958362, "uuid": "62a184d6-5e6a-4acb-bd47-61dfb633d426", "value": 265824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958362, "uuid": "70a9a780-c5da-47cf-846a-f3e6a4f85fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958362, "uuid": "c2a32d99-2a5f-490f-96ae-9d513dfa43e5", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfe79b4-d1c1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764928807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928807, "uuid": "0930cbc9-6c57-4226-8d74-4a2780328ee1", "comment": "Malware payload", "value": "adf76eb8a37a7a28703606a76c2f574f", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928807, "uuid": "36422d53-8691-4f51-96c3-23d5249aa0b1", "comment": "Malware payload", "value": "dd312c4e7fd6699bb2786a9c056916c3271477ad599b9539a88ee442146f5a9a", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928807, "uuid": "00aca8a0-d125-45f5-9259-cbe5f5209502", "comment": "Malware payload", "value": "72c90fe6df87ad8a187ecc2e44824ead105542cf", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764928807, "uuid": "dbabd01b-131f-44d3-980d-7c3d587a0747", "comment": "Malware payload", "value": "68681fbccfe43d830ecb7edec83a679848d88557eea4839b6fb6044397924e6cdf2aadb6f929b67e77c8bf29d469260b", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928807, "uuid": "76d27e30-0b37-40ff-85c7-70360f80f00d", "value": "T1521423436CE0D0A7744CCFF76FA6D6AC72A9D2E9F5A855DA4D9360D01F8483EE027089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928807, "uuid": "21b634be-6b6f-45d1-8c96-019d423b21ec", "value": "3072:k6IE5Q4EZ1e9nw2v6xn6rqTsH6UPJtzEYPmbLEldn6ZMtyIBRqVBeRtHvdlfuLzZ:k6IE5Q4YUn7uBsbB1EYPMLED60yIBRAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764928807, "uuid": "81973b2d-0acd-49a3-b936-f6bbfc3e482c", "value": 190875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764928807, "uuid": "19108d63-27dc-4351-bb8c-58812755aae1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764928807, "uuid": "bb968b70-e18a-460a-bffd-76c2ef93b336", "value": "nnoviembre_2025.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a455e0-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958424, "uuid": "a4608796-143e-4661-88b3-2e33ec31e3ba", "comment": "Malware payload (Mirai)", "value": "48dcb5fa53f2eb14339a7bbab04c9bbe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958424, "uuid": "867e8406-7b37-4497-a143-b2e20e89d2d9", "comment": "Malware payload (Mirai)", "value": "ddbe4b34438cda864037e9037d1593bf2f24cbe834bca0551c98e9227c85a813", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958424, "uuid": "046d53b0-0cc5-4a69-8a5d-463d9718f280", "comment": "Malware payload (Mirai)", "value": "8ac68e9f2683bcd771947d0bc711813e2499b399", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958424, "uuid": "bec56ed9-f2c1-44f9-82a2-75e789e78e70", "comment": "Malware payload (Mirai)", "value": "cd1da736d54fa744e3f61aed65a782605d3f4ea405b130dc7383aa3557a43c5993b3d715a36168c240e9fee71fded2ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958424, "uuid": "8702e361-6f19-4c2b-907c-228ef33a7375", "value": "T12C010C8D211256451C4D9E41B17A87146A4BEBE0707CCE29ECC608B39CD86707168F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958424, "uuid": "4d46d932-2682-4e1f-abe4-56600b1780e2", "value": "12:3j+sq+4NIl5zA+h0LKj+Z+Os+MC+O/+EuSE+jytaKA+cj+MJiA+McyfAUn:3R4NI7uK71mXu/tBaJFcMxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958424, "uuid": "7fe455c9-52c6-4386-89d7-c261a3467e88", "value": 765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958424, "uuid": "24f5c474-8fe1-431e-939f-f885ff6c6b0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958424, "uuid": "a19c32c4-541d-40aa-9c90-425444ddaabb", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6159c3-d22e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764975700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975700, "uuid": "478bb210-5ea4-4d4e-99de-2243f4c0f2d1", "comment": "Malware payload", "value": "d1b70b87cec278f5f761d27f5e99b396", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975700, "uuid": "ed41aa36-7085-4e8b-9625-1ff2e8578eeb", "comment": "Malware payload", "value": "ddca542e034bc9d6b576ee632f2f833fe2df77e56122cbef084a1f9882e2917f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975700, "uuid": "4f03a6f3-97d1-422d-ac0a-bf53f8da15fc", "comment": "Malware payload", "value": "14af7591e88c16d8decf8068aab5fb8e7aba0a73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764975700, "uuid": "190c71fb-d6b0-4a80-ab23-79c01243bd26", "comment": "Malware payload", "value": "8a2f60a4177c6ee101c5de79b41df3c1d3f3fedbfea44bc82b6920c6ac77c8b52243e3eee4b6fb1dd6be78ac4f6e1745", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975700, "uuid": "48348e83-f987-4bca-8ca2-626ad5ff3fa1", "value": "T1BC752346B3E260F8D1B74135C9164306EBB2B42A47206ADF0B714676BF237E4AD3DB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975700, "uuid": "85ac00b0-2b5a-41d1-adbb-63fd0a41574b", "value": "00ec1f9addbab7dd7a563fe6fe9caf72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975700, "uuid": "20e0f0ae-10e1-484f-b586-1dc547c4808f", "value": "24576:yctT5L/FP83CWq+N8bvQwCck03sI312i2dwjS8Ld2YfiGq7+BLDKoq8tatrOgTVL:PFE0s87C0pP2dwjSAdKOtDKj8gpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764975700, "uuid": "77ff0c1b-ad56-4ba8-8d35-84e0a88ff175", "value": 1585891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764975700, "uuid": "35417af4-87c2-4d28-8b9d-454fd003bc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764975700, "uuid": "e35894bd-29da-4cb8-b59f-d1af603e2e73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd43251d-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1764944107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944107, "uuid": "32e4e1f6-1f93-49f1-8e5b-aa10e23c1725", "comment": "Malware payload (njrat)", "value": "8db1db60c21403c4e1852638b856e6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944107, "uuid": "c127db9a-021f-47af-b72c-05e91fb69c7d", "comment": "Malware payload (njrat)", "value": "de0892e8c62f21f2fb6669f8b4bf28a7bd9c014cc5820735491c44ce93fe0f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944107, "uuid": "eca4275b-cbcd-43a9-8815-018f36fac829", "comment": "Malware payload (njrat)", "value": "50dd587b873429f42136fdda562ef23d30359075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944107, "uuid": "58c29b4e-4aa1-40f5-919b-ca8db6272354", "comment": "Malware payload (njrat)", "value": "5590b2bb82df7c9c06ac050628767b1f58f7272b897d7ae437351cf4193c907c6f9119ef9b8d902f9755ec3a24ea8c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944107, "uuid": "1987ded4-7605-49a2-9666-8906a41aaba8", "value": "T12CA412285698C917E9B507B00A31F370177ABE9EE822D317CEED5DEFB425B602904793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944107, "uuid": "7e2f6ee1-6c74-4335-a4c9-4c06ebb183a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944107, "uuid": "cd9ce980-4236-4615-9430-c8c2c49e0b72", "value": "12288:TlTQmPoHsk94dzCFfxTQu/F5pVcDCwXoxLWHZdPjUNE:pQmY3mGFfxDnYCLW55wNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944107, "uuid": "512c8659-a734-46cf-8d37-ad6970c65ae6", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944107, "uuid": "b3860015-05b0-4b14-b534-85246afc4f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944107, "uuid": "4a9f3c87-2b92-4e23-83a5-d8cb17431292", "value": "EW0h6nyQB0E4QEJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42af259f-d206-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958477, "uuid": "d38d8bbb-79b6-4ff2-bbb3-1b0fbb88dc8d", "comment": "Malware payload", "value": "88aee875733c3909e12d98d9b65082a7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958477, "uuid": "a36cbc9e-64b2-4868-972b-ff7f01001ae9", "comment": "Malware payload", "value": "df57dc8e0eea54f61bbb03f132a49008e244e597abf22820575a6b9be32894d6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958477, "uuid": "28aef32a-4e35-4fbe-a8e1-afb50efdb9fb", "comment": "Malware payload", "value": "9e656def2a912af3fa97670d511f4314cd65e1d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958477, "uuid": "6507d129-18a3-409a-9ea0-810c009651ad", "comment": "Malware payload", "value": "cac7c0f10ee877a2a17a8a23d8b5b60a4bb0784c080c158d71ef0d56eeeae138f0064b831132693d421317e804941298", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958477, "uuid": "6a4f681e-bba5-442b-87da-697b00f826b9", "value": "T1C9417FD710550BF76C90DC3332A94880B6D4A15998C59F0769EC3EE558BFEECAD44782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958477, "uuid": "33c8cc8e-0498-43a6-814e-1876f2a53eba", "value": "48:vud8jJttQdMIYvRd7OT6kC4I7L1p5N4I7x6T:vud8jJttQdMIYvRd7OT6kC4I7Bp5N4IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958477, "uuid": "ec21a8a6-3e7a-418f-9df2-70e2d89a3860", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958477, "uuid": "c269a30d-7edd-419e-83d6-7bf5d1f68224", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958477, "uuid": "fcaf6a66-feae-4bf0-8096-0cf4cc568068", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44c63bc-d1e7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1764945380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945380, "uuid": "9253df43-282a-4d6f-94a0-caca6c55e625", "comment": "Malware payload (QuasarRAT)", "value": "c7621bd824231ada140d61c4abfb61bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945380, "uuid": "ec748c6c-a4f1-4dc5-804d-fcde03889464", "comment": "Malware payload (QuasarRAT)", "value": "e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945380, "uuid": "5de89794-dc2a-4f2c-b1ad-6bd6a1345a7d", "comment": "Malware payload (QuasarRAT)", "value": "c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945380, "uuid": "e03a63c8-844b-4954-94f0-98b4c0e2887d", "comment": "Malware payload (QuasarRAT)", "value": "f97055846b633fa2a79ac8ad114d7d08f4e7d3100c76d64d788c2990f649332969fb6067b1f8c2f5139819cace8a595a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945380, "uuid": "c85800fd-6927-418c-aac0-ffea080c8cfe", "value": "T1150502DD3690A5FFC427D47189659D34E2626C7B0707D203A46B3C9FB63E5CB8E248A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945380, "uuid": "12860bbb-1646-4c0a-add7-4c83155643d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945380, "uuid": "48f446af-5992-471b-8dbf-2b9f3cfef859", "value": "12288:NTUJVLlMl/WJbWlsZ3A8O/SloAS5M2YQ0mlriPkEywNS1CjJj+OLJYUm:NQJbMl/WJ4sZvfRSimiP8wNe8j+OL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945380, "uuid": "bd1d2461-16d2-44be-bb2c-a99c04c24700", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945380, "uuid": "4a5ec11a-fcf6-40f7-8718-624cf5634b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945380, "uuid": "f7f9aa60-3b0f-48f9-b109-dfd5ce7fae4a", "value": "Comprobante.Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e44bbd-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958857, "uuid": "b8a12ee7-341e-468b-8e34-338fe714c149", "comment": "Malware payload (Mirai)", "value": "8e44f54d7e67ee0a19c74951a5c70489", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958857, "uuid": "e86b0574-7635-43ff-a7c4-596c89d4d9a2", "comment": "Malware payload (Mirai)", "value": "e1171e2d2db7f7fbf594f240fe0bbf1523530161c6ea007ecb0efbaf1c3b6377", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958857, "uuid": "f0a0ff17-3d29-43d7-8151-08cb7640d2f8", "comment": "Malware payload (Mirai)", "value": "a5a72840a83bc2752271c44e9eb03475152b4e75", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958857, "uuid": "2bddd2d2-6293-494a-8eb8-f7ae7504769f", "comment": "Malware payload (Mirai)", "value": "a7c7437ca2d6483a61934fb325c25cb0708e316f459bfee2bb49693b62637f3e56582bc1ef7f97813a978b85341e611e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958857, "uuid": "29f0bc51-9286-4c01-a983-90d9605ae0c5", "value": "T16DD0A7FC003FCF17C2108C04E03E60737032CBEA21A2CE0AAED0A03AA2B89203132E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958857, "uuid": "3fcced73-60f4-44f0-848a-ad1524acf7ba", "value": "6:LA5/laLaNgvKVA5/pFGNIvF+6qgFKVA5/nfiAK6iY:shlaLaNgSOhSNIE69wOhfLK6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958857, "uuid": "6d87c7c1-6b91-43fd-900e-84785ca3e0f7", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958857, "uuid": "affd4ed5-5d05-4174-a719-6c4208acaf3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958857, "uuid": "32d46cad-0fc0-44c5-98f2-ebc1a66e3516", "value": "netcom", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4321ca19-d1cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764933567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933567, "uuid": "37b3c6a7-3d83-4893-8721-337d2897ac59", "comment": "Malware payload", "value": "68976e485ee3395ad3cf1cc2e0ec478f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933567, "uuid": "c6d38949-6799-4554-9519-761a95da19ed", "comment": "Malware payload", "value": "e163a088d174d4eb41479b53e6df04831dc40899b893a0b183d080d2dfe52cd7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933567, "uuid": "718ab7f6-48b5-453e-bdf2-24da140fcbd0", "comment": "Malware payload", "value": "92025efcb36f4e441aaf673726f4a0b55b0a7760", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933567, "uuid": "5d5cb0ac-b12c-4ad9-a48e-832a0f31207c", "comment": "Malware payload", "value": "752a3124ea142488256bbda47994f30eae4ff451ec2925b86819e2b2e3caeabf36435a9834c1bd48e285592ca6351f33", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933567, "uuid": "10659985-9b0a-4d11-b359-b3cdbbe22120", "value": "T15F761203F78E492ECEE2BA781963137166156CAC152092CB4D02F218BEB77E95F16FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933567, "uuid": "97234eeb-d393-4138-b030-530619772b0e", "value": "196608:whNCnAJ7j9kixuhA57I9iKyBawltosWJ66zexAn:whxn9kix4A57AiKyIw8J66KxAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933567, "uuid": "2a5bf0e7-add7-4581-9747-07b0f677d716", "value": 7640329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933567, "uuid": "cbba40f1-2b29-42f9-bcd7-364d33e6b919", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933567, "uuid": "9c07954f-eb6c-46cf-9f8a-62892d516950", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8b370f-d1d1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764936023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936023, "uuid": "36d6aefc-bdd6-4329-bd58-a10c51ca43f8", "comment": "Malware payload", "value": "5005a43e31a04abf6a2a2b896b68ed4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936023, "uuid": "afadf46f-cfee-4e8e-858b-fb4a459f55d1", "comment": "Malware payload", "value": "e23c52b3f59c2765c13eb0c34f0c845d15875e20143ae9860132d0b12ee6bea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936023, "uuid": "c0ac3d3d-c65e-42a6-a507-40a88078efee", "comment": "Malware payload", "value": "337b9c8d44a895037604cc6187fbc7ade8031744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764936023, "uuid": "41bedd3d-91ce-4ae4-99ea-a47787d32015", "comment": "Malware payload", "value": "df9bff542801664dbb80fe367b29d99185a7e3358f4451a9b7b687fd41e9c283f080cd80e23610d1885ad178de3f402b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936023, "uuid": "149b5ca9-4442-4cda-aba6-28763e4746c7", "value": "T1997633C0E5CB0C0AC74B543DB321CAF4ED0459B26E014285995EEF9A2A7B792D79F43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936023, "uuid": "ecc6be04-d78c-47a3-93e0-04df0735cf8d", "value": "1121df302ff393c414fe24822a6585c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936023, "uuid": "50d8937e-45bd-4d00-8e03-9c49304e7d1b", "value": "98304:GR+0O0rpcVV5mQq5x1o9a1Ym7k4Zl/XiCkxrAXg/zhLFbliDGX9h/ygW/BYjbCMp:GRzLNQqJg5f4H/XoAwESagW/zk2oqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764936023, "uuid": "181774be-2367-4743-914a-d039ff174fc1", "value": 7261024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764936023, "uuid": "f1e77bdc-15ae-4b45-880c-4f0866587c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764936023, "uuid": "38b754aa-18c4-482f-a4a5-630ff4eefd4c", "value": "getscreen-824417860-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccee660-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909398, "uuid": "7ec06049-8b79-4338-8a16-a49fc7ca341e", "comment": "Malware payload (Mirai)", "value": "cb79df87d74813134579ebdceb2c9881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909398, "uuid": "3e20d1ba-88e4-47de-b156-29623888b1cf", "comment": "Malware payload (Mirai)", "value": "e23e229afd3252fcd523e130b503f35fffb7bce0e1e090145122a9510567a405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909398, "uuid": "cc6863bb-2199-453b-bfd9-e18491f85362", "comment": "Malware payload (Mirai)", "value": "a12d63e25d347fed2cb451acf0f60f864ddebf23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909398, "uuid": "1b91d7df-e738-47e2-b818-c31d5ce8c3c6", "comment": "Malware payload (Mirai)", "value": "58649b3a9195fc1f814a8055f3a87000cb5d39cb7e1a3ca9961e35a67c8e577509bee071abe9fca6b099ccb9ef2ef704", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909398, "uuid": "e0058e56-2a24-4f65-960c-62ac6945bfd1", "value": "T1DC735B45B8D1DA12C6C251BBFB1F829C372613E9D1DA3203FD255B6D7B8B86A0E3B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909398, "uuid": "692bdd62-c25f-4a39-86f7-5ac35a1f53f3", "value": "1536:OwJafbgqFO1cnHPBglLLSCemGCOqwUIi17+CwIu7xRk0EmSRc:DsF3ZICCemT17+YuTlE7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909398, "uuid": "e0db977a-e503-4a34-950d-80dc27f3c064", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909398, "uuid": "3aff22ac-c6c4-4b02-8f5c-10f525f9285c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909398, "uuid": "2bef8f0d-3921-41a8-ae04-1ea195a3a9d8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea98827e-d194-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909796, "uuid": "e3132526-cff7-4887-874d-b52c26fc6d6d", "comment": "Malware payload (Mirai)", "value": "8bc35409bf795e4c292f79bfb4714f9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909796, "uuid": "7b6d4fab-6771-4b72-a715-2ec39a14bf0d", "comment": "Malware payload (Mirai)", "value": "e2838ad07e8faa5a74003b0c67fe974d004ed2305dc3c8f322b416b5d2cb5d6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909796, "uuid": "d3bdb3b9-a3b7-4aa7-9727-bb56230750f5", "comment": "Malware payload (Mirai)", "value": "e6415b84a97172a397c5fafda39636d39822cd60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909796, "uuid": "b4baa621-a4a6-4833-831b-75f81daea376", "comment": "Malware payload (Mirai)", "value": "6edc2eea54b248b0da7326f361e46b7104bab0678db15bc7bb4677669aa37302e22f5ae46cc63f6393dc37a1b5ff0d39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909796, "uuid": "5e4876ed-ef33-4929-a998-af61bb4cbe9b", "value": "T1E8535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909796, "uuid": "7913c262-9947-4586-9411-f7afb19a9689", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8w:N1GjR8EVGOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909796, "uuid": "fdfeb0fc-0013-405f-854c-b81e628bf317", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909796, "uuid": "90b89853-b845-4690-9b72-86dfabaa23d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909796, "uuid": "9fa7cb07-304d-4ae1-8c65-1e33d9a87c9c", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbb5a55-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958358, "uuid": "c5e76e20-5a59-435a-8c40-f518faeeca52", "comment": "Malware payload (Gafgyt)", "value": "004a92e8ff2e14da4e81b89cf7527ba0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958358, "uuid": "0c6e3df5-3713-4b62-b033-d00be1170980", "comment": "Malware payload (Gafgyt)", "value": "e36fb14f09d32d99071795e2a4d3f128e164b2855161cc7fcd396e14c196b5c9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958358, "uuid": "b97331ef-d0b8-412c-90b3-188ad2d75f4c", "comment": "Malware payload (Gafgyt)", "value": "754be1916b5b9ab6f943ced78a581e08cff11823", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958358, "uuid": "394375ed-aad4-4681-b078-50b9810232ad", "comment": "Malware payload (Gafgyt)", "value": "a52344cdc5bf279270e4dabfa7d137fffd911c131baf65ee6c43ef0a03842a45b02e2b626b99c0ffae342c1809a7df21", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958358, "uuid": "57d4155a-841b-45bb-ac47-f104adde8cb2", "value": "T11E2121CF2114B645045DCF84206A4498B1E4EAD0B0A48E5BDCC878FBD584B1B6239EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958358, "uuid": "63ae6a0f-a911-40ab-b09f-3225558a960f", "value": "24:kpE52EeEcJEMNIZEtsEsEVKTDEFEHqEcEO/EiMETKEa3E3eM0E2EKPlEzEz8ExEM:k02EoJEQsEDQDEcqEE/EipKEaEeBEePx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958358, "uuid": "6e0ba3a2-0972-42dc-90f5-ca1adfc79c50", "value": 1210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958358, "uuid": "7fff5349-3609-4682-ae8f-f132d41eb029", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958358, "uuid": "256266e7-41a0-458a-bd6e-684564f5c8e3", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06675ad5-d1fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764954511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954511, "uuid": "96f76472-a0f4-481b-986a-4ee7da8efc0f", "comment": "Malware payload (Mirai)", "value": "c2bfe2f84f3eff42177fb796e0c8ebc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954511, "uuid": "c07db403-5535-45ab-b0c3-f1797313801c", "comment": "Malware payload (Mirai)", "value": "e379285742e4ecccd3defd15690c8b988eec922da217971b59103c36f4dac814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954511, "uuid": "f160377b-7161-46c0-aaf6-199a0307923c", "comment": "Malware payload (Mirai)", "value": "21053e1d5ad667bc29a14c01a587ee6d43f589fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764954511, "uuid": "907e5549-6e85-4795-8a1a-14c4deb2c58d", "comment": "Malware payload (Mirai)", "value": "32cc407566a815349fb05f5e5a75841ae37f7dd5d467f3bbdc1be7a0505b43d5379a99170dccb49a7626bd863d466c8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954511, "uuid": "d2c93bdb-d92e-4d8a-8035-b02000e853d4", "value": "T1E4D30845FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954511, "uuid": "51f8065b-e769-4beb-8c62-14d959cb30de", "value": "1536:VHQeHIjFlGz/r56QpF/lFcAPWZf4VTyqsTgDFYAvTTu2/oAdmlN8Vwyw2FR40o5A:VHQeF6Q79FcT4YZMDFYA9gAplNib8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764954511, "uuid": "1e462e83-fbd9-476d-a4bf-084be59fdcaf", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764954511, "uuid": "956a739a-f6d1-4f83-ad82-4894002c7d27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764954511, "uuid": "1ef41df8-63c0-42cf-9dc6-3aedc158dac7", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ce01f2-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958998, "uuid": "abe9f767-d965-4e84-a4ba-5f8e40d0b3d7", "comment": "Malware payload (Mirai)", "value": "f25353c76bdc404dd34e0a82e37292df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958998, "uuid": "30e7c984-904d-4030-8118-c3ba6dad132d", "comment": "Malware payload (Mirai)", "value": "e3817c1e41f4c53a9a365a3e4adb218f402ff5a832a5c1c683e169a4a80e469d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958998, "uuid": "d4544692-e1b6-4cea-98a9-57c880708715", "comment": "Malware payload (Mirai)", "value": "01f729c8bdc8d990c83851aeb590163449f3b98d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958998, "uuid": "c4e48306-0be8-4c88-8de9-62435b21fc2b", "comment": "Malware payload (Mirai)", "value": "3a07ff8a9d773f26b47917a9c351a5f95840cf3fbbbbb7c812a7715edeeecbc3ce891ddc77a39ecda62c08a13db201fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958998, "uuid": "fe1cef7d-4bb0-4ba2-9d42-adf94148fe4f", "value": "T1FB1108FF044DE6344A809959B0B3886D743307EBA0E5D609A98DE127B2CD928B133E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958998, "uuid": "ca827535-eaf4-4cf4-b1d9-f7b5d11a0acb", "value": "24:Z+ZOBkX3v6oYkX3v688kX3v6l5Dl5nkX3v6aO9kX3v6SmkX3vXw:UZAk6kEk2n9kykykvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958998, "uuid": "e0ecf5b5-2382-432c-b216-021048c5d26a", "value": 867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958998, "uuid": "74ff7657-b1e2-4da9-ae90-826c73352ab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958998, "uuid": "af47af8e-6bd4-4c57-9374-ae9e78a4fc64", "value": "fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b935bfa-d1f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764951647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951647, "uuid": "12860899-1e62-45df-88e6-62f75f6e3d7b", "comment": "Malware payload (Mirai)", "value": "2404b1ff30cf374d912e26fcef2214ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951647, "uuid": "6ba0fb32-452b-4492-bb5a-6817855a0c02", "comment": "Malware payload (Mirai)", "value": "e3c39af23ae738c032ee7f9e5101812cfd12f483c360ac43ef8ca3d975a54af3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951647, "uuid": "b733f28b-b399-4d7c-a3fd-a325bb4c690b", "comment": "Malware payload (Mirai)", "value": "e951419d7dc992ef08ffc3fdc015c1643251902b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764951647, "uuid": "e70d8e03-d5e8-4ec2-9669-06b8c65d28d9", "comment": "Malware payload (Mirai)", "value": "c9694b15e5f054b38ce7c80e7cf291872b161ada8e1939fc636048d11d08d01c209408f54e9cbb734a41b80eb84fd1b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951647, "uuid": "25e9da94-779c-4584-bc39-0e9dd5518328", "value": "T1B483023836776D6BF3EA62D0EFAD68C3A77249D88121C1E2342CED00DB25A779B04615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951647, "uuid": "afc5437c-bc73-417e-9e90-cde93207da32", "value": "1536:ROfuQfuvlyAtdcQxeCICt2cVVreVPm1Y28wkdXntiVg4wjLD+hW94u+qgw09G:ROfHMIQxeAt20VqVOK2RsiVQj3c04u+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764951647, "uuid": "c292287a-548a-4acb-b02e-c664d8e655b0", "value": 82104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764951647, "uuid": "c4bee32a-6e90-424a-8a57-92551a672dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764951647, "uuid": "47ce91e5-db8f-4164-9d5f-260f53b63490", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29b3bca-d1e9-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1764946210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946210, "uuid": "f208c68e-0ced-4dc6-b40a-f1cd3d8d2113", "comment": "Malware payload (RedLineStealer)", "value": "093311ceecd02d655e6e877571f1f270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946210, "uuid": "daa66075-668f-4e1c-952c-801cd7c5d21b", "comment": "Malware payload (RedLineStealer)", "value": "e3f1902421faae100167994834c994a1ae8c66ff91955011f85cc99339cd97e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946210, "uuid": "0e4acfbb-b41c-4164-bc0e-b450f71dcd8b", "comment": "Malware payload (RedLineStealer)", "value": "5d5ca5741877621c16287329a71e73ef5ab8310d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764946210, "uuid": "97fc16bf-86fa-4c71-af7d-e112ffcfd915", "comment": "Malware payload (RedLineStealer)", "value": "123d8dc62ee743fdec69b5c24e79090263efda48ba70aa65f492529083b7a0c2ff3fac12cbdb2edda79145f95bd42533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946210, "uuid": "0a6f598d-1f21-47f7-b2f8-485ddf85e533", "value": "T11AA401686298CE0BD9B22BB11C71D1B46778BDA9BC25C51FEED93EDB70797100A04393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946210, "uuid": "8df4c259-dc49-4b53-9a16-23542aff6fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946210, "uuid": "1d7b0ef6-9cef-4306-bd7c-736b7eca5588", "value": "12288:udnT5+/mylebeLHNMqMYkkrTQOP2XbLACO3X:u9omyl4qeqMYVEOPUbLAdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764946210, "uuid": "af193877-53c3-43ab-ad1d-e01ce80c1768", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764946210, "uuid": "c6593683-c207-43f6-8e65-d88c8adde86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764946210, "uuid": "a2b73507-93bb-4760-96a9-7de136113b61", "value": "093311ceecd02d655e6e877571f1f270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b74536b-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958948, "uuid": "a9e9faab-e480-4e84-bb85-77b4527b8600", "comment": "Malware payload (Mirai)", "value": "540d87273de4e7403c54380f751e6e20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958948, "uuid": "cf3b333c-d223-46e1-92d5-8e6d8b86125c", "comment": "Malware payload (Mirai)", "value": "e40d5e1ae2f59cf1fd8c0399dd6c1dc7f8650d02b2fa9c49defe62fb5d68669d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958948, "uuid": "df5bd851-faeb-45ed-9619-81aa3d1d0f7c", "comment": "Malware payload (Mirai)", "value": "739a6f0c0b2f13d37f1e9688dfdc08b948d64c0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958948, "uuid": "f7169537-9fa1-43ac-9871-18a7753d0f81", "comment": "Malware payload (Mirai)", "value": "648459eb0493afe5678d0edab102a664665c0ea1d3a5f21605117daac0e7540c472ff9760b62036a4fd9da9a08550241", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958948, "uuid": "3cc7e9cc-c971-484b-a27f-c563bc3a8a39", "value": "T1BA332841B8819A17C5E422BBFA2F418D332563B8E2EF7217DD225F15778A82F0D77642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958948, "uuid": "f0fca38c-6c71-4f54-8e13-faffb5b49827", "value": "768:Gkcr2Sh9iba6XSODzBlZ1m8MAjIGlzjUeSFUU34ML1N0xg8fJPou:Grnh4zBX1JxjIG6e2UE+Hgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958948, "uuid": "38984063-16c8-4c7e-8d19-4aef29f025c8", "value": 50484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958948, "uuid": "f0f107b6-151a-4272-bca1-df0736cd7508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958948, "uuid": "c490c3e1-bd23-4dbd-89f0-47e0d74760c1", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908d8665-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959038, "uuid": "4327df99-a7eb-444c-9afe-97025ef05b03", "comment": "Malware payload", "value": "eff60926a09fb2973ec4cfd7689f33d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959038, "uuid": "e63bb88b-5952-415f-b991-faa1b7089c29", "comment": "Malware payload", "value": "e433a4a5b6713918567da9891b0dff78d9df6b1d0ae95259017ab36b22905722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959038, "uuid": "fe5841f1-fd8f-4b03-b7fb-d2b61104b758", "comment": "Malware payload", "value": "383e405b1d56e850da9c924e0d3c872d099b31a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959038, "uuid": "1f5ed287-8daa-4a18-a5bc-8ad50fda6d80", "comment": "Malware payload", "value": "49cd5982695d12ae0f006874e82dcdd50b0b0f829859fd413674c7fcbd502674a6811b893f1155c18083de826e25caaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959038, "uuid": "82dbc7dd-7cc6-4a11-bf5d-b1dc683efa8f", "value": "T1A703855A2E228FEDF76D863047B78E25A34433DB36E1D684D29CD5002E7064E285F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959038, "uuid": "b5c6e725-a83e-4c31-8d9e-d7e7d19b3130", "value": "768:QJ6TklaLIzS3wMdPFwJwLwZaTNcEctTycG/G+TvsOPB3WYsGhTKAi2qaFFY6CIa4:U3VekaRGNOPTsMGUrYUa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959038, "uuid": "6ccbf6e7-aac9-446d-a0ab-d8559311e4df", "value": 39804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959038, "uuid": "72e94b70-7412-4fe9-9bc7-33cc3bc68947", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959038, "uuid": "09fa4e0a-94db-47a4-b80c-539c9d627c36", "value": "kermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713a8115-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958985, "uuid": "cc52ba1e-0934-4290-b6d8-2ab854398f03", "comment": "Malware payload (Mirai)", "value": "aad631b00aaa196010d6e61114923d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958985, "uuid": "060f2bd4-a3d1-4d9a-8c8c-7c4d2d8ae81c", "comment": "Malware payload (Mirai)", "value": "e4516536f3f2d6b05853adf10737a56269a0aabc022117e0708c6cedd0303ce2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958985, "uuid": "79a1e60a-2953-422f-9f1c-d79ee31332e6", "comment": "Malware payload (Mirai)", "value": "73ef5c9a7792405469188e01fdb6a2ae10f3f39c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958985, "uuid": "ddf847bc-e6e7-4b60-9b4e-b7deef11a04d", "comment": "Malware payload (Mirai)", "value": "b1185f4b842b9184e4a89f2116930f66afa72f58abb69552d7cbc277737ea0868420bd89f50d293925c99e51f0c94050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958985, "uuid": "19162d11-d32e-4b6f-88f5-4d6ce812f7ea", "value": "T166232AD9A401AD7CF84BE77E88120E18B522375510831F3B67EAFDA36D722945C67EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958985, "uuid": "f80d709c-337b-46ad-a584-a5fc95a37aae", "value": "1536:8f4q813HfXHEmY26D/YN8u5ZqyK//2ARc0:8f4qc3HPEIcwxw5/RS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958985, "uuid": "67274023-9fe9-4594-8c27-bf9dc362297e", "value": 50020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958985, "uuid": "517fc488-6245-4cd4-8e88-dd9ff4add4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958985, "uuid": "a4e98ab7-f00b-4e3c-a3ce-6459b9c2d530", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987a5fec-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959480, "uuid": "14a0d843-3a7d-418b-a938-82a8e5395a40", "comment": "Malware payload (Mirai)", "value": "1c5d25a794ffbf92bb91248b7f3c93bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959480, "uuid": "637f033e-9424-4f68-b019-23ab4318a884", "comment": "Malware payload (Mirai)", "value": "e4917f81856f452e4b866e440d0b7b42f3c2b00674a9d5bcaa7c445ed7b58536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959480, "uuid": "27126f57-d4de-4556-8261-6b5311564b2e", "comment": "Malware payload (Mirai)", "value": "5eb0448cdfc5f39d3300b876ab4b3c395e13f99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959480, "uuid": "fc332262-4535-4815-b136-adbedff83e91", "comment": "Malware payload (Mirai)", "value": "d13c396e89e9cc22a56d9f34ed4f788ab33d081936769c1e1a41da11a181d1238dfd0f592b7f3d0bda3a4ab30c8095af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959480, "uuid": "ac6eaf58-95c8-40df-b487-349009d755ac", "value": "T1A753B519BF650FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B19F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959480, "uuid": "8d2b71ee-c3b1-4d05-9c72-e81d5d0a8ac6", "value": "768:mnCmOWbxVYmjWtASw5R8enjeUEgpZScyXiSAK2yaEGw:mnCm9Ni9w8ejnEqZScq23s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959480, "uuid": "c3bdc740-bfed-407a-995e-5a819c010eb7", "value": 61032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959480, "uuid": "6df5ff99-6aba-4fd8-97dd-903f1c906fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959480, "uuid": "547c352d-4e9d-4a76-951f-0604461876fa", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2499cf-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917503, "uuid": "e4afa2f5-c27c-4674-9646-71e26b9eada1", "comment": "Malware payload", "value": "502910dfba0022993a980efd28062426", "object_relation": "md5", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917503, "uuid": "26b9269b-dad3-4adf-917f-c7ddd1ec04f9", "comment": "Malware payload", "value": "e4ccdc3b10a5af54723d84f9db4de8c481e415b0ac6d8870435dd4511ecee66c", "object_relation": "sha256", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917503, "uuid": "2cff2b72-cc68-40d7-9b54-e995059e431c", "comment": "Malware payload", "value": "62828222f886bf1f04125bda18bdb5a4de77f614", "object_relation": "sha1", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917503, "uuid": "b3398570-f973-4044-8af7-6ea2e3d24a12", "comment": "Malware payload", "value": "0333e1b9d9a28eda137b4b7dfce4edf0ec2470619f6c976551458fa84c0fb1787d64ab382bc178718b168a2249d747d3", "object_relation": "sha3-384", "Tag": [ { "name": "194-11-246-101", "colour": "#760C5F", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917503, "uuid": "aedf1ea2-f876-40ad-929e-7496ffa89ea9", "value": "T1A036336B32DFAE35C527B2786A95B04820B6D737F8B1A0130719B3C2063F7525B86D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917503, "uuid": "a19c1fb9-fd31-470e-b401-d7bc17da8260", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917503, "uuid": "14dedb20-874e-4c0e-aac4-f2c352f2de67", "value": "24576:lXLRHehffN2+RN1dfNy0ES0CvxdYyhs1+fWbTxO2ZwBRHLjdml+az7nA4HetO:PmN2cXY0ES0Cvth4dbTYbLVml+KHetO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917503, "uuid": "2c843c42-0589-4cc8-9061-34e63f009c08", "value": 4927488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917503, "uuid": "d5cfc2e4-5757-4bce-a519-4126fb4f4876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917503, "uuid": "31f742b1-c9a9-4223-8319-bdc481c42d8d", "value": "e4ccdc3b10a5af54723d84f9db4de8c481e415b0ac6d8870435dd4511ecee66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313e1432-d1cd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764933967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933967, "uuid": "27bcb025-c329-43da-a1c0-f5a2d151aff9", "comment": "Malware payload (Mirai)", "value": "a81633d8c8cdb6710e36b3ac7451702d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933967, "uuid": "3b79d815-431e-4d3d-9020-60684ecf0923", "comment": "Malware payload (Mirai)", "value": "e4e358c107cdf3f769d62887a0a9aab2f77cf6e01127b4a8a7e2dd34cd53cacd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933967, "uuid": "de3f155e-b0ef-4a6b-9b04-56fa00b2f72a", "comment": "Malware payload (Mirai)", "value": "db3021e1b75af0a052024e94b47515e7b1a558e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764933967, "uuid": "bdcf07e3-a3da-4bab-8589-9473fbda06e8", "comment": "Malware payload (Mirai)", "value": "ff259588be618d1bf45b506788f02c95f1367e9da6f0ffe8ecb8db14a355bafde678ef8c39d66f2569d80fc04ea1d83c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933967, "uuid": "f5295ab0-4f07-41dc-ae7c-9676ae12ba86", "value": "T125A10AE674B5977A6EB0ED7371D6C652B14061AAE0D68D0BF3D1F0E8044EF61F484B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933967, "uuid": "97deb265-fd96-4d9a-b4d8-bb2495945cb4", "value": "96:vbLApSAPXALTAzOEp6AbZAZuAbUADnAjRA1EAD4ADpAR8T:/3IKmO46+nt4IFRU9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764933967, "uuid": "c8c8c1b4-f169-4e44-bdb6-3a8bd8bfc05a", "value": 4844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764933967, "uuid": "618d2c81-92e6-4600-9d55-621396e69c53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764933967, "uuid": "8ceb8672-758e-44bc-84e2-b4a0be8159c4", "value": "huawei", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc9c437-d196-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764910389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910389, "uuid": "e608eebb-eec2-43d9-a1eb-f65f1fdc6994", "comment": "Malware payload (Mirai)", "value": "fa6995bdbbfef03441290c943728b50b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910389, "uuid": "d1ebc2ac-78bf-4dd8-85bc-89d18e21c12e", "comment": "Malware payload (Mirai)", "value": "e51a017726f799b79b53ba02df6cb59c66eefef2e794e8bd0559dbbe3e99a126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910389, "uuid": "f63d94fd-cb1a-4909-affc-13b9fdbde917", "comment": "Malware payload (Mirai)", "value": "8db164b82cb156448caa65abc0e76a7ba821f3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764910389, "uuid": "44e250b9-4259-4bcf-989b-24de47b3cf84", "comment": "Malware payload (Mirai)", "value": "f414ed3e19a81cc4de4c26a03cea52350fc7f06e7bd05ec720dff7ee5b8acd93e9587bc05a0465fb988da90618bc0a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910389, "uuid": "d2299427-3ddd-42f6-8404-f6983b4d6d08", "value": "T15CB2D13460DF1271D67154BA6EAA9320A69F02F969FF3E61A411073CAFC764362643D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910389, "uuid": "151850b5-8ebb-4a6b-9272-90687af5a2de", "value": "384:4CTKz9PkfZD5KdUgf3wdysmiENBMyENcO9OBXxDeGOZhymdGUop5hu7O:4CTK+B5KdUg/wctv/JENcO9OBXxcs3Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764910389, "uuid": "9e6497fa-209e-4f9c-81cc-fe364211d1cd", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764910389, "uuid": "a9f9cdc6-d3c6-497c-b978-bc2ce04d810f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764910389, "uuid": "9ba73f16-3e61-47a3-9ccf-8b0b685c4634", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15760eb3-d193-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764909009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909009, "uuid": "7778e34d-e6f8-4534-9d44-4bb0a19d7881", "comment": "Malware payload (Mirai)", "value": "9a4061b1855e8ca5d5abe183c72f679f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909009, "uuid": "6a046355-4d4f-4b54-beb1-971073a4f7b6", "comment": "Malware payload (Mirai)", "value": "e65622d833b92f8f88a2f93ded1dd0a85cb13f2015a24a2a8ca609ccf797ad20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909009, "uuid": "425d857b-39e8-4b10-ab6a-3e3f4e49b632", "comment": "Malware payload (Mirai)", "value": "9ddf7104719aaabba9405244c641983751c8905b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764909009, "uuid": "4a658606-f9aa-4f90-98a5-4a241768e77d", "comment": "Malware payload (Mirai)", "value": "3bc2ec039c92d1186afb87503f3b8cfa8fd87b978ac50a58c987a5928df555f6b51b45793ff0a42230d4461df9dca578", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909009, "uuid": "1910bfd0-6962-49d2-86cc-d4e0a243c99a", "value": "T1B2A3284ABD81AB11E9C525BAFE5E518D335307ECE3EA7102ED105B2D66CBD2B0F3A411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909009, "uuid": "1f37ddfd-6af7-431e-8129-507de1ea0db6", "value": "1536:JWnjh67eaamG61o+xXJ8sV6ziOYskTkWfilBriWWPaD9PwY7jY4k0YmS5EB:2Dml1FPV6ziOYsV7WPaD9PwX4lY7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764909009, "uuid": "75f7a122-e63b-47f5-90e4-e5278deada33", "value": 106932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764909009, "uuid": "275469ae-daf9-4049-89b3-07fa9842e2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764909009, "uuid": "4f6916da-22d6-4b31-a5d6-fb7843f1cc90", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d46081-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959501, "uuid": "d59ccbed-1e60-411d-9aa1-8438df0c839b", "comment": "Malware payload (Mirai)", "value": "8f4a8a4255ce1d740a307de4decd88a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959501, "uuid": "739fa047-f29b-46ad-91f1-23f567582347", "comment": "Malware payload (Mirai)", "value": "e69e61b03c24bca2fe8f4e840fda23d30884d766414f9a34b59ba21a39764017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959501, "uuid": "e325d2eb-8aa1-4c85-ba35-822d70e4f3e1", "comment": "Malware payload (Mirai)", "value": "d771dad103752806a36c2cb782315c56510ebb34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959501, "uuid": "41e39ee4-7727-417d-a7c1-a7c361d5aeb5", "comment": "Malware payload (Mirai)", "value": "f725cfaecf2f40b843f504fb587512ee81b4318ebba563e93dbfe3524e50ef2f117fecfafa116201954868cc6f8abe80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959501, "uuid": "5b9c9448-f8d6-4104-a8d5-5a17613630c8", "value": "T134933B0123394D5BE8975EB015EF1FF183BAEC8119B2B504A91EFFA40772BB21489F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959501, "uuid": "4bd0c710-7e00-4f61-bdfa-f483377cb55e", "value": "1536:r3P+zslCXuREVhfnzvEPtjUzsnRiDwNlL40pJU5oNGvYS7wU:rs5uRyfnzqA4nRiDspC3kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959501, "uuid": "9754e098-238a-475e-87de-9e8f18f10950", "value": 90351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959501, "uuid": "ca12fd61-26cf-4fe6-9fed-939243f7df22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959501, "uuid": "2b1bd8eb-82da-4148-875a-9efe52320184", "value": "Omni.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00088093-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958366, "uuid": "ceb7a3f0-c48d-4c6c-9bad-33667a46215a", "comment": "Malware payload (Mirai)", "value": "ebe79e90019f90e68a737ca2d8fda576", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958366, "uuid": "78b05c3d-5b3d-403c-ae22-17e5dc68a36a", "comment": "Malware payload (Mirai)", "value": "e70983ec4c9ca9fb06a1bf65ce8c03a640f4f2903e19962a31791f43aac8183f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958366, "uuid": "60972751-a42f-4a21-bbe8-7aa3e56fe6f3", "comment": "Malware payload (Mirai)", "value": "c600439a47f0d785fd14238544a17f069618753c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958366, "uuid": "07ab85be-df97-4e45-b382-dbd3982c94bb", "comment": "Malware payload (Mirai)", "value": "23610b15b942b3a707d842a3a825774ce402672fcad6fa0241ef5efdf58825e06aca383ee5c5e644ece511a35e3472c5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958366, "uuid": "1d9cbd5f-479d-4716-8082-d2cb99d61f40", "value": "T190D09EBD756B53B70B44DF02E0664C90703B97DB94B1CB15B48DBC29B5AC6203132F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958366, "uuid": "22b30ea6-e2bc-49ee-a6f9-7bc516cdd4c3", "value": "6:St5/+yGMt5/+sLit5/+6NIl5sht5/+GFa0LKiX:Ah+wh+sLwh+6NIl5sDh+H0LK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958366, "uuid": "1acb8b38-a1e3-400f-80e3-5d454c0c4766", "value": 253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958366, "uuid": "c60e3400-d06b-406d-a35d-0e3b7ccc2590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958366, "uuid": "93f664f9-4993-44eb-b3b5-f8d627430d1c", "value": "lil.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef9a0eb-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958981, "uuid": "ad59f261-f276-4396-96c6-b54f91ad7bc7", "comment": "Malware payload (Mirai)", "value": "9dae27ea6b904b373c1160688e526907", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958981, "uuid": "0356c80d-df6b-4fce-83bc-db881f0e3b30", "comment": "Malware payload (Mirai)", "value": "e7d7e615632b35a6ad23e2d0185edc258466643d7cab75becf972105ee8c9bdd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958981, "uuid": "2853873c-bac9-4895-998f-f6b1816745c0", "comment": "Malware payload (Mirai)", "value": "315ba57897049e69dd92ada6847ee513001a8537", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958981, "uuid": "2341a543-b807-4346-9903-5b71661cd4b1", "comment": "Malware payload (Mirai)", "value": "58f39fb433c92d111317f99da9e469c1ae878a8fe76d98fb43150b144901a1ecd13ac7b7e17ba113ef2db65ec40755f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958981, "uuid": "35b1a452-cc37-4863-9c36-d0b9c76f762c", "value": "T17C11637C4422BE0081281E36F07B4557723287DF74BBC658EDCA513DA3C9890A022F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958981, "uuid": "8165c02a-133e-43ce-8c4a-c1013c0f2719", "value": "12:shdeDha9DhJaDh+62DhlOBtDhnsDhO2UDhwDzDh5aDhcDRT:eoUkYlYvIgqQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958981, "uuid": "b527496a-9895-4011-bd16-1b2cce6fde55", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958981, "uuid": "524dae39-86c0-49a6-ae43-d7f38de73955", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958981, "uuid": "ee7a074f-bb8d-415a-9e23-0980a4678b1a", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df9bd6c-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898286, "uuid": "66a348ea-5518-4486-80c1-cc596b8afa59", "comment": "Malware payload (Mirai)", "value": "92ceae978a1b3ab464b269812a473725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898286, "uuid": "b1981e97-bb79-4266-99cf-7fd9acbe0c09", "comment": "Malware payload (Mirai)", "value": "e7e90d627065a2f967342122d99bc98f2e0eaa0c31c1b8f1951c95a27482e9f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898286, "uuid": "e32e45c1-74b0-4adf-ac5d-e3e8b56e3746", "comment": "Malware payload (Mirai)", "value": "c12c81e6d687544b4d4c1513b244f5f11e9d02f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898286, "uuid": "c0915754-6c15-4dcb-b4fe-d76da5a6144b", "comment": "Malware payload (Mirai)", "value": "b49c1e0e60c550f6c9399f8baf782bd452683a85400ec49192302ccb647fb70c299c013d9eee6ab2c131d21b626e132e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898286, "uuid": "5abf69a9-d6fb-4c5e-8139-953b678393ec", "value": "T116837DC49687D9F5CD06467571B3EB338636F437222AE983D3D89A23FC529429A072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898286, "uuid": "63563cdd-b0a8-4f4c-a91c-05c95bd39e13", "value": "1536:6lATE58h0hGZuf/H04AZBCyajO1sL6M3htGmwmHrHhRWoBh1gcASCs:6liE58h0hquf/H04AZBCRa1sL62Y5orL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898286, "uuid": "c98f49d8-7bd2-4655-8801-99f47f7fff78", "value": 84272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898286, "uuid": "8536c0c2-1b56-4598-a636-42006376d3de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898286, "uuid": "b240a473-eba9-43cb-ba10-3a39b27d3329", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d006bc-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944011, "uuid": "7eb7cc00-e8d6-44c8-99b2-2a3834b8f557", "comment": "Malware payload (Mirai)", "value": "4795da1696b8aa17bc714f63f224716e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944011, "uuid": "82a7942e-6501-4dda-be18-ea5243c97699", "comment": "Malware payload (Mirai)", "value": "e7f71dc40fe3575e32b85cbfa77584a77be6b0e8251f68adb4ceca0b0cef9f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944011, "uuid": "10d03d18-8a6c-4b0d-9121-cdf0a63326fb", "comment": "Malware payload (Mirai)", "value": "e161d6991b239050c8e725224901c5903ee08ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944011, "uuid": "fb046b4c-e39b-4779-9c3c-794973916002", "comment": "Malware payload (Mirai)", "value": "107aa9a19f3212c0643d0aadac37be7ff1986d1c9dd990b01460404fcc405b457d5298d69a0e6f3314bcedc0b6e9ec63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944011, "uuid": "2036d8d8-0b11-4b08-bd2d-d9a46462861a", "value": "T149B43A56F8809FA1C6C12976F64D86AC331347B9C3EB720699245B343BE786B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944011, "uuid": "89a246eb-c109-4441-acbc-860189c6b05c", "value": "6144:hk/ZK3bezcNWLrKyxXaLf+ClBMKdoNW2wIBGG88qkddDuTHl6t2MKAz9Hjgpjj+Z:cHcEFpaTTlB4tPFqikTH7MVgpjj+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944011, "uuid": "d5cbc27f-f07f-4f18-8384-e004f0069471", "value": 513384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944011, "uuid": "2a5d25fe-70c6-4983-a5a2-a64356b9511b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944011, "uuid": "e39b8905-aa2d-4c20-9c62-e1ef0f3d319c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6fcb3b-d235-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764978732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978732, "uuid": "254de7cb-872c-4d3a-abb1-5294bb81e2f1", "comment": "Malware payload (Mirai)", "value": "47eacd796b1d636a6e990292c75a307b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978732, "uuid": "40f20707-67be-4f36-904b-cc04f535266e", "comment": "Malware payload (Mirai)", "value": "e9523148ccdda530ca539f31bc3b0a317f9dfba41c749c44b4d6e6e754f1f2a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978732, "uuid": "63e89dd2-bbba-455f-9765-ccadf56e4e5f", "comment": "Malware payload (Mirai)", "value": "8a4aff43ea66e3a7870b20b555c504ab2e2aa3c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978732, "uuid": "c5dea459-420d-44e7-a2f3-a4a725ca1860", "comment": "Malware payload (Mirai)", "value": "07eb14b284519efb3f303dd7da9ee2598aaf0f31abb02e2714e7b6f27fe1d57251e15277e79694b0c7e5df35480f6a16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978732, "uuid": "264de93f-1063-41e0-90a6-2b989d55e533", "value": "T104B64B47EC9504E5C8EEE630C6669263BB717C485B3063D72B60F7682F76BD06AB9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978732, "uuid": "ba9f058f-a6bd-484c-b403-0da37848e203", "value": "98304:4wVXKnd8/Lqr8C1DMOIPw5qhEnrOM0YAFucoe5LNHnxa:Y8/Lqr8MMEniM0YAYG1xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764978732, "uuid": "a49350c2-1779-4de7-a93c-5f9ed89befea", "value": 10858648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764978732, "uuid": "a56ac700-dfa9-4f16-95de-0413af96915d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978732, "uuid": "25cd7d4a-71d5-42c4-a1cc-71c653cdea0e", "value": "3.47_Stub_Linux_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd173790-d234-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764978440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978440, "uuid": "24c9f32b-ce11-4ab6-97b4-d41ca59d6f84", "comment": "Malware payload (Mirai)", "value": "5e566139094f3c09b3faab21c4e18941", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978440, "uuid": "45d6e206-c9e0-4fa1-bd16-077129e44573", "comment": "Malware payload (Mirai)", "value": "e9ad9e883481facc31b94ba170a7715b78d9dade69f3c64078fba8e81634e2e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978440, "uuid": "e28ea3d8-7c72-45e4-9be7-fdaf0500e788", "comment": "Malware payload (Mirai)", "value": "82a349a4d821216d54657276ba79df4a6afec949", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764978440, "uuid": "1d36b942-371e-4282-8210-b28601c42149", "comment": "Malware payload (Mirai)", "value": "383f6363a570ea2b42ded817d2e8221a0401d87fb879e9dd41def91a1fa204eeb10f1139e70b5c3902047f4d090db966", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978440, "uuid": "48889f12-49e5-4640-83a8-7fb476ff0df2", "value": "T19451B7FD1C6A032A5D469D0BE37F54883033CAEBA465CDAACD4A7C359389D753122D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978440, "uuid": "66a95e4f-a1e9-4f92-a2b2-6c17c861dc8c", "value": "48:SontsbrH2HL54/3c3cTm8yknfyiIYtoWSQKazsssMI6oW1:SotsnH2F4/3c3cTm1kn6xYtoWSQKKss5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764978440, "uuid": "e17364e1-ff7c-4f80-a6a5-10adb267cd9d", "value": 2537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764978440, "uuid": "1a951913-b2e9-405a-a6a5-4ad0886c8be8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764978440, "uuid": "b9425fa7-ca6d-492b-9c61-aa6f9838c4c4", "value": "jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c0f1a5-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959504, "uuid": "973c7f2b-f858-4adb-ba03-30429313a7a1", "comment": "Malware payload (Mirai)", "value": "e425d03ffb4695181efc9494be77c8e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959504, "uuid": "5f256129-763a-4ee5-8cb2-67b28de01e52", "comment": "Malware payload (Mirai)", "value": "e9f03297b35e5993ccc29339f4c8d52adea26f26b7a5c016e32eb51b1642d9bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959504, "uuid": "569b5e59-98b8-41f8-a206-27d8403c394e", "comment": "Malware payload (Mirai)", "value": "ec38155bae8d490b278562c9558e989ec3f62fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959504, "uuid": "d35da0b6-55f2-410d-8df5-0fc6c4972b5f", "comment": "Malware payload (Mirai)", "value": "a43e2626311e9893cbfa86af918de47f46547f39f1eec637db4b55985b90ecd83ce638bc2fd9818d8ace28f8e9da2356", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959504, "uuid": "2e646787-963c-4468-9010-4ab99c7a0b9e", "value": "T196137C7BE46E5E64D0460230B4649E342F13F6C493536EFB19AA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959504, "uuid": "4bb07536-bb79-4105-b7c7-af3fbd6e4cdd", "value": "768:2aRH4ge4hYyFDinQT3yMILrGCudezHsC3o9Zc98C/ww:2aRYghh/FmnQyMi/udoHsf928C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959504, "uuid": "7dfc94c0-0eeb-43ea-a0ca-31c4b65b0402", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959504, "uuid": "cc0478a4-4792-4d6b-9441-56956565f99a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959504, "uuid": "d9c5827c-b98c-4a9d-9b4e-a74c4d147cac", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcf435d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959063, "uuid": "a31a0648-a028-4b58-88bc-d8575d601a18", "comment": "Malware payload (Mirai)", "value": "555cc81f3765b0227d6b148fb574808c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959063, "uuid": "a71cc45c-9535-415d-9c27-e91490031aaa", "comment": "Malware payload (Mirai)", "value": "eb006f24c7a82e99df1df70675daa67f1d2d42bdc443ab2c8e90b75393cfd35f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959063, "uuid": "685bd08d-bacd-46b0-87ac-8415fc4cf370", "comment": "Malware payload (Mirai)", "value": "a76f50b8ff279cf9cc2e3edb4b130031467048f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959063, "uuid": "5eba7cc8-3ffe-4756-9940-098fae5e7ad7", "comment": "Malware payload (Mirai)", "value": "c45ea17582b90add56471363360c425c1ccac2e949cbe540dd55d774198c6b0936158b52fec56894c3a092e73115fafb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959063, "uuid": "530510ad-ba0f-4a1d-b952-09bd4ceb0f99", "value": "T151D012FE002A2692D100AE022016B12EAA6787CF71624F8695CC3932BA4C924F751E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959063, "uuid": "6600540b-c09f-4117-ad54-7dfdee578790", "value": "3:LgHKRWyg/w8NBzSa+ANja4qM4oq8Ui9WFKVgHKRWyg/pONBzSa5Ap99HM4oq8Ui9:LCP5/wkPj5Zq7FgCP5/MyvsZqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959063, "uuid": "a627c52b-fe02-4587-b996-afd2d13c9664", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959063, "uuid": "d880115e-aa47-4227-814a-ded6c5a61f70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959063, "uuid": "c8765db9-950e-467a-9ffe-14ce28c2d7d1", "value": "gig.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb77636-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958419, "uuid": "b604e938-b068-4909-b917-7d6a2e1d6dcd", "comment": "Malware payload (Mirai)", "value": "249ff537589a0cc2a8d2ebbe27686fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958419, "uuid": "2c01b11c-939c-452c-b3d3-f3e42673ca75", "comment": "Malware payload (Mirai)", "value": "eba6e16c6229cff1328f6351ce212abcb8d653989fa5a8b198434bacbba6300f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958419, "uuid": "3eec4b50-52fd-4209-b57b-e855b5647129", "comment": "Malware payload (Mirai)", "value": "0d2f464e03cdc7262284e17d6469d8456fac4648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958419, "uuid": "2b063de7-4926-4633-bb2e-3f7a732f8ac5", "comment": "Malware payload (Mirai)", "value": "2476e3b6a101866d8f24d0ddf089eafe3ab5364ab19663a587440b98ec69d819423d46df0426e2d4129debbdbeb47be2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958419, "uuid": "eac31e33-2473-4f76-8e37-49838181aede", "value": "T13F1318C4F553D9F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958419, "uuid": "9b293ba3-c094-4f7e-a271-06687580f67f", "value": "768:xMlB2zs8ssGfrRI6aQ2KEenzTq8uDOyca95VlVs:YYzs8ssGfrRI6aVKEefWOrarVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958419, "uuid": "afe4eceb-a190-4712-b50d-86a3235fc9c2", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958419, "uuid": "ac290db0-5fa5-4430-bd1f-628a20e96ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958419, "uuid": "424b244b-2bfd-4354-8264-bc98e398dbf5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72e312a-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959075, "uuid": "e0423524-3500-4ece-a270-a394bfd1bf59", "comment": "Malware payload", "value": "99eca044fd94ffb1f8aad3128301d6b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959075, "uuid": "868e85e6-1935-4540-a6a2-f4687ea8f043", "comment": "Malware payload", "value": "ebafedd809f264edc20469685b855295f4377d2b54ada2c9802d27b04044eadf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959075, "uuid": "a1c2d7d4-7da0-4afe-8016-9294dbc91eab", "comment": "Malware payload", "value": "72fd1732a6ab21c2ec398eb281cfe0857db91601", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959075, "uuid": "f6e23e2a-794b-49b7-8f6b-a2b70afdab30", "comment": "Malware payload", "value": "959015859e44ab2d62927cb3482150bcef354181ad77383d1f553f7c372f67a0326c3630f8326b1d5dc122549d38f199", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959075, "uuid": "d50ac07f-effe-4399-be84-c35112f5d628", "value": "T1B1E0E51DC10C8BBFA417498F7EA839ED611E51591E8F1F0498BD2D1A74899285180022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959075, "uuid": "72fd2448-0bad-4351-b771-d6eca96be5da", "value": "12:/5949dJ3+aVvy4gZesFrFBEGgbu+yfuT+JF8EpASLye:ha9X+eVWrTBEGjTuyLpvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959075, "uuid": "d94aacb6-d7c1-4a4f-a2cf-3d2f29a9b34b", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959075, "uuid": "853efb70-81c9-4941-ae8b-7ac043b574cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959075, "uuid": "fd475a59-8b32-405a-825d-e40a8b94a7cc", "value": "ah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e49f46-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958454, "uuid": "0e9e9ed4-4fed-428d-9c7e-d34752b9c80e", "comment": "Malware payload (Mirai)", "value": "35cca39d0d4978db9ef9863f3f84266f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958454, "uuid": "27578ae5-e124-4c99-96b8-10e9756804a3", "comment": "Malware payload (Mirai)", "value": "ec4ae03960027985fdb5851ed1ace6c06118b561fd1796f113593f98866fedbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958454, "uuid": "c1f10c0a-3187-4ff7-bbcc-537c8e89e383", "comment": "Malware payload (Mirai)", "value": "d54b2bfd10f0b27703bfd20661bb895eefd2fce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958454, "uuid": "38982411-46ed-45c9-9ed5-2d1e44f795d7", "comment": "Malware payload (Mirai)", "value": "fe38fd448709faff8946975e58f3f97d2116fe498a61ca9ce05de3eabe250a701f4bff2c61a4b77560d21b370ec657ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958454, "uuid": "eb2c86c2-4d38-4283-9d71-48e9b3df413a", "value": "T18D040806BF210EFBD8DBCC3B45B8270514CC586A22EA7B36BA74D458B54B25F16E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958454, "uuid": "4bdfb705-becf-44a9-9836-fa9a0e3e4a6d", "value": "3072:KcJcQbdC6WRjG2aQavbgKmaYIcnInJMXXNc54ozh5:KcKQbdCVGZFzmaYIcnIJMtcZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958454, "uuid": "c7f5322c-c8a8-444c-905f-5315af8a8947", "value": 182584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958454, "uuid": "a8be0dc8-22a6-4e0b-805c-cc986c97b9f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958454, "uuid": "53861504-5da0-4b8e-a329-3a81a57a63e4", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a829a769-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764959077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959077, "uuid": "67110584-a3b2-419e-a741-03e1522fee5f", "comment": "Malware payload", "value": "c0e201aef606463281ae1d68ad5e6987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959077, "uuid": "90614ed8-4385-48bc-b29d-0efea4307fd3", "comment": "Malware payload", "value": "ec808fb17266c4008b3c9b57cd3bc0f14e010ed85a67dc2d9a882e7b2c4439c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959077, "uuid": "e38214db-fa13-45be-bf77-2073f81d43b9", "comment": "Malware payload", "value": "69ccb25433e357adadb6de6f7cb1dde967c9a131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959077, "uuid": "d9433b7e-5585-4ec8-a423-fe1a70e348c6", "comment": "Malware payload", "value": "2d39eff03a710de619f3459990c419a0ea697eb0fa9e4da9d38e0826601d06631ad08d6e4b93c7a9a1bf343df992d3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959077, "uuid": "86e5335f-c50e-4418-91e2-f1106a6d9788", "value": "T1E2236C76C4BAAED4C15842B4E8308EB85F53B140D6571EBA6F8589A74083E7CFA1D3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959077, "uuid": "ef45ed1d-0fd4-4f79-92f6-1ad4845a5a33", "value": "768:Fa/wt1C+GSeetUzqcCxyHbJy6wI9h3SpvvQyJQIYmWUjUdCjocG/CBcum:Fa/wt1YEKqKHbjwdnbJVWkUdnT/CBcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959077, "uuid": "3bf8a52b-7d50-48f0-ad17-ef225f587d76", "value": 50040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959077, "uuid": "aff8bbf3-d8dd-4f47-94ee-a6cdcdccb956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959077, "uuid": "169435b1-dcba-4c28-bd86-e99fbae61ef8", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68271ee7-d1e5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764944367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944367, "uuid": "7700d3d5-b87e-4060-8d17-95daeb94731e", "comment": "Malware payload (Formbook)", "value": "15a5859af9a77f834d4deff36e11734d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944367, "uuid": "4a4fccaa-f2ce-4952-acf3-0cfb84ec749d", "comment": "Malware payload (Formbook)", "value": "ec98f86305bdd3796f997971809fce431a8da94e303b91f616965e9d484c64f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944367, "uuid": "478f8036-65be-4f18-851f-12e1b1c740ab", "comment": "Malware payload (Formbook)", "value": "1665eab324baaa14306ef0b178ccf7b7b0f2fe08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944367, "uuid": "dec672bc-bbef-4f41-acd0-2e22abcdd3d5", "comment": "Malware payload (Formbook)", "value": "630c06035847c9a10980161e4007223cfe6b267e06b24f080f3a3db08ffe533239eb6678c9a68e989cc3ce6af2e648b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944367, "uuid": "48b2154e-1ab5-4dd8-90ad-90ef1d0b54c0", "value": "T11695AD5D84B06CD26014FEB4F685EFD7CCEB5385162707520FE4858A6322C83FEAB6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944367, "uuid": "530a543b-ffcd-48bd-9e88-3b91cb03f7c7", "value": "12288:IykthlsFqtemQY6TLLyc+dDfRVZQLTuZd1xRL0j47/pTqiwyFP/IfrheEwOozp5T:nzxY62XlZQGRLPzztWKI6/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944367, "uuid": "2c7453c0-b886-441a-89e2-081b432c84e8", "value": 2061264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944367, "uuid": "1b95370a-1a01-47d1-a844-937d95d6cd7e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944367, "uuid": "dae8642e-5324-4e14-b33c-e0d5a936e6fe", "value": "Payment Notification.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b59f1f-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958348, "uuid": "328dec58-7b9b-49a8-a51a-2728ed13a87b", "comment": "Malware payload (Gafgyt)", "value": "ab56675934a6da9e8b933be043161fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958348, "uuid": "abaf70ee-e1ac-429d-abd8-d6fc5fc9cc10", "comment": "Malware payload (Gafgyt)", "value": "ed73578d3d88a3dde381c1c30e75aae9b704db4dcfdde3ff964ad13652f98133", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958348, "uuid": "4f2ea50a-b3a4-4208-b4f5-441e03219893", "comment": "Malware payload (Gafgyt)", "value": "086fb7cce2ebeac91449d687a4030b46782b351d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958348, "uuid": "5d0d934a-4c71-4334-899e-4bef9961792e", "comment": "Malware payload (Gafgyt)", "value": "a8463f90da29699d81bae694d651a6846ffd1a9988ce383674d517641de7bb877b4cf75bd58b90b3a693797e66373f78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958348, "uuid": "6f16145a-e171-4420-81ef-dc446938a13e", "value": "T19E932A47E9615BB7C0C66AB169E68D310713B9912F4F1B89713CA6F8074B8CDBC0EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958348, "uuid": "2b0b8f9e-777a-4a2b-b0c2-62870942af9f", "value": "1536:4TathcyY/axr6BrVtJtpGxgdKX+W3x8p0C+uzccmknVMOMuIfaW7:4aLdY/ax2BrVtPp8Xo08ZmknVMOtIfau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958348, "uuid": "f8bfcb3d-8590-45f0-ad8a-b13189299cf6", "value": 89186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958348, "uuid": "60c6f81f-3280-4ce5-ae4a-6fee4483d78f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958348, "uuid": "7ccdf6e5-2d3a-45e8-8b4c-1a546eba5a71", "value": "Fantazy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c91d2-d1fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764953420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953420, "uuid": "eb5b75e6-4558-422a-b9a2-602d35c2d339", "comment": "Malware payload", "value": "b8664029d8ec2458a817640874a9a0bb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953420, "uuid": "e5e8bf51-68a5-474c-a00a-f6cae690db58", "comment": "Malware payload", "value": "ed748bfb18ebd9e83b0b694894f34fdd47a8e615dadd54cf922f350085d1a7e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953420, "uuid": "8eb1d3c2-f4b3-4212-b726-e0900003578c", "comment": "Malware payload", "value": "4bfcf96fdf20eead450b5b76e9fd4bcc90ae7402", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953420, "uuid": "3aca3133-faa1-4da0-b5fd-14eba8ee87cf", "comment": "Malware payload", "value": "65ce8deb4a2e79297e21f9454b14562e98270b02b7ab129c7efd3054a0e2093219020c33529dd208532261c4655baea4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953420, "uuid": "77faabe9-a435-4fbd-a304-49dee6cbbc1e", "value": "T1F0460222378FC527EB5E06F05A3DC65E512EF9B7076142C7A3C8A95968704C22B3AF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953420, "uuid": "477640b3-e987-4dc3-a8f3-76533f4aa7ea", "value": "98304:EwmfkXTgQODqamRaApoSS1FNbieh++iZ1mg+cxKLDokM5PjnutEBhW2+apw:LmfjxqamRheF0ehxhQWD3Mpnu6W2pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953420, "uuid": "eb684bf3-d3ea-4caa-8f33-6bb19d3c3f8f", "value": 5764608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953420, "uuid": "0d03f0ab-8368-4459-93de-0aab341b1403", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953420, "uuid": "574e7aeb-474b-4988-860e-2b4e58f8002d", "value": "CarrierRegistration.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa370382-d1df-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1764942035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942035, "uuid": "8849a8a8-424b-4a46-9ccd-4510bdc27980", "comment": "Malware payload (PureLogsStealer)", "value": "e6a823f769e847a3999a6abfce5eb674", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942035, "uuid": "1838410d-cdf3-43a2-95e6-10fc184a7de4", "comment": "Malware payload (PureLogsStealer)", "value": "edbc086b7ec99b5fa7d682abde4501e0a7bf31cb521e6398012eb208a68aa40c", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942035, "uuid": "5b33ce48-a9bb-4ced-a28e-b72f8bc64861", "comment": "Malware payload (PureLogsStealer)", "value": "a2fbfd67ba47fbad813fe279f49a95f92a7ea73f", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764942035, "uuid": "c626155c-20b8-49ad-b554-bfdf9c645f4e", "comment": "Malware payload (PureLogsStealer)", "value": "2f9d69215e57bef9bfb305b7cec6fdd86ee1603d56907e971429179016b318ef6c69fb7110f340a0a5c98d03a8612581", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942035, "uuid": "be53a1bf-a22a-4122-9892-279407870c8e", "value": "T123E5B05D84B05CD26014FEB4F685FBD7CCEA53852A2B07520FE4858A3352C83FAA77A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942035, "uuid": "948239c9-124d-4dd2-8059-623605df58bb", "value": "24576:XD3p4j1Ur2sutthTH8ZWU8pjZ7AhTrhMFofMqZph1Gt+pQ9eEFoX/SGf3194YUU8:TjrsVrTchZZpAkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764942035, "uuid": "b386470e-c9e5-4011-b29d-a853cc10ef38", "value": 3271660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764942035, "uuid": "c30682dd-256e-40de-bed2-b04283edd74e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764942035, "uuid": "76f51438-5b4a-4f2b-a771-ab7c13e03fa0", "value": "df989s98g98d9fg894993494999h9gf9h9fgh99sd9s99df9gdf98g9df9g8d9.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccbac02-d1a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764915598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915598, "uuid": "1fa89909-124f-48fb-aa7b-62ee4943cc7d", "comment": "Malware payload (Mirai)", "value": "e816a08e2efbf4e505ea7c372411238e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915598, "uuid": "de005d23-1518-4083-8846-050dc27e29d6", "comment": "Malware payload (Mirai)", "value": "ee14c9b1d12d73367b4b9e30ea94fc030640de750b61b782fc15ed45b1ae4a05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915598, "uuid": "b2f69e37-f38c-489c-ab14-d55c73d2824e", "comment": "Malware payload (Mirai)", "value": "05af5b0ffaef7a67370069e9eb97443220c59821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764915598, "uuid": "e5a7993a-6a9d-4bf4-b234-c90022153235", "comment": "Malware payload (Mirai)", "value": "a6c99f829371772bf033f9adad9dedd17111e7670b5043ecdc2914ad701f86ef83844fa3daadf063dee9b6af6845d46f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915598, "uuid": "d265e63b-9553-49b3-9366-9eaef6483c22", "value": "T18DD2E12D194244AEE890D0766BE503F63E320F92E842A50B38697A479DDF4793933FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915598, "uuid": "f075a8c5-23f1-4552-b327-f9c174218d4f", "value": "768:Bspb+bq/kw1PwwRxQsJazljfj4AHG2yIqJgGlzDpbuR1J/:Bib+bqXhbxQsJyd7lYVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764915598, "uuid": "ce76ee95-6f79-4f5d-846b-730988404570", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764915598, "uuid": "d05824e2-9f57-4087-8a5b-35812b5f3605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764915598, "uuid": "58ba3a26-70d6-4443-bd47-57e7ae17ffad", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b56eb1-d1ba-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764925725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925725, "uuid": "75672cac-a367-4a91-89e9-601053066179", "comment": "Malware payload", "value": "20d1aa2892f3981cd463535f495bf438", "object_relation": "md5", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925725, "uuid": "9defc192-5a65-4141-a2ed-1d0965b5c7ec", "comment": "Malware payload", "value": "effba77be35fb75299883957d3acf9560970a054bc85d20457552e3511293cd0", "object_relation": "sha256", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925725, "uuid": "8700592f-f740-4c8d-9a2e-76bd74396711", "comment": "Malware payload", "value": "42374ee27645f9b44f6a86b1fe1921302573b632", "object_relation": "sha1", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925725, "uuid": "e6b4117e-3b7e-42d1-94a7-81245cbdecc2", "comment": "Malware payload", "value": "46781908d00569b03cad3944f5c27b32042d0c092d406ba70090c36b5fb9301452c6ca40352ad069d65f81a3e4b9ce2d", "object_relation": "sha3-384", "Tag": [ { "name": "154-90-58-164", "colour": "#3D8E08", "exportable": true, "hide_tag": false }, { "name": "195-24-236-47", "colour": "#67A586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925725, "uuid": "0109c38c-f061-40fa-94d8-3ec9608deba6", "value": "T1DBD37D57B7A500FBE0778238C9A30A45D772B81607619BEF039487666F237D48E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925725, "uuid": "df9db83c-3b62-4faf-8448-564f18278c99", "value": "c2369cc464d6a1fcad5e806a3342cbc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925725, "uuid": "f2aeeea9-0b5a-49c2-bb4c-4f0a2f9a3b0a", "value": "1536:75t/0mESf3cS2hh9+DnztBE6of9GCVxaTTHCS/BFvUVDFHWvwEO0sWPdw9dlNNyH:b+mc/zcnL+fpxkiELUVx2vwSAhyoSy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764925725, "uuid": "0d2eb0d9-cf0b-47fc-a434-1af6597c87dd", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764925725, "uuid": "8781b414-2b79-4ec8-a603-4380010645f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925725, "uuid": "1026d76e-20cb-4c2f-923a-e7bd1fc4dd1f", "value": "profapi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e9cf39-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959048, "uuid": "cd6f8ca8-b486-4246-b561-caf02b8ec70a", "comment": "Malware payload (Mirai)", "value": "4ab88df1be61f373ae3e178a67b43168", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959048, "uuid": "ca68d4e6-1757-4111-a993-308f28cd6a12", "comment": "Malware payload (Mirai)", "value": "f04560d94450d84521aa8f16f994f87446558268c68d0f814c1b9c1304b4ba92", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959048, "uuid": "572ad64b-9731-41d8-a0c4-8c1db1c70fd7", "comment": "Malware payload (Mirai)", "value": "d7786d6fd4f1d73ce1f74e8bd995d86a11263ae2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959048, "uuid": "3280c9c8-5480-4843-8c1f-704bca6525cc", "comment": "Malware payload (Mirai)", "value": "687b25271650b453df4ab61366549a0e51ad4212c90abef747cbcdad9b3c533a8d6559069f096a42f976bf14950f5f30", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959048, "uuid": "c5792e91-e350-4cc6-ad6b-1c4844bb2083", "value": "T1B2C0C9E433063744804CB82620BA284A34B2CA0B1676877F8C40E031D044834F331E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959048, "uuid": "91057972-8b0a-4aa2-8813-7a7592ec90b9", "value": "3:LxAjtyg/yImWBFSHEom+bMUDbGBFgxAjtyg/yI8QGFSHEo8QLKwoVWLDbXxjKpXD:LA5/bm9E1+bpiBFgA5/b8Q9ErQLKwoVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959048, "uuid": "1ad3ffb8-4dc5-423b-8cdb-605a7f8daac6", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959048, "uuid": "02e6998e-11a3-4894-a2aa-c23cda8f7e91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959048, "uuid": "ee8b039c-0543-425f-8937-7e5577960aef", "value": "brr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdfce18-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "9b544783-03f1-43f7-9555-bdb85eb3d72c", "comment": "Malware payload (Gafgyt)", "value": "94aa08e1c334601930f002b43a59d161", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "c329d759-aa65-4e62-a882-602850085323", "comment": "Malware payload (Gafgyt)", "value": "f0bc617bc487b3be5ab5a67dc0a3f7d5c9001b8d5da6592ffeb9de09a05eacd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "125bc4fa-0774-47ed-8970-a074a69dcf57", "comment": "Malware payload (Gafgyt)", "value": "291f5d5ff81f8ef9bc97b872876a223937890627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958338, "uuid": "78092b0c-be45-42c7-8042-a388605de267", "comment": "Malware payload (Gafgyt)", "value": "1f42ad7b3c89e6eaf0f7e76de7579945939c2aa3d6bdf8f93e01b303a6e025581edb2ed3b97d72b7dcec795dbf619b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "847bb675-7393-4ea5-ad94-8fbbe6b32e1f", "value": "T146934B17BB1D0B53C49B6AF11CAB3BF18769FAE112D26285620EAFC44733AF02911F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "58f02c31-d6be-4dec-9db9-48de85aa69a3", "value": "1536:IwHJoQLXDxRX8zHcaN7IwRoCobrUgvhiDmBeUmX2VMDrUuKfa5X:IQmQXxwHcaNUs5M+mBeUmX2VMDrNKfaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958338, "uuid": "a6158f67-b7e7-48c8-8f14-e3490fafd00d", "value": 95320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958338, "uuid": "74c81b4c-bc6d-4991-aa99-055df7307de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958338, "uuid": "052ac964-dd7c-4809-b5ce-64206181360f", "value": "Fantazy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadd7058-d229-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764973765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973765, "uuid": "f8c70e4b-5240-44cb-a698-685efe20db6b", "comment": "Malware payload", "value": "adcd3d2a90cc9677d426b2370daa3027", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973765, "uuid": "0f82592d-d594-4ebd-97dd-33ca2126baf1", "comment": "Malware payload", "value": "f1066cd155176fae006da497a91dd1f1a3a2cb98228cb17c7db329ea652833a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973765, "uuid": "428cb359-796a-4ab9-8dcf-b42d0fbd48dd", "comment": "Malware payload", "value": "4e5567582eb647e18def3f618154298e1c3fa5b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973765, "uuid": "c60b000c-9d6e-48f4-b9b3-a3c0ade05bfd", "comment": "Malware payload", "value": "99311be9466fb480c7746fcaeaed9809047b276cfd127b0f7e0901edb3d3cc64f0027f1bcae4f686e0c50a9cf27ab878", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973765, "uuid": "82a31a6d-c0a0-4277-a20c-1714ba44b0de", "value": "T10711339E3410D9D18D5FE604387EEA21624682D5A0C23F2455DE2A3580DBF183E0FFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973765, "uuid": "41d89226-7ff9-475e-afcb-167a623b5001", "value": "24:evrNbhorNbh5rNbhp1rNbhqrNbhTrNbh7BrNbhErNbhdrNbQj:evToT5Tp1TqTTT7BTETdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973765, "uuid": "6292eff1-26e6-4418-8023-c2cd1164ecf9", "value": 920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973765, "uuid": "ab25f51e-40e7-4459-925b-3bf2dde0e8af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973765, "uuid": "ad6d1d8c-c46f-439d-b878-6831880e3816", "value": "dvr.tbk-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90b99ae-d201-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1764956528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956528, "uuid": "ce5e068d-5190-466a-9775-fe494ac84c17", "comment": "Malware payload (MaskGramStealer)", "value": "c18231051b250ced688fdaf42b60779f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956528, "uuid": "98098344-1518-4466-883a-148249dd428f", "comment": "Malware payload (MaskGramStealer)", "value": "f1954400304fba8b96f35a6e1e6568df314cd489e8aa42feab89ee5367b6be19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956528, "uuid": "482b6abf-b7dc-4871-b96c-f817e6f267fe", "comment": "Malware payload (MaskGramStealer)", "value": "6452b8ba8522d0a3fbfc22463641edd4d1d0e35f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764956528, "uuid": "909db329-209f-4589-a08c-42e45ed724ad", "comment": "Malware payload (MaskGramStealer)", "value": "a5c82e3f3f158434058436648b0e2e91e8b15bf41778aed43f5a0941995210ca69f43e417db60b436a2c045f1b771213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956528, "uuid": "c3d3b84e-48ba-4f50-91a6-364734faa898", "value": "T1CD286B4267EA01C4E9F7DA398AE65617D673BC462F3085CF254C172A1F336E08E76B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956528, "uuid": "a1ac5b4f-b551-45f9-82b4-ba80299886ac", "value": "80959bfcea0a5c7ff3ffcefbdfdcb7db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956528, "uuid": "f238b272-7ba1-496b-b266-f3bbaca68837", "value": "393216:7H2yh7Pav4KyBhWgkpyYW7rcVLJlb1Q/9IVYfB0sIyNOnS0B4AycWMCYf2eCHhZZ:rr7K96IFsJY2x0LgZmhrsxwbc0r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764956528, "uuid": "70fb0352-fd89-4435-bfc4-63c82826313e", "value": 101458979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764956528, "uuid": "e82e94c8-57a4-433c-ae34-034adda09fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764956528, "uuid": "c74a6049-189b-4471-85ad-fdb7aa4469e1", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74cf91b-d211-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764963398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764963398, "uuid": "dcec7194-9d7c-45f3-bddd-3c8d639f7265", "comment": "Malware payload", "value": "cd972b7d5f753d7caca877cce93b83ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764963398, "uuid": "02cadb84-0655-47fa-bb7d-154bb9c18b7f", "comment": "Malware payload", "value": "f1c50ff0ed5f6061f03fb57c6028edc3098c2f6511210f66df362513b3bc70b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764963398, "uuid": "ed7225bb-353f-499f-8b5e-7c58e6a115bb", "comment": "Malware payload", "value": "60b89899ba80ac1c2d013688bfedb7f1766bcf2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764963398, "uuid": "7d806548-d153-4812-9867-d08350fdb0ba", "comment": "Malware payload", "value": "2d038b15c00c32ca840a96cc2abd0c7956cef326bd84f2ada57dc5ce02abc80a7f35dda68082c2cc0672b36764363d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764963398, "uuid": "6104c13d-3d9c-4a10-a95c-74ee0cd8f7e6", "value": "T15A961982F981492AC55BF2349CB162507774BD0943313BD76FA70AA90EFABC4173EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764963398, "uuid": "cb514489-4c43-497e-b5b6-274fd2001b74", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764963398, "uuid": "0df40366-6844-4650-a62d-028258281125", "value": "49152:rIAALG3AWqXWVdrRhK19Uu56II14sS9X4MSHzoTnTX0AnDmFVkPukRPP:0q3WIdr95FoDMF1kRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764963398, "uuid": "7f0eff28-e96a-4610-b09e-2860a7691f1a", "value": 9095816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764963398, "uuid": "2f84ba89-5821-4e61-b01f-354b017c0ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764963398, "uuid": "386d7634-321b-4efd-b31c-abf3a826848a", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91070593-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764944006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944006, "uuid": "baa71f03-dba0-4e93-9ce6-611346bddb28", "comment": "Malware payload (Mirai)", "value": "3635042edca15f084d454aa3548baa4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944006, "uuid": "c4f62611-4e64-4438-a4ce-dfeb1767e78d", "comment": "Malware payload (Mirai)", "value": "f2439528a93b2244bfe83df9e7138e20981b0ca4ec9de95856a6e99f55a758a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944006, "uuid": "e14dd9ed-7513-476d-8a2c-b87b295b6947", "comment": "Malware payload (Mirai)", "value": "45cc5db387cd71cee90b8eef571fc9e54628c602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764944006, "uuid": "08a63505-e88a-41d2-9070-fe885aa51dcf", "comment": "Malware payload (Mirai)", "value": "e5ca8050d410efab9104ca6a20a8cbc36300e3d249c9b21972edeb2b24b4bb7eda528a6158ebe06e841147c147108642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944006, "uuid": "07fe02cc-ce08-4ded-83ec-2c921da891b8", "value": "T104B43A56F8809FA2C6C12976F64D46AC33174779C3EB720689245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944006, "uuid": "eaa1ff01-6f17-47b9-8f6e-2cf5d0032632", "value": "12288:F9qlsvnhKTEmRO5vawEn8S7lOgpjj11gj:F9es/hUEmRO88Kl1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764944006, "uuid": "7b9126ad-d9d4-479b-bc8c-1f5065a36e5e", "value": 513384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764944006, "uuid": "0ffbc2a3-3a69-436c-b915-f44d5897c701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764944006, "uuid": "58442c23-c1f8-48fa-8bec-b3ea0961c704", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385a9ef9-d1dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764940421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764940421, "uuid": "c5a8f9a1-ec9f-43b7-85e9-74341653e3fd", "comment": "Malware payload (Mirai)", "value": "8c34f0837dd9795030c99c040bb22408", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764940421, "uuid": "536d0f83-b53e-4d1d-b1d0-6283b93f995f", "comment": "Malware payload (Mirai)", "value": "f2575420b8d73b89d7fc2f76a70f6ff96e696f3a72da0ae0c0b9e78b8d42b576", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764940421, "uuid": "95117922-374d-4bb3-8cbc-a62890f54100", "comment": "Malware payload (Mirai)", "value": "36d4a2e384963190a36e6776cfd9d579ad7514ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764940421, "uuid": "a291efa3-6f57-40a0-a307-5ec0e0b95ab6", "comment": "Malware payload (Mirai)", "value": "0361ecbd3843b8918dbb1f9c45812ecb6828ef98915e300e93b8f162d16942fc40ee5a335e0614db5e6697cd139ea74f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764940421, "uuid": "832d0829-c80b-45ee-94bf-578b6fadca5b", "value": "T14F11305F6C59DFC5D398C745B8A3F549E109825300E07B1DC2EE8772A0EA6143E86EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764940421, "uuid": "9ea373b0-27d0-465d-8b82-bd25709781c9", "value": "12:78ZL7+DIZ87+DIZh7+DIZpd7+DIZXWp7+DIZv7+DIZ7p7+DIZ7U7+DIZ7x7F7o:eLX8XhXpdXSXvX7pXYXlZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764940421, "uuid": "62c768b6-beee-4620-9cca-68184d970f0b", "value": 980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764940421, "uuid": "57cc9ae6-a723-4054-b666-4179aed37999", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764940421, "uuid": "44068e06-a2e2-400f-8a34-605a2251e3d0", "value": "router.lblink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce416561-d1b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764925640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925640, "uuid": "3e221cf6-1478-4840-87c3-9833e6e345aa", "comment": "Malware payload (Mirai)", "value": "111b172a0a1d2f3aa21318174705af60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925640, "uuid": "55117b20-b46e-4062-9a68-68cb6ad0aca7", "comment": "Malware payload (Mirai)", "value": "f282436014fb5858505598bdcf16c034ce7c659bc06061a9afa5f1ae8c202cd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925640, "uuid": "44927d1f-c422-49d3-a79a-9ce3b1951da5", "comment": "Malware payload (Mirai)", "value": "71efaa5c7c0402dc10499786e9bc1519ee7c9dd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764925640, "uuid": "0982fb2a-d839-498d-87c7-b12e3a110c0d", "comment": "Malware payload (Mirai)", "value": "1fffb02f6f8c48cf28f2cc38230954bcd6bf2cbfe5abb9c831c87fc2e97985ab7f1d2d8fdaf3781abbe755a8e9130492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925640, "uuid": "c5337e05-a173-41d9-aeaf-f57fc3117efb", "value": "T19A44C6167BA19EF7C89FCD3306EA460220CDE04B22956B2BB6B4D65CF74A90F45D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925640, "uuid": "1a1292d0-b9e9-4f01-9fd1-58bad3d6ed45", "value": "6144:riBM7d+dbW+1XFi0lZqmJG9X1CGv13ZbSanEu:dd+db35qmJG9X1CGv13ZbSanEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764925640, "uuid": "f24b488c-810b-48e8-8770-d31c4cbc0544", "value": 256440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764925640, "uuid": "f806e43d-03ff-47bc-9643-0c313c4c05f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764925640, "uuid": "3723cc54-9cd9-4df8-bd05-b537309c3fe1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22589fa1-d228-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764973026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973026, "uuid": "803f178a-c340-42ec-843d-2ee1ee8f1477", "comment": "Malware payload", "value": "17e1d914b7d3f549b21cdae58c1996a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973026, "uuid": "540c35e1-9f0d-4e37-aa8d-0a0ec915e923", "comment": "Malware payload", "value": "f2d97ee61222fa4d6cd8c36e377462f20831c991fd2c1c62dc675c63f01e248f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973026, "uuid": "99470c63-8806-4f51-8cba-a7d606bb68d6", "comment": "Malware payload", "value": "5ac4318a81531fc934fad340a4d6fc2b30468a25", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764973026, "uuid": "81bc71e8-067f-48b5-8fee-20a2d9273601", "comment": "Malware payload", "value": "37b7f4e457a09d2796dd244f3b4d84797c00ae37adb847042ac892a96cc70d810fb8885e0e658f15ceca0547d572d34c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973026, "uuid": "f31f980d-cd91-42c2-ac93-dc2705eefb5a", "value": "T12F73181362AF860875F39B4D566B15340F773E9A093E4168168CF60BCFE39085DA97B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973026, "uuid": "d81f8084-eaf5-4a6b-9bcf-ef6be6379cc2", "value": "768:3zI7kmogMHy/3ZguOYuOYuOYuOYuOYuyuOYuOYuOYuOYuOYuOYt:jIgmtayPZgYYYYYdYYYYYYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764973026, "uuid": "4a4a3dde-fdcb-47be-b3f4-d6e87dfb9112", "value": 78834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764973026, "uuid": "2c9e24b2-9ba9-4ca6-b137-1c3dc118612e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764973026, "uuid": "66831314-8f10-4a1f-8a01-f7572104ddda", "value": "Aircraft PN#,Desc,Condition & Qty Details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa09277e-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958356, "uuid": "914a22a9-58bf-44d2-bbc5-28a37e70a7ce", "comment": "Malware payload (Gafgyt)", "value": "b36721e6149659939e01be4dfa593cc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958356, "uuid": "fa9a92fc-f42d-4ce2-8556-a51d7a1e01f8", "comment": "Malware payload (Gafgyt)", "value": "f327e9f3deeda8d2336a168740cdbaa16ab9f943b8f17b8c586589817682861f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958356, "uuid": "55bad557-6144-413d-8239-923dab4ce10f", "comment": "Malware payload (Gafgyt)", "value": "8ef5f0e0750c4ec46afe05b02d2b1e1a4f02a3da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958356, "uuid": "63d9f939-18b6-4d10-abe5-49d8b7848b62", "comment": "Malware payload (Gafgyt)", "value": "192015c83fb44cd5cca480017e3035987f351e3b43baeb4e4d860c4a0bddd565c473876d206006fed382bc7442c87acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958356, "uuid": "82258097-f4d9-4a4b-a45c-b795a9ad581f", "value": "T180935B23E152C6BBC0C796B41BDB8A619823B4B91773724A33D87DB53F128D95E5CB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958356, "uuid": "c4f5e259-92a9-4fd0-b817-d5b616f9f71c", "value": "1536:U7V4QXQy0EINE3/i7CZ3Qwmr38QUdGvbJgJWAQNIKmA+BWYXFUjaZ3tX:aDQPEINAFlQwK8zgddLm/BWYXFYaZ3tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958356, "uuid": "6e1a1a8b-2c03-4c90-a038-cd04db4ecca7", "value": 96413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958356, "uuid": "e12d067c-5b8b-4743-84bb-ec69c932cffd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958356, "uuid": "dc519f80-1107-4783-9999-ea7e262c8db6", "value": "Fantazy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3565607e-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958885, "uuid": "6bbd3aa8-90f3-45b9-9f12-f7a9304cf49a", "comment": "Malware payload", "value": "8625a109faffdf70ef451a71118f4bcc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958885, "uuid": "fddf82cc-ed5d-4552-b74d-3c3b08656770", "comment": "Malware payload", "value": "f3a3049ba10290609f5c5366cf7d6736d6f21db6c0cf4e4ebab0061a145d4d90", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958885, "uuid": "1a2c58bb-5a09-46ab-a835-750d01c9dd41", "comment": "Malware payload", "value": "ad1ab50b8d1b4f1994829984e1e29c4bbb870291", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958885, "uuid": "7d668188-a4c2-452e-9119-8f075a5aaf20", "comment": "Malware payload", "value": "a792ed3d3cdef534328a52bf1597154ef4b3502dbee41813c88fdddefa20104942c6f61bd6dabf281562136e770e50d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958885, "uuid": "962eebe0-40a6-4a38-86d0-d725bd2a4d06", "value": "T1ED62217C46276F9C900DE57AB386420CF1BA8BDE54BF9BA06D95157D30A20EC7133E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958885, "uuid": "79fc574f-66c8-4eb1-b955-c04219eeff7e", "value": "192:uGzkpqp2/rocGzkpqp2/roKGzkpqp2/roBGzkpqp2/romGzkpqp2/rohGzkpqp2Y:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958885, "uuid": "73d3033f-7c90-4c8b-b002-1ebd65180be9", "value": 15914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958885, "uuid": "2e45d72e-66c6-48ac-967c-11190042cc2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958885, "uuid": "4baf6162-4ed6-43ca-b581-964134e57ab3", "value": "bo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d03b16-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958939, "uuid": "dbf33c0d-6569-4e88-9ea0-97c8722cdadf", "comment": "Malware payload", "value": "ccde3e6e88295fc22da577721987a5d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958939, "uuid": "de7e8b81-4df1-41c2-b678-39c6212f27b6", "comment": "Malware payload", "value": "f3ac9fda8e87f9fbc6d38e7e8bd0f2f3ab222ba08ab80c176c5db29661f275dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958939, "uuid": "c0843871-95f8-44cc-92c6-4fb4b38e30c9", "comment": "Malware payload", "value": "231d7d71a3d239ce2fa1f63e912c4d1ba132bb2a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958939, "uuid": "ac416765-9699-4f09-8b2e-4c007095d3b3", "comment": "Malware payload", "value": "da24c8d68dd3fb4ea16bbb1be96b51c2ebab8d9d021d3401dfd3a283388e33e3243404b1729134df741152af7ca7ad59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958939, "uuid": "4fa09017-ed33-4e63-aa27-19c57737419b", "value": "T161011A59030A252F421E643A757A03E6B233FB0F7A2ABA95FC05D07AE2C45B09831579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958939, "uuid": "5f2e3122-99d5-4224-b671-0d9acd06dda2", "value": "12:frR71lAW1c2HrR7xAW4rR7BAVUhrR79ARU0frR7nZA2JtVlrR71LAMB/6rR7JAeu:zF1aW1HLFGWuF2WNFiRU0zFn+2HHF10U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958939, "uuid": "c4d54bd5-8062-46b2-b31a-a89de77fe71a", "value": 697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958939, "uuid": "8f80dca0-0c07-4a37-bc7b-c1fd45c14f97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958939, "uuid": "05bcaea5-8dbe-4bb4-a5a4-b0049f335686", "value": "sl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fbef9e-d1d0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764935369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935369, "uuid": "8e90306b-9fae-44f3-9d8b-ffe60914db13", "comment": "Malware payload (Mirai)", "value": "bcecdb606ae27474f4e5f59b7dfe0fb7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935369, "uuid": "3167582b-998b-45b1-90e6-37116b73fe1c", "comment": "Malware payload (Mirai)", "value": "f3e8abec45ed54954974ed44b1207d389e8edeae24274c014d891297d0bc87c7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935369, "uuid": "8e0a3dfd-02b0-4e44-9d04-4f372905b0c6", "comment": "Malware payload (Mirai)", "value": "65b33e930968c9808ca3f8d06f0b5f875033dc02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764935369, "uuid": "dd87b655-bec8-4826-ac6b-b45d9694e4bd", "comment": "Malware payload (Mirai)", "value": "4c92f22ce1bb51a081b63db7833b54342807f22a0227b66886d53984fedc4c4f19ec9dc3c7e79adcf321cc2e4f4529d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935369, "uuid": "c068f422-34ae-45de-bc1f-bfa856da9545", "value": "T12211336F2508BCF38264D700F86FFA01A375B24540E63F2986DDCF7180D99447B19E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935369, "uuid": "9d0d8853-54bd-477c-95cc-3deb85c242d1", "value": "12:78Z20uEZH0uEZE0uEZpA0uEZXWs0uEZK0uEZ7s0uEZ7f0uEZ7U0uBRuo:e26H6E6pA6l6K67s6j6I5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764935369, "uuid": "ce6c238e-bad3-4f40-b2a7-6f71122bea21", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764935369, "uuid": "61fd326a-73a5-4e09-a55f-87fad41cf191", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764935369, "uuid": "3eeec7f1-7258-4612-8c29-3cb4693328ed", "value": "router.totolink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e73332-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958669, "uuid": "325a9c7f-bedc-4d24-9bce-72024fae19e3", "comment": "Malware payload (Mirai)", "value": "18980f3cf70fb3e10d5b23da77430997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958669, "uuid": "d5d4ed1b-528d-4dbd-9fed-3f21bfff1cdd", "comment": "Malware payload (Mirai)", "value": "f459942e5214c478c124ef712af858b9cb9ab76fa7333ed289497f4ce280d5f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958669, "uuid": "a1c0e613-27fc-4c01-b092-585b7c59eb13", "comment": "Malware payload (Mirai)", "value": "27dedadec0f1c9fc19b27708bdd06e5377d1a44f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958669, "uuid": "6040c886-8268-4e12-898b-d2ad51d1c332", "comment": "Malware payload (Mirai)", "value": "8e92694a52a8a21a60ffbcb9e57085a5dfc8451625d32083bfd2be188c1a9b2dcb4a82867c2d0080d70b8cb753b24abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958669, "uuid": "2346499b-8225-4e8b-a6f7-207ed1c69c90", "value": "T1F463951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958669, "uuid": "3c86816f-ff0c-409f-b92d-2dfc13448e5b", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAi:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzxL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958669, "uuid": "df493436-6dc0-42f6-a693-eb212d533249", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958669, "uuid": "bec3b746-fb0d-4a60-8929-c276c1e5d244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958669, "uuid": "16ab9fca-c5c9-495a-8d1e-b07ee008f8a9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336e6e0a-d1a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764918509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918509, "uuid": "445d9017-f4b0-42af-b597-bee3d099cc87", "comment": "Malware payload", "value": "f8a31f84582a1de604c16e79c738756f", "object_relation": "md5", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918509, "uuid": "54c6833d-a5c2-42bb-9bae-905b7192dfc4", "comment": "Malware payload", "value": "f4764953ac5110429c1f05afb9309c740cbb1447d9b9fc993b08391f19556f69", "object_relation": "sha256", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918509, "uuid": "84997c3f-7c62-40b5-85b2-cc272e9d41af", "comment": "Malware payload", "value": "88d4064b98eb249e9d61f926980e9767fb94ecab", "object_relation": "sha1", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918509, "uuid": "66939173-2f82-4a86-bc44-fc0117579851", "comment": "Malware payload", "value": "832b39c5f546237c7b556c443ecf1509b7101cd6d24b7dc4b5923e7fd18e771061d8ea22a817ee982dae1857700166fd", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-0-8", "colour": "#61ED1A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918509, "uuid": "2cefbbda-c679-4c39-8bd5-ee8c7d2adc1d", "value": "T11EF09ECC085205F457C6CF137491A055B07E4091DA35EC9929D115FD4DC40D85EDEEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918509, "uuid": "36fa4601-770e-4bc6-8056-0ed5a4ff6e01", "value": "12:5YVJhZBpevpceVpevpcHn6QJ1qaVHAbr4OVlCk6Pp:g7cceLccH7RlAHZ/ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918509, "uuid": "4a3e4d09-3e3b-4e86-9350-f524e6adfb11", "value": 508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918509, "uuid": "c8e07c6d-cf0e-4e88-a958-172d56167b42", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918509, "uuid": "0b9f1ccf-41d9-4b93-8d1a-800d69f91e83", "value": "f4764953ac5110429c1f05afb9309c740cbb1447d9b9fc993b08391f19556f69.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bb4d64-d1c1-11f0-a129-42010a9c0007", "comment": "Malware payload (SmartLoader)", "timestamp": 1764929060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929060, "uuid": "a7d98f20-1efe-40aa-ac87-353e7ed9d5da", "comment": "Malware payload (SmartLoader)", "value": "156877ea1c1af73aa4d1e89d1e85a130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929060, "uuid": "cdeb3763-79a0-4466-983f-f9883ab4bb08", "comment": "Malware payload (SmartLoader)", "value": "f47f8283581a0e0bf3ae63757b4fe6d44cb1c2b140856bcfbef77cb454abe0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929060, "uuid": "84cdb4a6-2e56-4971-9ceb-8b1559adea89", "comment": "Malware payload (SmartLoader)", "value": "6243225d8616a37e0bdc708a0de1b38adf73a7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764929060, "uuid": "3c97d9f6-f04e-4471-a35c-0a6849270eb5", "comment": "Malware payload (SmartLoader)", "value": "cb1c2fcf2680657b4c67032cc9f1d5f6f2280188b117f98eda7399c2f4d25e8436de758bf8d626b06a057a01da9db460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929060, "uuid": "7f7834e5-d0a6-4fae-b15e-1c3281140efc", "value": "T12EF58D27B244713FC46B0A369A379359AD3BB76076368E1757F0086CCF369802E3A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929060, "uuid": "b899d316-a911-4759-91b1-f52998619a83", "value": "25a7ef295da08abfa9603aae163a4712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929060, "uuid": "8e64ee7d-b9dc-4b47-b7dd-ab9433db2f0f", "value": "49152:1GW6JsVqh5Pm4ssZsSwXs+ocDFFuXDfCKMSWKQRcpxd2pThPSgl1:116JsV60FFuXDfCKLdQKxoJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764929060, "uuid": "82ca3f81-5e53-4b66-9667-ba274ebff058", "value": 3391600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764929060, "uuid": "b8e62b94-0a99-46bf-9725-5cd06bb6c16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764929060, "uuid": "fa08fd65-a17e-4d27-bc77-6760bb970cc8", "value": "f47f8283581a0e0bf3ae63757b4fe6d44cb1c2b140856bcfbef77cb454abe0cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b9818-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958453, "uuid": "1052d6ed-f661-4f26-b0a4-78c8bdcefd67", "comment": "Malware payload (Mirai)", "value": "39d46be8a9a6afc02fb5497c6fba42f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958453, "uuid": "01d75d70-0955-48d4-85c5-ef5b33cacb8d", "comment": "Malware payload (Mirai)", "value": "f4a34a67a4e8159a46557b2485f1ed30a1d3c858f9278e58c470fcc73804fcdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958453, "uuid": "fdd53484-38d4-461d-a783-fd4607263c84", "comment": "Malware payload (Mirai)", "value": "a6e9d828ed02dd44108cef0d221b0f5efe1db038", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958453, "uuid": "a36e99f3-e59c-4990-a5ea-9912f3bb2d99", "comment": "Malware payload (Mirai)", "value": "77a061eef4ccc2a2d7f850642101984e6e2af62f8d86effd5570b31c56ded13c3b0c387442c2061b0418c1c95be32049", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958453, "uuid": "c4126bd4-3e8d-4818-8633-ce0b9ddb7c7a", "value": "T15E118EBD42097564408EE816B1E9CB48707B8BDFE5B78E506EA4727860F85DD3032F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958453, "uuid": "c9eee90e-4070-45af-81d2-37eda8395a8a", "value": "12:YWh/4Yvh/nIvh/nvh/mvhfERCvhyvho8Lvh4LvhcvhyILvhQiL:tgYZfIZvZuZsRCZyZ5LZ4LZcZyYZQiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958453, "uuid": "3e6896a3-e61d-49c0-b3bc-0772bac1a9ce", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958453, "uuid": "76e046d9-f43b-47df-b39c-c16deaa001c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958453, "uuid": "ba144bec-96f4-4b15-b7ba-df35043e98d8", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9476fdf-d1c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764931162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931162, "uuid": "4b3672fa-3b22-4fce-984a-3ddcee58d008", "comment": "Malware payload (Mirai)", "value": "5f1f4fbeffaf60030f1da4c8e74ab6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931162, "uuid": "c85c10b1-e559-4dcd-970a-d7603769cc17", "comment": "Malware payload (Mirai)", "value": "f4d324641f0cf8eb1bc873ff93a41755a773afd1e00a11c3b555158318f35e16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931162, "uuid": "b958aeec-7726-4bde-ae04-19de0ad6e9a9", "comment": "Malware payload (Mirai)", "value": "1880a5b5521e65b38e4bf03335faa0fc4ed29f6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764931162, "uuid": "0a8304ea-96d6-49ba-a0fb-e8b27b6932af", "comment": "Malware payload (Mirai)", "value": "b81f926a8cf2990cd73ba35c690e3ec5d2f709df26a5a200f997da9f1694df1029ed90d8d20addd6fa51a7cb3881576f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931162, "uuid": "fedd41ed-4212-48a8-857a-55e876dbe64e", "value": "T191631A4B7B11CF11C756E67042F38B963AAE2A9236D2950BE35CDD403AA435C681FFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931162, "uuid": "6d01c98b-c460-46fc-b99a-6436d300cb9a", "value": "1536:r/LFi8X/d1oNkG+vitc6p6OKC5l52+mvBS1CpQx66SaL:rj8OcK6l52loE6SaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764931162, "uuid": "f05f471c-aef9-44af-beff-74934f780105", "value": 72624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764931162, "uuid": "2a873e6a-2946-470b-a5a0-eb30e656cd0a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764931162, "uuid": "1d27f1fd-f90d-4590-8109-b235dfd43bd6", "value": "VRmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d557134f-d1e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1764945839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945839, "uuid": "897ac67d-b56c-4c8f-9d65-34ac0e7f8579", "comment": "Malware payload (Formbook)", "value": "1aefcbbc1ea725bd40e7dbcb62d53b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945839, "uuid": "e285cec8-6045-4870-b5aa-03640895bc9a", "comment": "Malware payload (Formbook)", "value": "f626061c6431a018a00e7f4bf29904f1d4fe9fe093a5fe7fdcca08d0aaead56c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945839, "uuid": "069e3f42-33c1-4d3a-a8d9-da21cedb610e", "comment": "Malware payload (Formbook)", "value": "1df40e535cd00db0cb356c65d67fab8f9369fc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764945839, "uuid": "613c8172-e4c2-45db-9e91-2876cdce2e43", "comment": "Malware payload (Formbook)", "value": "4e761bba3412ce125183ffa4d6c6ae20531d5bb349c943353eed8a848046babe5d98c77777036b103a81ba5eaf187452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945839, "uuid": "1581111b-1f74-4df8-929c-5c58a13cce79", "value": "T113E42385AD92A050D1B4B330C836CC948E393A729D19773F9339E25BACB1393D96778D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945839, "uuid": "a1035ba1-3ffa-42c6-b501-32f8f198d843", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945839, "uuid": "d0a480d1-d1e0-45c8-88cd-9139a707e662", "value": "12288:Qz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uq2FmEEnNJ5f+sEO5Vsakasvnoi9Kvv:Qf+iN57Gtene3tkmNJ1+sFtwPo2fpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764945839, "uuid": "a81fc830-7a22-4818-b535-8833e3b4d0a7", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764945839, "uuid": "6e567039-99b2-4902-88a7-9b29d298961e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764945839, "uuid": "95e8b256-3599-462a-ba1e-8cd37ea8e9f5", "value": "STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3cdaa2-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958866, "uuid": "e9047457-7ab3-4fa1-9609-2a3f62b034e9", "comment": "Malware payload (Mirai)", "value": "640aefb444d17cd97c463b0442db981c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958866, "uuid": "20f2a424-e059-499c-9eae-cedf280d490a", "comment": "Malware payload (Mirai)", "value": "f651ab359a6885baca4b67398fde4686ee59d7ee202d90783c971f46f8f7cbd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958866, "uuid": "774a3c54-c4b7-4c0a-a867-8071c5f3ff53", "comment": "Malware payload (Mirai)", "value": "0929e896f51f41d2d6a6808f982b23d7129569f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958866, "uuid": "1e5545a6-ac9b-41d3-b36e-93449986a996", "comment": "Malware payload (Mirai)", "value": "1f44a2d2e283e4b3e8477d15cc3f13391107638508f6d06d0591346b04415980f3de4a053b076a0255ee813e0ad2a899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958866, "uuid": "1d40ea64-45d9-417d-ab54-a8a6c6dca903", "value": "T1E6031997F800AD7DF84AF33EC5470A34B531F65845910B3373B6AD639DB6294482AE8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958866, "uuid": "e8743c73-15a8-4f3c-b5d3-c21537a44c97", "value": "768:umEFm6vv8rEwVQkvcXkLFArJZX1mo0Ou/8uF9bf3FlXcVow4YNUhU:uRvErEOz3OvX1J9u/8uF91lX+oPeaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958866, "uuid": "b18981d4-bf30-4c03-b9e5-99abe61a63d1", "value": 40652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958866, "uuid": "b678e83b-8832-469b-8d67-84615e35a981", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958866, "uuid": "07f15680-214d-465e-b742-0dddf7b9f44e", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c3bda1-d205-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1764958342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958342, "uuid": "bbc91450-31c9-47db-95cc-a6a2a06b0084", "comment": "Malware payload (Gafgyt)", "value": "9bdd95f89cf98155af7a4009904d30fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958342, "uuid": "fdfbe84f-b232-4a97-8b4a-b8e111e094c3", "comment": "Malware payload (Gafgyt)", "value": "f65a6111ea7504072a8198a7797d0976ab63143882154ee08fb9583fa0decf20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958342, "uuid": "8616c42f-9e5d-4edf-a15a-468c956efa68", "comment": "Malware payload (Gafgyt)", "value": "9704a10e24c8482533af5c89e331029f62a5be38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958342, "uuid": "8ab3c1fe-3638-4f72-9369-bfc4a87d6b01", "comment": "Malware payload (Gafgyt)", "value": "92523e5d963adbb252bb7f1960015c6f9393507d33d7e2f5430e1843c226eeef3677c552bb01b7c9bcf5c1c740099689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958342, "uuid": "25ad565e-f936-46f1-afba-247b739c71e5", "value": "T1F7C32905E450875BC2D2237AEB9E465D37336BA893DB33115A34BBB42FC27D91E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958342, "uuid": "74033783-0489-4741-8116-610dddaa9370", "value": "3072:5a5QDpDeRWa25UOCR1DLRUL4+mwQYY5QXhga:o5QDYWacC1DI4+mwQYY5Ghga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958342, "uuid": "1f0e0e02-1db6-4d50-9536-1d1ce206ab9b", "value": 123743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958342, "uuid": "0855a58d-46b1-43c0-9286-cf2b5d7ff6da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958342, "uuid": "20970878-9815-4ddd-95c5-e757a1fcb00b", "value": "Fantazy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737ecac0-d200-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764955982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955982, "uuid": "1a42d548-35b2-43e3-acd8-a9c467222344", "comment": "Malware payload (Mirai)", "value": "ddf2a142259209bb70bbbee978dc6176", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955982, "uuid": "ec985db7-9c13-4119-b2f0-e64a822b19d4", "comment": "Malware payload (Mirai)", "value": "f71c1b8e06a86ad75a36cc48947e5d12cb1a299931624edc4483f02a5ffaa969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955982, "uuid": "65bba1e7-bdce-4d84-9190-5b630e682045", "comment": "Malware payload (Mirai)", "value": "b6ca2d4ed4535f52303e035d136d0c7e1ccfcda9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764955982, "uuid": "2297bb63-dfce-406a-8e25-ff5c742678f5", "comment": "Malware payload (Mirai)", "value": "cbf5d458c0aa4da32a1c94c366e4f3b3f053f5a87d9ccfe169aa566aad317f3b7eaf3af6c55543939fa86eff05178cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955982, "uuid": "e947526f-40b3-4921-a315-fd7e2c136163", "value": "T12BE30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955982, "uuid": "abea883a-a716-48bd-9f3c-8ca338029151", "value": "3072:pUkePnlUPX1JJXJUwbY+a9scgTbOCm3DoVRpL:pUHN4jJXuwbjaPr/3DoVRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764955982, "uuid": "84a5f2e4-cb97-4291-92db-150dea3898b0", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764955982, "uuid": "4d2edf2d-6de8-412b-84f8-194eb0645efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764955982, "uuid": "e13f9809-1480-405c-92ff-1fcb755b7203", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fddc467-d208-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959493, "uuid": "25dee6d4-43e4-4cfc-b948-b0f099330c2d", "comment": "Malware payload (Mirai)", "value": "40e1d42789debb984e1d6eaa2a0b7fc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959493, "uuid": "8e16db58-0072-45c5-b7ae-92a14944f416", "comment": "Malware payload (Mirai)", "value": "f736621581514cb64157ddeeeecb61f0581c090ea8546dd250955dc6fab15b03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959493, "uuid": "24f02533-0d3b-4e7d-bccc-78cf7a30fef6", "comment": "Malware payload (Mirai)", "value": "f562ce98c96870780be03fd15021f1a0c131df84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959493, "uuid": "524c50f8-f79f-4cbf-b7e7-dfd00f8a1d64", "comment": "Malware payload (Mirai)", "value": "c1653765f81bddf73abf36991b9f8c1767e2926ee1eccc4d8f07f5ff29234121de731f19483a114e0f9df16700940103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959493, "uuid": "fb0b157b-b870-41fc-987a-6b2bca97abba", "value": "T1F2530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959493, "uuid": "3a2ac858-297e-41c0-996d-85cf57861e6a", "value": "1536:wdnIYoZXnYkTAcASlquASBAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqCuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959493, "uuid": "04b1d643-1eec-4659-81c3-8e97299ab32a", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959493, "uuid": "7f8d9099-500f-46da-955b-aae8571d3248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959493, "uuid": "4de0902b-8fd2-48f3-ba86-3367a084a388", "value": "Omni.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e513f9d8-d203-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764957461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957461, "uuid": "d812745a-7ea2-4b3d-8023-77e6ff805370", "comment": "Malware payload (Mirai)", "value": "fafa0c6d600f6bfa57878b1fd340ffe6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957461, "uuid": "9856055b-8030-40f7-b215-84b246ff573d", "comment": "Malware payload (Mirai)", "value": "f7fcea907f9487603d631be6a607b0f38b1eb734bb18c0c51d3a264ae5619491", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957461, "uuid": "e82a3f08-f601-4a84-89cc-5efe7d5e82cf", "comment": "Malware payload (Mirai)", "value": "fba0f6ef1032d1d99a8020b04497501bdace79f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764957461, "uuid": "ce107364-d76c-448f-a597-883f34203fd8", "comment": "Malware payload (Mirai)", "value": "7b9de08bfb77e51c54d772966bb228445556b7501a67ccc85e58ff2630a4feb6c6e6f00b2e4962a7fc299be79251fe58", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957461, "uuid": "13d7db8e-c0c2-4a66-ae5a-8904ba4a3794", "value": "T1D411249F24922F58D158CB027CB7E908A165B3DD10E87B17A1EE1F35C0D8A043D16FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957461, "uuid": "42cd5c0c-a456-4d00-a24a-e6776067d8fd", "value": "12:78Z/RwSNeZCRwSNeZ9RwSNeZpxRwSNeZXWFRwSNeZ7RwSNeZ7FRwSNeZ76RwSNeU:eJRCSRCvRCpTRCwRClRC73RCmRCbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764957461, "uuid": "8931a9f2-d9af-420d-8dd3-454c4b4aeae5", "value": 940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764957461, "uuid": "27bb53bd-da29-49b5-9544-892b794f2980", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764957461, "uuid": "1466f108-98b7-4f19-b3f6-822dc8c4a5a6", "value": "dvr.lilin-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394cf6d4-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958891, "uuid": "9949568f-e53f-44d1-8f08-cf94163abfec", "comment": "Malware payload (Mirai)", "value": "25283562baf572ec8c48a32cdcbe4cdb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958891, "uuid": "8c466680-448c-4954-a923-1145883d7463", "comment": "Malware payload (Mirai)", "value": "f956fc9d97640ad663bf9d9f193702de858f32b1b03d235bfe5f374a3827d58f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958891, "uuid": "a4f8619b-6b4d-4a11-9eeb-6d9158ad6b6d", "comment": "Malware payload (Mirai)", "value": "ebaaeff8fde922947ef404f8c694ae21113c608a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958891, "uuid": "c0d531d4-7990-408b-aca5-8b8da5d81672", "comment": "Malware payload (Mirai)", "value": "3ebc63b12c52d77ae78a6ea408107f84d2a1e482d3ba8696e56898eb7eadd989927db71fd8fdfcd771234c2a9463e264", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958891, "uuid": "dbb37e8e-f862-48bf-bf54-5de7d7e92181", "value": "T1FBD05E9BD004A6B4D20AE88E317003DE72238B9F70A74F51AD48307FA2C44D8B011A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958891, "uuid": "97da676d-c60d-4222-ad12-550cff787bc1", "value": "6:L6Frx8ZXt5/jNwAK7PSrx8Vzg6FrLJZXt5/ZWJNwAbJ78J0bZrLJn:vth2A9m5XthoTwA2aZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958891, "uuid": "e6d002be-94af-41b5-a80c-24e4cb9266b3", "value": 242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958891, "uuid": "afd38d04-9fda-4e99-bf5c-6e13c06546eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958891, "uuid": "c7f61d61-807c-4ced-b7c3-5902aaeb2462", "value": "olor", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a40bcce-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "91d6bac8-ab18-457b-9ae4-51e9ca02beb7", "comment": "Malware payload (Mirai)", "value": "2fab303be4abd787b5ca1329bb72941b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "9e2051a9-50f7-4b8e-b2c2-ed3c4be794fb", "comment": "Malware payload (Mirai)", "value": "f9df71baa6b2f863b2a7f2989d8d43f4b053ff4c30249b3df03ab2dbaeddf235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "f5d62b47-b92a-4370-93ac-fb1e7264bb10", "comment": "Malware payload (Mirai)", "value": "4311e89458eb7423527b8ad9e6a9074e58fa2131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958436, "uuid": "d7f01312-fddf-432d-9b9c-638c5e510f72", "comment": "Malware payload (Mirai)", "value": "162ebb0cfea6715e87d802666729f115179ab501d89448e9f3382f00fb1b7c31bed9855a03b5e8874efcf31eaad77e8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "ab284af5-833e-42c0-93fb-f1c169ed80f0", "value": "T169730845FC819B15C5D922BEFA1E018D336367ACE3EE7212DD111B25778A92F0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "ceffbfa6-bacf-401f-aa1d-d23c5d6ca9f7", "value": "1536:udnPsDPmQgM/eVeKtWSKoHIxmBDKzuMguCUdlGni/0wmARu:NzmsAWBoHIxmBDKzuMgXa0wXRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958436, "uuid": "1f782372-992b-43eb-803b-047c40a01e2f", "value": 77892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958436, "uuid": "43abfef7-8ba4-4679-bcd7-1261f25cfb23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958436, "uuid": "f4b63846-70dd-46b1-9522-49f457600963", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8f4857-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958875, "uuid": "d914a834-5748-43c4-bd2f-f49b3f89b7da", "comment": "Malware payload", "value": "c30ec8f711171b806400252a393a3c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958875, "uuid": "a77cd392-2ffb-4958-961f-6a0d3e234ee4", "comment": "Malware payload", "value": "fa0147dbbe0d6d099374663134e43a4a525fe36477291930013024eeacd13fdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958875, "uuid": "19169394-b5ff-4bbb-9406-c2d2e77abd30", "comment": "Malware payload", "value": "7d0046395a84dca61d614ed6881950e2a5a9ec77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958875, "uuid": "0a1885ef-ffbc-41e5-b090-29804355cb0c", "comment": "Malware payload", "value": "6d7f65d939e4587e667e439f3dc0aaa83fa810999198fb56662037dec27dcc530b8ea00e0a5e0f65d7924997d83176c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958875, "uuid": "a1fcdd37-a925-45c7-8233-af1d6174279a", "value": "T13C430841B8819A22C5D422BFFA6E42CD332A63E8E1DF7217DD125F15778A82F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958875, "uuid": "f6996bed-baac-4b55-b2b9-8051a82580b6", "value": "768:wqMMiKImMY4kIckVFMZ0fbgUoUBtDCAu4gH3bMOSQmmnNYkN0fDsmPeuJ:CM8mwFMSDJoUKZ8Q7OjWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958875, "uuid": "4cc781b9-cc1c-4295-90b4-73e91c19048f", "value": 55248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958875, "uuid": "6106ba39-0b2f-4a38-80bc-b34b86483ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958875, "uuid": "f872174f-ad81-4950-86f5-08f50843824e", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fde1b79-d207-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764958902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958902, "uuid": "a3e2a476-b22f-4b6a-93c2-068a8f288fb5", "comment": "Malware payload", "value": "a9826d812eda65dfa1ea0b4e2022436d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958902, "uuid": "2f9d8ea4-450c-49c3-8fd0-2fd2a05e33eb", "comment": "Malware payload", "value": "fb0171449c148748b344dbe934a0d19f8c765ca8b650f7b87d86261875f0eaf4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958902, "uuid": "f925d8a6-3434-4cb4-9e4b-c6fb26f43297", "comment": "Malware payload", "value": "4df00c791a5e692892a22a6f7d9187094ed822ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958902, "uuid": "44f9b40f-040b-44cd-a5ac-d7cc5f86b6ab", "comment": "Malware payload", "value": "dadb786132019107a6ebf1adae0521847d086b8aaef397ee7eda4815759c2d02199e569a8b02066f258d9f6a3f48dc06", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958902, "uuid": "46adf5e2-4676-4ba6-a145-390406cdbca3", "value": "T13211667C052A99D48458D43B7297C10CB4A64FEF5C7BDB941D46127D30B08DE7232E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958902, "uuid": "ccd59122-dc6b-49d9-9188-07610caafa73", "value": "24:kFZVaFl5OVaFzVaFMVaFAIVaFoVaFtVaF+VaF6VaFjVaFAoVl:kLVafMVaVVaeVanVaeVa7VaoVacVahV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958902, "uuid": "a2d6fbf7-d3d1-48dd-9317-aff297b84610", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958902, "uuid": "7cb9196a-41d1-4187-9e39-e56a07be5fd6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958902, "uuid": "570199fd-ddb8-444f-8cb9-f0b193fc4bee", "value": "cn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338e5ef3-d232-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764977350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977350, "uuid": "a5423675-f031-4311-ba31-4e6670fef9e9", "comment": "Malware payload (Mirai)", "value": "77ac0a9af998fcbd29faa432746784ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977350, "uuid": "6d3f7cf9-0cb5-45fe-8b65-a0d31ad0d671", "comment": "Malware payload (Mirai)", "value": "fb1f766c681815acd2c4c1f5114ef3e1f9cc180ad0def1f5f1ef5a03be5a1720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977350, "uuid": "c33e96df-08d8-4998-a1c3-d8d05496e2bc", "comment": "Malware payload (Mirai)", "value": "7b40bc2867a1a14d5076fdea4df0ec4b146949f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764977350, "uuid": "fcaf3a21-f6a6-434c-a333-a9d55bdb2d43", "comment": "Malware payload (Mirai)", "value": "ec970797c4ef91721d11af254807d6f9624fc0289a42a8138d3586081cfdaeeba590418c43db92eb41350833907769e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977350, "uuid": "23a20f67-2f15-4e48-ad5f-0cfbd492952a", "value": "T12C2318F5D602C1F4DC2011706036BB56AF71C3726639EA47DFA92632AC07B8C9A1B76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977350, "uuid": "7807b5e4-d8b1-4f1e-bbb9-ee1906bf56f4", "value": "768:IG5hPSSqQGyXUWD5xyJr9QYy0yzWqZrnXMm+1xcvfJ+nt+409QNmILI74YYYYYYo:N59SSqPykgynQYCWI7MTxU+t+40imIc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764977350, "uuid": "4c23eac4-fc3e-4d55-b8e5-3f37770d3aa2", "value": 46448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764977350, "uuid": "6e2e30e3-6038-4d66-b70b-5e274af3d1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764977350, "uuid": "58b1a31c-3843-4f35-9429-7ff3c9e3c66c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f801ff6-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764959036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959036, "uuid": "8cb049b4-11c7-4518-b078-f50698181a4b", "comment": "Malware payload (Mirai)", "value": "28f97008b6fd9aa71d92cd2f91abe7c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959036, "uuid": "47e9580a-57e6-48d0-ba82-450cec7f75ff", "comment": "Malware payload (Mirai)", "value": "fbe254681cab293ab4ce8ff3cf19c7debc8f9c4edb48e52f01fd0ddc714aff7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959036, "uuid": "7db107ed-e226-4108-a279-62bf64c24b66", "comment": "Malware payload (Mirai)", "value": "e740d17d91ad61091c127026cbd21f090535ebcc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764959036, "uuid": "bf9f29c0-6edf-42d5-b1b7-9e9a80e3537c", "comment": "Malware payload (Mirai)", "value": "e9c36f2951378f2dc83f7fc5ad05f5d5cb78eb46676169960590e9370a172657bbc5e5dc604ff622a7faea99af4ef56c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959036, "uuid": "c99e2469-9fab-44ab-885d-4fdb254ca7a3", "value": "T128F090B8E05E3E56420DAD4BF266080EA07783CE402BCF9AFC94B039619C5803076F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959036, "uuid": "20800b94-2572-4e72-b2c8-fa5519d373a8", "value": "6:St5/ebTZ6WY+x8t5/oaKZjXI+x8t5/+LzPEixx8t5/+sNELx8t5/+6NIF+KZEBF5:AhyT6hfJDh+Lsh+sZh+6NIbMDh+HG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764959036, "uuid": "a8e96021-88a7-43b3-bf23-1a72029e5b5f", "value": 498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764959036, "uuid": "4628b143-2424-4388-8519-77d71467bad1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764959036, "uuid": "26eaf1cb-d72b-45a2-aa60-ada7d663f86f", "value": "li.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79232fb9-d1e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764943966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943966, "uuid": "1b66b551-5f03-4da7-a312-c489ba063e84", "comment": "Malware payload (Mirai)", "value": "0a8b43deec27cc45131ae1df6c691d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943966, "uuid": "b0b71203-3d0a-4650-a9d0-47a3eddabf7f", "comment": "Malware payload (Mirai)", "value": "fc0fe771434958f87fcdd5300b56dce03bfea8c797603df90ffc04405945510c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943966, "uuid": "4f0f3eca-bb72-40e5-9a0e-d5987173a84a", "comment": "Malware payload (Mirai)", "value": "0517f45f9cee68c6f5c7758d10970ec305e3ff19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764943966, "uuid": "eea4ade4-91b0-4a29-b918-4af50f922a9e", "comment": "Malware payload (Mirai)", "value": "9f4ee32308dea135dd37bc01e38f2680db5bee1e91b789d95bce4452647fa1459bc25335a9c0c67eb722cf4594acbbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943966, "uuid": "a6457c30-e59d-4640-a26e-bb93e552cd20", "value": "T1B5042331D2AFA2F68194886FF12B057759CC81D55898B433689EC2E853E38F34717E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943966, "uuid": "62f0c29c-9a3b-4043-beaf-6959b75e2f05", "value": "3072:TeahxN+XO6ExBlbAOh5STOUc/oin/DLA4kK6EumpU+FqVd07zE+PMR5LESW1Qmp9:BhHeO9lE6oO3wif3kfDqU+kVX95LEb1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764943966, "uuid": "1b28eb7f-cfdc-4fd4-9ff2-2a92f25fc8b7", "value": 185828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764943966, "uuid": "84560c0d-31ca-4553-99c3-8075c0dd1fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764943966, "uuid": "46728d66-b5da-4e97-abdc-a527bcc97406", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bf29f6-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958377, "uuid": "4dfbb1b2-ccc1-476c-81f8-c139f36bcd35", "comment": "Malware payload (Mirai)", "value": "4da667a260d5331c75a13d8691866d22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958377, "uuid": "fc9d352d-f5b7-4452-9a05-5c0844e6a981", "comment": "Malware payload (Mirai)", "value": "fc233811fb9cb82c6bbd692ee440262050b55cc1e2238b8803428cf52dbe539a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958377, "uuid": "45cdb0c6-657a-4bee-9c26-855877eefd9a", "comment": "Malware payload (Mirai)", "value": "25b2731f3ec2f6e9d2211147bfacca58b72e7d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958377, "uuid": "c24248e4-330c-4493-8e78-59b9cf773e9d", "comment": "Malware payload (Mirai)", "value": "d21fc523fb8f75f411a786b4d4329ae0c2c2dd92341df12824444ad5d1f6c5d290d18140df1c148331ceba5041f2cd1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958377, "uuid": "7bc36eec-b007-42c4-8e09-08fdf734c4bd", "value": "T1BD53F64AFD819B15D4D521BAFE0F514D33534BACE3FE72029E242B25678A96B0F7A801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958377, "uuid": "77daef41-849a-4486-ab22-9eb6bbb55ebf", "value": "1536:jBng2O2UUqZeXkErNtMxVBiL0HpyGq7lllM6niui0nFlWtu:e2O2UtWNtM7BiL0Jy53iOjWtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958377, "uuid": "6ebaa88a-d41f-4f83-8f9c-b02e3746a70c", "value": 62832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958377, "uuid": "efb1c0aa-2d46-4e0b-8053-9478585e941f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958377, "uuid": "ae5d3453-9dfe-49dd-9779-329e2eb8c19d", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ccad98-d1a6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764917405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917405, "uuid": "b2b3f6b2-6303-4d72-9568-550d1f6cd0a6", "comment": "Malware payload", "value": "9077295f0eb9db45fc495a04637ee197", "object_relation": "md5", "Tag": [ { "name": "167-99-224-13", "colour": "#18E60E", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917405, "uuid": "90654d1f-ce38-4b15-b343-58993d4f6761", "comment": "Malware payload", "value": "fc322ce85fd888497fa63d641100eb7626f8f4af3a9544fd20207f7c128f9df0", "object_relation": "sha256", "Tag": [ { "name": "167-99-224-13", "colour": "#18E60E", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917405, "uuid": "a52774b2-2400-40dc-ae4d-97b4e79aafdd", "comment": "Malware payload", "value": "7ba979aec530fbe025fb1b7de75ce86f0640f365", "object_relation": "sha1", "Tag": [ { "name": "167-99-224-13", "colour": "#18E60E", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764917405, "uuid": "f6de69b5-c9e9-4307-a27e-e07e2f7074f1", "comment": "Malware payload", "value": "9f9ae080deedafcec435fbb4de527fb80ce5a22ba384b6b09662f5182e756afaf21d105d7985844ba851c36f1fe9f3e8", "object_relation": "sha3-384", "Tag": [ { "name": "167-99-224-13", "colour": "#18E60E", "exportable": true, "hide_tag": false }, { "name": "206-71-149-51", "colour": "#69FC0C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917405, "uuid": "cc2f120b-3914-4df8-b8f5-66eff86f2614", "value": "T14F064A07EC9545E9C0AED235CA669293BA317C885B3223D73B90F7382F76BD06A75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917405, "uuid": "e375feb7-9778-4165-8960-0ae8b6205fee", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917405, "uuid": "db05c4d4-53d8-4159-aba7-dc960743a46a", "value": "49152:Tcsu+9nTbz0IbQHzMa77uxt9VYbSPe5En2EvLgXxrSR:31bpAd+VYbSP0En2BXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764917405, "uuid": "3a0ee836-95f5-4fa8-bbd3-fb4fa8678b49", "value": 3983872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764917405, "uuid": "b1282615-dda5-4f02-82f8-9ca39bed646f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764917405, "uuid": "20671eb9-0cfc-47d9-9334-d07bfcf236b3", "value": "fc322ce85fd888497fa63d641100eb7626f8f4af3a9544fd20207f7c128f9df0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a87ab02-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958920, "uuid": "64473b95-8115-444c-9edc-2b6aa5e82483", "comment": "Malware payload (Mirai)", "value": "c0467f0633c4d0ff0e59264ee7e668d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958920, "uuid": "2ec53b0a-1ff4-41ac-a9c3-6ee54d95adff", "comment": "Malware payload (Mirai)", "value": "fc703b31bb73328e252f90ac8a40c92fe6fcfa8539b8847d916d026618d83409", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958920, "uuid": "fe6eb40f-0778-44c6-a9bf-67b62c84c099", "comment": "Malware payload (Mirai)", "value": "17020e87a6b5ecf2991d06668cf98a61686371a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958920, "uuid": "6a453fe7-141e-40bc-8080-f87c17c1b49c", "comment": "Malware payload (Mirai)", "value": "84bbabcfa0b527a826023eaaf9409945c63c3485d5a745d2d82861ea4a694652fe85be8e9932aa7b1d8273a10fee7554", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958920, "uuid": "ccbc0635-0cff-43ef-b638-eaac90df08df", "value": "T1B5C08CBE002F2241C100FE1020B9301EB273CBC730B08B0A92C83833F48C420B232E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958920, "uuid": "d35d056a-58db-4b11-93db-704b624389bd", "value": "3:LxAjtyg/w8NBzSa+ANja8PeFKRDxAjtyg/pONBzSa5Ap9MVv:LA5/wkPjNaKDA5/My+Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958920, "uuid": "bfd5389d-a068-45c4-b5f1-89c0d0c7c8ee", "value": 158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958920, "uuid": "c1e0f857-8c8c-453b-90bd-ae305b2ccdee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958920, "uuid": "9cc452d8-1d22-4359-8030-30f9444c6f70", "value": "chomp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034f1ccb-d192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764908549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908549, "uuid": "dbbc759c-bf48-4198-9f1b-fa2cb27af467", "comment": "Malware payload (Mirai)", "value": "387cb6c65fb0384e37e73c7893f90998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908549, "uuid": "3dbd146f-db11-4b99-b5a5-a1145508929c", "comment": "Malware payload (Mirai)", "value": "fce77fb52f8a0c3ba071f752166b7d8b03d9911a9a69087c03aa0116cb6638ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908549, "uuid": "35a11df9-51ff-4f5d-9cac-5d8873cca6e0", "comment": "Malware payload (Mirai)", "value": "522eda27c0ed43d00fa8b0b2c53402bef720d999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764908549, "uuid": "c2556e34-99f5-4486-96f3-11143699bbe8", "comment": "Malware payload (Mirai)", "value": "010e260cd63dbdf86b0404e108036aa8523bd9b7c5453d65ecfdc6f4a0848e4105a02e43e60eb41585fe9c6b451c4597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908549, "uuid": "5bf1294e-891a-470c-8e5e-e40b0e37c448", "value": "T104B38CEBF2471260C86246F007CB4BED3E2322816F27C5E77D2A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908549, "uuid": "2600654a-f150-478b-b508-ce8751d9ae35", "value": "768:ia85XyaNNPzJPy0Ku9iXOCB/wsnCoGARPHWeSZyuqJ80F7Z4t2mMxgIwBpn554R8:itX5NbAeCBzPJWLcuq+qhmqgJ6/LWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764908549, "uuid": "b986610d-1970-4601-87dc-8486d6cab913", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764908549, "uuid": "614ebcf0-f0ac-4609-9250-ff172437fa19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764908549, "uuid": "02572baa-259c-4ef7-b2ca-ad31af7d2bf7", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffdd28d-d206-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958446, "uuid": "1a9e249b-6652-4abc-b7c5-d0d22f7ebd2b", "comment": "Malware payload (Mirai)", "value": "8a135c080ed02cfdb64d87d1a87a1392", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958446, "uuid": "ad27eec9-fb67-45fb-b6ca-92022e41110f", "comment": "Malware payload (Mirai)", "value": "fd0bcf440ac26f9475e8145826f142712e24fba58ecf1f7cb37cd903be89deeb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958446, "uuid": "a2c93ce0-de00-4485-a35b-c86429912547", "comment": "Malware payload (Mirai)", "value": "5c1f5d33ddd200c2187d75b3c2e1ae2036994736", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958446, "uuid": "fdefd900-83e5-4150-8a5a-6b3b54867ba4", "comment": "Malware payload (Mirai)", "value": "233ed37ef3ace9f8e0d69bedf9fb4d3d54cfe814636f6306d08a9db464ea71d4e1c8361140f25d5867d26c4b8fc54324", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958446, "uuid": "a3304acb-d89a-4693-8948-b5050652cc5c", "value": "T1B3F036DF107008595080B90EF9B3DC26B35E76E92CC51F8C595E0E3DA19D91EB815F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958446, "uuid": "fc6a3fac-b4d8-4b2c-a3f8-dab18aab94cf", "value": "12:t9DeZD9XHWMJ96HWMpzv9pzMHWMPIjD9PIMHWM6D9LHWq:t9SZVW1W4zzzGWcIhWLNWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958446, "uuid": "4d14fd09-97ab-447a-bcde-7e3bfb4b3dca", "value": 647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958446, "uuid": "41630d9f-c665-4f82-9e83-bfbd6d44f7df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958446, "uuid": "574a9621-2b88-4be2-9645-9085c52e7988", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af4a716-d1b7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764924668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924668, "uuid": "b8fc0762-204b-464a-8677-21c490bf38ef", "comment": "Malware payload", "value": "8ccfdbf089d6b2fed30174454048508a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924668, "uuid": "2dee7b4d-1b76-46f3-be2c-9cbebf89b7d9", "comment": "Malware payload", "value": "fd6ec293c37abd2d832659697d42c781727b0d32ba6bba3f0387b0dedaabe74e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924668, "uuid": "9c06131b-2ef9-4755-b773-8ce198863a50", "comment": "Malware payload", "value": "f07515b207389276601bb21b78ffe38b82cd16d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764924668, "uuid": "0e05080a-7181-4692-b5ac-eecff867d423", "comment": "Malware payload", "value": "d356c5f380901e5826eb09315dac5ab94ebe1f46835ed8cc991027899c310fe2ec198c0e5d19ae6a15bdad98043c8d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924668, "uuid": "412b1a58-aac3-4f44-875e-381c060aaf1e", "value": "T10A758C13F9B1447CD9EBC8314A5E84B7A731B4298116BE6B3968EA303D15F23AF0CB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924668, "uuid": "bcce41f4-c153-4717-a1ee-8ed31671b7de", "value": "49152:LvsxSkHfWIERAPrMCBwVeYyx4qdV3gxIYGx2LiDwL:L0boej4LiEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764924668, "uuid": "134e80b8-9379-4fc6-b239-81bc6b77f02a", "value": 1574168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764924668, "uuid": "56921ffd-4016-439a-8c46-7b5cc1b38216", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764924668, "uuid": "fdfd867f-74a2-43bc-8c1f-e8c7422f974a", "value": "clientx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cc2660-d1ac-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764920063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920063, "uuid": "173f5502-bb82-467d-b9a7-ede962fb9530", "comment": "Malware payload", "value": "328eaac2117ff62d34fec8175cc72900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920063, "uuid": "3356ec03-a3c3-4d23-8bad-788cd5a721ef", "comment": "Malware payload", "value": "fde3819fe90193bd64f3e6257a9a7e683aa359405e40f56658ea56cae46ed8a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920063, "uuid": "2d18e733-e22f-48a0-9c10-78cc9da13680", "comment": "Malware payload", "value": "767d274aaf67aac1b01764ba95afdfdcfc0285da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764920063, "uuid": "29ebee82-ba08-4446-88f0-688936ab4cef", "comment": "Malware payload", "value": "36c62b9e10243daf0d07cd6b16b747dd1a9a8ecd0284a7f1da1be5dc871cb103b2aae7916d906f8553475038bfeeda9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920063, "uuid": "10bc5da8-dc5d-4944-9b95-33ef7b66d9d2", "value": "T17877334CB1E058CEFEBB913F8455C8068F69B1D39BE2C89E079899321C57AEC1D35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920063, "uuid": "81b02d24-fe0e-4730-aa66-fb495efde0cf", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920063, "uuid": "bb1d9595-57f5-4858-a3c2-6e2af62d6872", "value": "786432:IujmF/XktzMFlUR1OiAhnCdsqVtcQT1RYyyvV/M8+N5B1/P8Dpw4j:IXZkZMEWHVCdsacaDH8+N5BZ2pw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764920063, "uuid": "695c5498-dce3-4d5b-bbc1-043265204743", "value": 32840946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764920063, "uuid": "0a47a3d1-6b03-4c60-857e-acfcd5398028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764920063, "uuid": "3d3e8e4d-d704-4929-bd32-414dd0f01cb3", "value": "MicrosoftUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a13aec-d1fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764953622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953622, "uuid": "ec4f9733-c591-4dda-bbac-bcb7cd571ce0", "comment": "Malware payload (Mirai)", "value": "edc50fcf778ae0a4f3d955d188054f26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953622, "uuid": "0b7fa15c-eda8-4906-a392-1b8292192be7", "comment": "Malware payload (Mirai)", "value": "fef373bf40a142121f11c89ab4d5c1f6aff9ee3c5c214aa349bc75baa1c32714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953622, "uuid": "22d80ae0-0e79-441c-9590-8f8e7cf2d4c8", "comment": "Malware payload (Mirai)", "value": "57dfa34c22c2f4cbbf7476937859d1a84c6b4666", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764953622, "uuid": "95f81ea5-758a-4354-9eda-d51c8f78b0d0", "comment": "Malware payload (Mirai)", "value": "76006539d05addec299ad7f4a138f318d34c454fbd11484add83b7a5912cbc20100f826c844501cc9c255f59397e1071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953622, "uuid": "b7bb3e46-e34c-494d-abdf-2503b1f99883", "value": "T14DB35A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953622, "uuid": "d3a16c43-d3ef-4715-9d01-2b0f3431252f", "value": "1536:1a97/6/q0AmnClRL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zB:1y6HClRZn+MCISxPKO8WL7t4LbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764953622, "uuid": "aaee0325-3600-44ec-b696-b3b79ff8c2d5", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764953622, "uuid": "a8c8440e-b743-4c3c-961f-83ab0071ef11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764953622, "uuid": "ba413abe-5ea8-4afd-86d9-57ba5716b118", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494e2169-d1a9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1764918545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918545, "uuid": "e1468804-d131-4499-9738-988e02b074d8", "comment": "Malware payload", "value": "f29ad78b8ba73814a1eea4f27cce8005", "object_relation": "md5", "Tag": [ { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918545, "uuid": "8b0cc1f8-7005-4a28-8054-5112e1608c25", "comment": "Malware payload", "value": "ff26a397fef929b7d602fd18e232682a04d200cf883c870d0b493745085bc4bd", "object_relation": "sha256", "Tag": [ { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918545, "uuid": "d6d28202-2091-4510-97a4-4f4a3d69e27c", "comment": "Malware payload", "value": "25bcc477af174691b580c26452b5fc3b415906d7", "object_relation": "sha1", "Tag": [ { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764918545, "uuid": "05b5a48a-e600-4de1-bbb0-7912d1ed9111", "comment": "Malware payload", "value": "8eefeea8f6350a439c6dfbab59f52ae4a2f759b82989ccde0e37e131398d7af1ba4186514d822955478ac05ce3924ada", "object_relation": "sha3-384", "Tag": [ { "name": "196-251-86-145", "colour": "#DBF24E", "exportable": true, "hide_tag": false }, { "name": "51-79-214-125", "colour": "#DD3DEC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918545, "uuid": "2760b422-200a-472e-ab1b-d605f6d86432", "value": "T16A3502118AC42FB9DFAC5A19C0BE161F63F15A8A9017B5CDE7337D07AFEB904021B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918545, "uuid": "03ca34a6-d627-4b7a-b61a-ca8b315909f2", "value": "24576:nV5fVF6lqk05lc2D1IK/cRCtws81hoHw1iFvS:VFByKXWT8QgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764918545, "uuid": "6c921cc0-6dd8-472a-9c48-46b0e872107a", "value": 1101168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764918545, "uuid": "7fd91ff5-1784-41de-b4fb-b78c3e97c319", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764918545, "uuid": "5d3edd81-0539-4515-8abc-57f63c16769a", "value": "ff26a397fef929b7d602fd18e232682a04d200cf883c870d0b493745085bc4bd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214f1d55-d17a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764898292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898292, "uuid": "b72b1864-28e9-4894-ab12-f0821b0a8df1", "comment": "Malware payload (Mirai)", "value": "e92eca4ff7b756f28c8d6ac184e33a7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898292, "uuid": "8be3f1d6-2f54-474f-bd94-91a6d037c042", "comment": "Malware payload (Mirai)", "value": "ff2f5e19ffcb1d722090b88cec0d012d71f50a79fc0cdc514be5a19b76ea8805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898292, "uuid": "65b02306-cec0-4000-9171-2b56bc219aa1", "comment": "Malware payload (Mirai)", "value": "b9f64d1c7838b75531135f931b1f6829c3b771c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764898292, "uuid": "c32ae93e-88da-4496-b3a6-977c0df812b8", "comment": "Malware payload (Mirai)", "value": "bf75149bb57556a62a275715044b6a416cacca123aac909cd6944ca6517972bef5334f74a3285c1a40e8797349dacec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898292, "uuid": "148fe6a8-28b1-42eb-8658-abc6a27cf2c0", "value": "T1C2935D02B62C0A47E4A35DB4293F17D193BFE95020F4BA89695FDB1A8635E331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898292, "uuid": "fcb05d57-9cc0-4222-8737-ed2a397446d7", "value": "1536:U7f3Kt1Th0c0sJbVLDVt5MYoJz3DBJj9QPiOT6joeFSAi2FdfkpuRBdC:U7f3Kt1Th0c0sJbVLDVt5M3tFO2Bm2F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764898292, "uuid": "bff67b0f-f622-4f64-9d48-3a7f01f6b112", "value": 95852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764898292, "uuid": "24e374c5-bf72-475d-9c3b-d3ba4b3eaf17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764898292, "uuid": "eec7001f-0558-4c8a-ac81-e09404dc8bfc", "value": "UnHAnaAW.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74600896-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958990, "uuid": "2d279539-8c00-42a4-85c2-eee832c95634", "comment": "Malware payload (Mirai)", "value": "7ee34ab03cfeac318780f61cd1e59f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958990, "uuid": "2b70a447-68ef-4144-a205-0610b1fcbd88", "comment": "Malware payload (Mirai)", "value": "ff3385e6e24eb1d3b6919bba2372e87fdbe81b8b079b1cc9daf1db5ce0ca8645", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958990, "uuid": "b641bd8d-c358-4a2d-9db6-6d397e99cf7f", "comment": "Malware payload (Mirai)", "value": "ec6c8fa47963a7cb2afa944b329ce938a88a0301", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958990, "uuid": "58dc7e99-0702-4d92-a88e-b7cd88e572b1", "comment": "Malware payload (Mirai)", "value": "13f6079abfe869168d8b4f464209a3219baa4e04582d816630a22c4b381335e66dd9d5de07609bd495ab9818fc7cc6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958990, "uuid": "aaa481bd-0a2f-468a-8da0-53250aba4717", "value": "T130333BD6AC00AC7CFD4BE6BE84120B08F960375561931F2B66BAFDA35D722A44C56DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958990, "uuid": "2886c8ab-4dbc-444f-a71e-39b662718d32", "value": "1536:jWPiw0dX06QJSERayXE3dBTnU8u5Zqfq/mGdPjM:jWPiJERXE3dBzSw+mELM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958990, "uuid": "d0837bf7-98d4-41fc-b7ab-2c89ef7650de", "value": 54340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958990, "uuid": "33a7babf-dc06-4a8b-8d0e-7edeb3c4732c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958990, "uuid": "028bda64-2520-4a32-bfb7-8f3bece77c13", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fffc8d-d207-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1764958855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958855, "uuid": "bfc1a38d-226d-4595-868c-449a021718c4", "comment": "Malware payload (Mirai)", "value": "5aa390ed076787b0760b37fd10c70aee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958855, "uuid": "96c96ab1-499a-410f-b239-6464cd7bcde8", "comment": "Malware payload (Mirai)", "value": "ffdb017572f213cd5b75e18aada87854f089f517394385b96857fc627884dc79", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958855, "uuid": "d1ec748b-08fe-46f4-9965-4b0c9d4ad562", "comment": "Malware payload (Mirai)", "value": "acc48b4d48e0757e40d8a6868fc82ca77809e20f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764958855, "uuid": "4cbbcbfe-96e3-4387-8032-0aa38f954ad5", "comment": "Malware payload (Mirai)", "value": "5e45c0671042ebfd85cd6d80dcaf48d26ab0ed0927a2fa12af8acc2537864064ba3ca8a2b1a882e44f65cb9293d129dc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958855, "uuid": "489a5514-7733-4bbe-947a-c187f79ee7b1", "value": "T1C711547D002FFF1681046E15B127B436707287EA71B79F459DC874B6B1DC9627232E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958855, "uuid": "64214891-f568-4584-b4fc-7a7cefa9f009", "value": "24:pRrMyMftQMlaLaNggSNILSERDK61n/0bNNljnXd:oBfaLaS8hHwNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764958855, "uuid": "c3e4d887-bbb7-49d2-80c5-5ee9333384f5", "value": 913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764958855, "uuid": "0a234b43-9f78-43dc-a69a-537ebe4705e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764958855, "uuid": "f9894ae6-9f92-436b-92bb-22862fbf5b65", "value": "zm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d59aa96-d17d-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1764899708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1764899708, "uuid": "a919ec1b-bab9-4aad-9055-60e85a859e53", "comment": "Malware payload (AsyncRAT)", "value": "3b6a0296e223a2008aa5532e66eb45d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1764899708, "uuid": "0a12600b-253b-401c-ac2a-382c7ba25795", "comment": "Malware payload (AsyncRAT)", "value": "ffe62ce01381e57eeed388498cce63803de8f7a9093d0c9b8ff821179d65aeee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1764899708, "uuid": "45950687-6b86-405b-987f-ae99be763c79", "comment": "Malware payload (AsyncRAT)", "value": "04c1c126bf33d8d482375d84d891157ea6009c59", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1764899708, "uuid": "7e923688-f871-4beb-8b44-18838b33eb49", "comment": "Malware payload (AsyncRAT)", "value": "a4666f8d8664c5d1b6e0aa178fa1c007349df4197abf526d9accc132c94ec8d7c0add528dbf82a729b9ceda4c621153b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1764899708, "uuid": "4e326e3d-030b-43c1-ac6d-bb77dddfdb9a", "value": "T119C4CF987250B5AFC417DA3249A4ED74A6206D7B931BC20395E70DAFB90DAD7CF042F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1764899708, "uuid": "92737ed5-4cc2-437a-b572-13a10a126441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1764899708, "uuid": "2b1f5014-2715-436f-a412-99979a4f0461", "value": "12288:crKr1psyTQmPoHsk94dzCFOGbkZ1+k5dDDs2nMU5C0aNdn8V9V1J87FVN5gl1G:hps0QmY3mGFOMs75lDxXFe8J1pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1764899708, "uuid": "57fb8046-6aff-4aa2-9195-2712fd063fd1", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1764899708, "uuid": "a4953c41-d62c-4ec8-b24e-28d66e290b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1764899708, "uuid": "b8c6a8cc-715e-4aa3-98fa-15aa521b273c", "value": "Quote#Request20250000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }